In this post I will show you how to find who uninstalled application from Windows Server. This should help you track the user who uninstalled the software.

Your Windows Server running in production is critical and also the applications installed on it could be important. As an admin you don’t want anyone with uninstall an application from server without any prior approval.

What if you find out that one of the application has been uninstalled from your Windows Server ?. What would you do to track the user who uninstalled the application.

Install and Update Third Party Applications with Patch My PC
Install and Update Third Party Applications with Patch My PC

There are lot of third party softwares that allow you track the changes. If you don’t have those tools, you don’t need to worry. That’s because you don’t need any third-party software to find that out. Using the Windows event viewer you can find the user who removed or uninstalled software from server. This is very similar to how we find who restarted the server.

Windows does not keep a application uninstall log. At least for not all the applications that you uninstall. While the Event log only logs some uninstalls, Event ID 1034 is most helpful in this case.

The steps listed below should also help you to find the user who uninstalled the software on your Windows 10 computer.

How to Find Who Uninstalled Application

Here are quick steps to find who uninstalled the application from the server or Windows 10.

  • On the Server run the command eventvwr to launch Event Viewer.
  • In the Event Viewer, expand Windows Logs, and select Application.
  • Right click Application and click Filter Current Log.
  • In the new dialog, for the Event sources drop down list, select MsiInstaller.
  • One of the events should reveal the user who uninstalled the application.

Launch the event viewer and expand Windows Logs. Right click Application logs and click Filter Current log. We filter the logs because out of many logs, it becomes easier to find the required one.

Filter Application Logs
Filter Application Logs

You can either filter the logs with event ID 1034 or use the event sources as MsiInstaller. Next to event sources, click the drop-down and select MsiInstaller.

Event sources Select MsiInstaller
Event sources Select MsiInstaller

Probably you may find lot of logs with MsiInstaller as source. Scroll down through the events and look for event id 1034.

The Event ID 1034 clearly tells us the name of application that has been uninstalled and the user account who uninstalled it.

Windows Installer removed the product. Product Name: 7-Zip 19.00 (x64 edition). Product Version: 19.00.00.0. Language: 1033. Manufacturer: Igor Pavlov. Removal success or error status: 0.

Find Who Uninstalled Application from Server
Find Who Uninstalled Application from Server

Still Need Help?

If you need further assistance on the above article or want to discuss other technical issues, check out some of these options.

Prajwal Desai

Prajwal Desai is a technology expert and 10 time Dual Microsoft MVP (Most Valuable Professional) with a strong focus on Microsoft Intune, SCCM, Windows 365, Enterprise Mobility, and Windows. He is a renowned author, speaker, & community leader, known for sharing his expertise & knowledge through his blog, YouTube, conferences, webinars etc.