Is there a Windows 7 uninstall log that shows who uninstalled what?

Question

Is it possible to know who uninstalled a specific application from Windows 7 event logs?

Solution 1

There is no 100% way to do this, such as if it was using a custom made installer that didn't log anything, but fortunately most installers use Microsoft's installer service (MSIs). The Installer Service logs everything into the event viewer.

1. Right click on "Computer" on your desktop / start menu and hit "Manage".
2. Under "System Tools", expand "Event Viewer", "Windows Logs", and select "Application".
3. On the right, click "Filter Current Log"
4. In the new dialog, for the "Event sources" drop down list, select "MsiInstaller"

That will filter the log to any Windows installer related actions. If you know an approximate date / time you can look there. Or, you can click "Find..." on the right to try and search for a particular string. The event text will look something like this:

Windows Installer removed the product. Product Name: <product>. Product Version: <version>. Product Language: 1033. Manufacturer: <manufacturer>. Removal success or error status: 0.

Once you've found it, the user performing the action will be displayed under "User".

Solution 2

Go to your event viewer, go to application event log, right click on it and select filter current log, then select MSIINSTALLER. This should give you what you need

Comments

[Rinat Hatipov]

"Windows does not keep a uninstall log", well, yeah, it does when it can.

[FrancisV]

I guess this only works for apps using MsiInstaller but thanks for the information. This will really help us a lot.

[N4TKD]

Windows does not keep a uninstall log,the Event log only logs some uninstalls and in most cases not very helpful but I would look for Event ID: 1034 he may get lucky.