Doug,
Thanks for the shout-out. I'd suggest that the price is MORE than right…for what RegRipper does, getting it for free is much more than just "the price is right".
Harlan you normally are to humble about RR so I softened the recommendation lol It's invaluable and priceless
For what the registry holds and says about the actions of a user it really is a great place to start any investigation as it shows so many environmental settings that can point you at what files to start looking at or for.
Also, many times the questions asked is about the users interaction with removable devices and network connections - this can be found very quickly with proper registry examination.
This may seem like a really simple answer but could still give you a clue. When you install many programs the setup will prompt you to ask whether you want a shortcut to the program to be available to all users or just the one that is installing it. So you could look at each user's Start Menu shortcuts and if a shortcut to a particular program only exists under one user profile then this may be a pretty good indication they are the one that installed it.
Obviously not surefire because any user could delete the shortcut from their Start Menu, but it's an indication.
…if a shortcut to a particular program only exists under one user profile then this may be a pretty good indication they are the one that installed it.
However, if you parse the UserAssist key entries from the NTUSER.DAT hive, you'll see where and when the user launched the installer application.
There are more definitive methods for determining the answer to this question, and guesswork and maybe aren't required.