Tracking Down Who Installed or Removed a Program or App

by Allen Wyatt
(last updated September 12, 2016)

1

If you manage a system that is used by multiple people, each with their own login to the system, then you may find it helpful to know which of those users installed a program or app. For instance, a user may have downloaded and installed a program that is causing problems, and you need to talk to the user who actually did the installation. Similarly, you may need to know who uninstalled a particular program from the system.

Provided that the program was installed or removed using the normal MSI installer built into Windows, you can find out the information you need by examining the event logs maintained by Windows. Go ahead and start the Event Viewer; the easiest way is to use the searching capabilities of Windows, looking for "Event Viewer," without the quote marks. Once the program is started—it can take a few moments to load—you are greeted by the initial screen. (See Figure 1.)

Figure 1. The Event Viewer's initial window.

In the right pane, near the top, click the Filter Current Log option. Windows displays the Filter Current Log dialog box. The Filter tab should be displayed in the dialog box. (See Figure 2.)

Figure 2. Filtering an event log.

Using the Event Sources drop-down list, choose the MsiInstaller option. This instructs the Event Viewer to display only events generated by the installer, which is exactly what happens when you click the Apply button.

In the resulting set of filtered events, look for an event that was logged around the time you figure that the installation or removal occurred. When you find one that looks promising, you can select it and view its details in the viewer. Among those details is the name of the user account that was active when the installation or removal occurred.

You should note that this approach will only work if the system users only use their own accounts—in other words, users log out and log in as they should on the system. If everyone shares a common login, then the user information in the event log will be of little value. (It will tell you the event occurred, but you have no indication as to who performed the event.)

Also, if the program installed or removed didn't use MsiInstaller or it used a method that doesn't utilize the event logs, then you won't be able to find the events by following these steps.

 This tip (13465) applies to Windows 7, 8, and 10.

Author Bio

Allen Wyatt

With more than 50 non-fiction books and numerous magazine articles to his credit, Allen Wyatt is an internationally recognized author. He  is president of Sharon Parq Associates, a computer and publishing services company. ...

MORE FROM ALLEN

Recovering Password-Protected Documents

Got a locked document you just need to get into? It may be quite easy (or next to impossible) using the ideas in this tip.

Discover More

Non-Printing Hyperlinks

Karen is having problems getting hyperlinks to print in a document on her home computer. There are only a limited number of ...

Discover More

Ignoring N/A Values in a Sum

You can use some of Excel's worksheet functions across a range or worksheets, but not all of them. One that has problems with ...

Discover More
More WindowsTips

Filtering Event Logs

Filtering a log in the Event Viewer allows you quick access to those events you're interested in watching over time. This tip ...

Discover More

Deleting Events in Your Event Logs

You don't need to worry about event logs filling up your disk, but you still may want to clean them out eventually. This tip ...

Discover More

Adjusting the Size of an Event Log

Event logs are used to store information about what goes on, behind the scenes, on your system. Whether you want to increase ...

Discover More
Subscribe

FREE SERVICE: Get tips like this every week in WindowsTips, a free productivity newsletter. Enter your address and click "Subscribe."

View most recent newsletter.

Comments

If you would like to add an image to your comment (not an avatar, but an image to help in making the point of your comment), include the characters [{fig}] in your comment text. You’ll be prompted to upload your image when you submit the comment. Images larger than 600px wide or 1000px tall will be reduced. Up to three images may be included in a comment. All images are subject to review. Commenting privileges may be curtailed if inappropriate images are posted.

What is five minus 0?

2016-09-12 18:55:22

Tim

Just under Figure 1 you say
"In the right pane, near the top, click the Filter Current Log option."
... but when I tried, the option was labelled "Create Current View" (on my Windows 7) which is the same as your Figure 1.

Is "Filter Current Log" the Windows 8 and Windows 10 label?


Newest Tips
Subscribe

FREE SERVICE: Get tips like this every week in WindowsTips, a free productivity newsletter. Enter your address and click "Subscribe."

(Your e-mail address is not shared with anyone, ever.)

View the most recent newsletter.