A patch was recently run that broke some things. We are trying to figure out if it was installed by someone on the network, or if it was an automatic update. Is there a way in Windows to figure this out?


Probably not with 100% certainty if it was a specific user, but probably if it was automatic. To check the automatic possibility, check to see what time your automatic updates are scheduled for here: Windows Update>Change Settings. Then can go into your Event Viewer, to the "Setup" log, and see if there were updates performed at that time, which correspond to your Windows Update time.

If it was a specific user, unless you have previously increased the Security logging, or have another application doing this, the chances are not good. You would still have to compare the Setup log to the times the person was logged in.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.