Some users in our environment have elevated accounts just for their own machines. This account does let them install any software they'd like. There is a specific naming convention to all these accounts, something like: P_username (the P_ indicates the privileged account. I believe there are only two event ID's tied to software installs, 11707 and 1033. So we'd like to have a report that shows any software installs performed by these P_ accounts.
