Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is it possible to know who uninstalled a specific application from Windows 7 event logs?

share|improve this question

2 Answers 2

up vote 6 down vote accepted

There is no 100% way to do this, such as if it was using a custom made installer that didn't log anything, but fortunately most installers use Microsoft's installer service (MSIs). The Installer Service logs everything into the event viewer.

  1. Right click on "Computer" on your desktop / start menu and hit "Manage".
  2. Under "System Tools", expand "Event Viewer", "Windows Logs", and select "Application".
  3. On the right, click "Filter Current Log"
  4. In the new dialog, for the "Event sources" drop down list, select "MsiInstaller"

That will filter the log to any Windows installer related actions. If you know an approximate date / time you can look there. Or, you can click "Find..." on the right to try and search for a particular string. The event text will look something like this:

Windows Installer removed the product. Product Name: <product>. Product Version: <version>. Product Language: 1033. Manufacturer: <manufacturer>. Removal success or error status: 0.

Once you've found it, the user performing the action will be displayed under "User".

share|improve this answer
    
I guess this only works for apps using MsiInstaller but thanks for the information. This will really help us a lot. –  Francis Jun 16 '11 at 1:56

Windows does not keep a uninstall log, sometimes the program will leave one behind that may give some information, but I do not believe you will be able to find who did the deed.

share|improve this answer
    
"Windows does not keep a uninstall log", well, yeah, it does when it can. –  vcsjones Jun 16 '11 at 1:44
    
Windows does not keep a uninstall log,the Event log only logs some uninstalls and in most cases not very helpful but I would look for Event ID: 1034 he may get lucky. –  N4TKD Jun 16 '11 at 2:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.