Tracking Down Who Installed or Removed a Program or App

by Allen Wyatt
(last updated September 12, 2016)

1

If you manage a system that is used by multiple people, each with their own login to the system, then you may find it helpful to know which of those users installed a program or app. For instance, a user may have downloaded and installed a program that is causing problems, and you need to talk to the user who actually did the installation. Similarly, you may need to know who uninstalled a particular program from the system.

Provided that the program was installed or removed using the normal MSI installer built into Windows, you can find out the information you need by examining the event logs maintained by Windows. Go ahead and start the Event Viewer; the easiest way is to use the searching capabilities of Windows, looking for "Event Viewer," without the quote marks. Once the program is started—it can take a few moments to load—you are greeted by the initial screen. (See Figure 1.)

Figure 1. The Event Viewer's initial window.

In the right pane, near the top, click the Filter Current Log option. Windows displays the Filter Current Log dialog box. The Filter tab should be displayed in the dialog box. (See Figure 2.)

Figure 2. Filtering an event log.

Using the Event Sources drop-down list, choose the MsiInstaller option. This instructs the Event Viewer to display only events generated by the installer, which is exactly what happens when you click the Apply button.

In the resulting set of filtered events, look for an event that was logged around the time you figure that the installation or removal occurred. When you find one that looks promising, you can select it and view its details in the viewer. Among those details is the name of the user account that was active when the installation or removal occurred.

You should note that this approach will only work if the system users only use their own accounts—in other words, users log out and log in as they should on the system. If everyone shares a common login, then the user information in the event log will be of little value. (It will tell you the event occurred, but you have no indication as to who performed the event.)

Also, if the program installed or removed didn't use MsiInstaller or it used a method that doesn't utilize the event logs, then you won't be able to find the events by following these steps.

 This tip (13465) applies to Windows 7, 8, and 10.

Author Bio

Allen Wyatt

With more than 50 non-fiction books and numerous magazine articles to his credit, Allen Wyatt is an internationally recognized author. He  is president of Sharon Parq Associates, a computer and publishing services company. ...

MORE FROM ALLEN

Stepping Through Head Formats

You can use the shortcuts described in this tip to quickly change the heading levels of the headings in your document. You'll ...

Discover More

Relative VBA Selections

Need to select a cell using a macro? Need that selection to be relative to the cell you currently have selected? Here's the ...

Discover More

Deriving High and Low Non-Zero Values

When analyzing your numeric data, you may need to figure out the largest and smallest numbers in a set of values. If you ...

Discover More
More WindowsTips

Deleting Events in Your Event Logs

You don't need to worry about event logs filling up your disk, but you still may want to clean them out eventually. This tip ...

Discover More

Creating a Custom View in the Event Viewer

Creating a custom view in the Event Viewer allows you quick access to those events you're interested in watching over time. ...

Discover More

What is the Purpose of the Application Event Log?

The Application event log holds messages generated by applications and services. This tip explains more about it.

Discover More
Subscribe

FREE SERVICE: Get tips like this every week in WindowsTips, a free productivity newsletter. Enter your address and click "Subscribe."

View most recent newsletter.

Comments

If you would like to add an image to your comment (not an avatar, but an image to help in making the point of your comment), include the characters [{fig}] in your comment text. You’ll be prompted to upload your image when you submit the comment. Maximum image size is 6Mpixels. Images larger than 600px wide or 1000px tall will be reduced. Up to three images may be included in a comment. All images are subject to review. Commenting privileges may be curtailed if inappropriate images are posted.

What is nine minus 3?

2016-09-12 18:55:22

Tim

Just under Figure 1 you say
"In the right pane, near the top, click the Filter Current Log option."
... but when I tried, the option was labelled "Create Current View" (on my Windows 7) which is the same as your Figure 1.

Is "Filter Current Log" the Windows 8 and Windows 10 label?


Newest Tips
Subscribe

FREE SERVICE: Get tips like this every week in WindowsTips, a free productivity newsletter. Enter your address and click "Subscribe."

(Your e-mail address is not shared with anyone, ever.)

View the most recent newsletter.