Checking info on bad employee

[Niclo Iste]

So I've been put on a test at work. I am forced to share a desk with a slob, liar, and slacker. He's so far installed a bunch of programs and claimed I did it to try and get me reprimanded or fired. I need to know how I can prove who installed it, when and also after the fact that they've been uninstalled. Mind you not a wiped hard drive. The biggest problem is McAfee as it's a huge no no here to install antivirus that isn't authorized. I need to figure this out before monday.

I also need to find a way to track his internet traffic as well. He wipes his history but I recall a way to track through the registry. Any ideas?

[Guts3d]

Punch him inna face. Then check both the system log and application logs. Then, verbally abuse him, making light of both his dubious ancestry and his offensive odors. I got your back.

[Niclo Iste]

I already tried looking at the event viewer, only me removing it showed and nothing about it being installed showed at all.

Believe me I will break his nose if I end up on the elevator with only him.

[MobilePCPhysician]

Install a software keylogger.

[CeeBee]

Unless he is an expert there will be traces left (temp files, installation files etc). Look at file attributes and see who the creator is. Hopefully you don't share the login...
Side note: many programs leave traces in %appdata%\local\temp

[Niclo Iste]

He may be using a scrubber program at the most. From what I have been told he's about as good at IT as a blindfolded monkey having a seizure.

[nunob]

http://www.nirsoft.net/computer_forensic_software.html

The IECacheview program is nice. I always run these things on the drive external not on the sytem live.

You may also consider that he is using a USB drive to do this in which case I typically just disable in gpedit.

[Guts3d]

I'll still come over and punch him inna face. I'll wear a derby so you will know it's me.