Hi!

This is pretty impressive stuff  :Thmbsup:

I thought I had disabled ntfslastaccess, apparently not (on this build).

Do you know if that has any impact on what is logged in the journal?

I'm specifically interested in the log (including @ least filename of setup.exe's, for example, ideally with full path in log if possible) of files that have been executed by the user...

Does the USN journal record this level of info?

Thanks