Is it possible to know who uninstalled a specific application from Windows 7 event logs?
There is no 100% way to do this, such as if it was using a custom made installer that didn't log anything, but fortunately most installers use Microsoft's installer service (MSIs). The Installer Service logs everything into the event viewer.
- Right click on "Computer" on your desktop / start menu and hit "Manage".
- Under "System Tools", expand "Event Viewer", "Windows Logs", and select "Application".
- On the right, click "Filter Current Log"
- In the new dialog, for the "Event sources" drop down list, select "MsiInstaller"
That will filter the log to any Windows installer related actions. If you know an approximate date / time you can look there. Or, you can click "Find..." on the right to try and search for a particular string. The event text will look something like this:
Windows Installer removed the product. Product Name: <product>. Product Version: <version>. Product Language: 1033. Manufacturer: <manufacturer>. Removal success or error status: 0.
Once you've found it, the user performing the action will be displayed under "User".
1I guess this only works for apps using MsiInstaller but thanks for the information. This will really help us a lot.– FrancisVJun 16, 2011 at 1:56
Go to your event viewer, go to application event log, right click on it and select filter current log, then select MSIINSTALLER. This should give you what you need
Windows does not keep a uninstall log, sometimes the program will leave one behind that may give some information, but I do not believe you will be able to find who did the deed.
1"Windows does not keep a uninstall log", well, yeah, it does when it can.– vcsjonesJun 16, 2011 at 1:44
Windows does not keep a uninstall log,the Event log only logs some uninstalls and in most cases not very helpful but I would look for Event ID: 1034 he may get lucky.– N4TKDJun 16, 2011 at 2:04