Unauthorized software install

Hi there, 

With the modules you have, you should be able to take the advantage of the SAM Asset Inventory monitoring: https://documentation.solarwinds.com/en/success_center/sam/content/sam-asset-inventory-sw1159.htm

This is essentially mirroring what is listed in the 'Programs and Features' section of a Windows Server so a good way to monitor installed programs. I would then personally create a report that lists all the asset inventory software, and you can then filter out any of the 'Authorized Software' from the report. 

There's an existing report called 'Software Inventory Report' that is a good starting point, but I would probably do a query on the Orion.AssetInventory.Software table myself - it depends on your level of SWQL knowledge. 

Server Configuration Monitor (SCM) would also be a good addition to your line up, as you can better compare asset inventories over time, rather than simply the 'current' status of the installed software:

If this helps answer your question please mark my answer as confirmed to help other users, thank you!

Marlie Fancourt | SolarWinds Pre-Sales Manager

Prosperon Networks | SolarWinds Partner since 2006

would this be a manual process?  I am looking for an alert at the time of install.

Then maybe SEM can watch the logs for install events. 

That was where I started.  But, it will only notify you of software installed with windows installer and if registry changes are made.  If someone was to install PUTTy this would not alert.

It would be a manual process to set-up the alerts originally but, after that, the alerts would fire automatically whenever a new piece of software is installed. This is the same as how it works with the rules in SEM.

SCM actually includes an out of the box alert for when the baseline changes, so you'd only need to create a baseline set of software and the alert will just give you a heads up when it changes: 

documentation.solarwinds.com/.../scm-define-a-baseline.htm