Figuring out Who Last Updated the Windows Server

Question

A patch was recently run that broke some things. We are trying to figure out if it was installed by someone on the network, or if it was an automatic update. Is there a way in Windows to figure this out?

Answer 1

Probably not with 100% certainty if it was a specific user, but probably if it was automatic. To check the automatic possibility, check to see what time your automatic updates are scheduled for here: Windows Update>Change Settings. Then can go into your Event Viewer, to the "Setup" log, and see if there were updates performed at that time, which correspond to your Windows Update time.

If it was a specific user, unless you have previously increased the Security logging, or have another application doing this, the chances are not good. You would still have to compare the Setup log to the times the person was logged in.