How to find log about uninstalling program on windows server 2008 R2?

Question

I want to know who and when uninstall the special program at windows server 2008 R2, but I can't find helpful post that describe how to do it, so I create this question, hope someone could help me!

Solution 1

Go to your event viewer, go to application event log, right click on it and select filter current log, then select MSIINSTALLER. This should give you what you need

Solution 2

While Ovi's suggestion would work for any MSI-based software, it won't work with software packages not based on MSI (and there are many, and for good reasons).

Our monitoring tool EventSentry can help you with this. As long as your XAMPP shows up in the control panel for all users, removing it can generate an alert in the application event log. You can also choose to get this alert emailed to you for example.

Of course this won't work after the fact, you will need to have EventSentry running while somebody removes the software.

We have a free version available (EventSentry Light) which includes that functionality as well. Disclaimer: I work for NETIKUS.NET.

Comments

[warren]

what "special program"? How is installed/uninstalled? Who is the vendor? We will need some more information to assist well :)

[dazhi]

I operated in accordance with you said and export the filtered event log to txt file, but I can't find word "xampp" in the file. I export all application's event log, only could find some word"xampp" that not related with uninstall, so seems the uninstall log of xampp didn't be recorded by windows 2008, that's inconvenient. Anyway thank you for your reply.

[Lucky Luke]

That's because this would only work for MSI-based software.