In this post I will show you how to find who uninstalled application from Windows Server. This should help you track the user who uninstalled the software.
Your Windows Server running in production is critical and also the applications installed on it could be important. As an admin you don’t want anyone with uninstall an application from server without any prior approval.
What if you find out that one of the application has been uninstalled from your Windows Server ?. What would you do to track the user who uninstalled the application.
There are lot of third party softwares that allow you track the changes. If you don’t have those tools, you don’t need to worry. That’s because you don’t need any third-party software to find that out. Using the Windows event viewer you can find the user who removed or uninstalled software from server. This is very similar to how we find who restarted the server.
Windows does not keep a application uninstall log. At least for not all the applications that you uninstall. While the Event log only logs some uninstalls, Event ID 1034 is most helpful in this case.
The steps listed below should also help you to find the user who uninstalled the software on your Windows 10 computer.
How to Find Who Uninstalled Application
Here are quick steps to find who uninstalled the application from the server or Windows 10.
- On the Server run the command eventvwr to launch Event Viewer.
- In the Event Viewer, expand Windows Logs, and select Application.
- Right click Application and click Filter Current Log.
- In the new dialog, for the Event sources drop down list, select MsiInstaller.
- One of the events should reveal the user who uninstalled the application.
Launch the event viewer and expand Windows Logs. Right click Application logs and click Filter Current log. We filter the logs because out of many logs, it becomes easier to find the required one.
You can either filter the logs with event ID 1034 or use the event sources as MsiInstaller. Next to event sources, click the drop-down and select MsiInstaller.
Probably you may find lot of logs with MsiInstaller as source. Scroll down through the events and look for event id 1034.
The Event ID 1034 clearly tells us the name of application that has been uninstalled and the user account who uninstalled it.
Windows Installer removed the product. Product Name: 7-Zip 19.00 (x64 edition). Product Version: 19.00.00.0. Language: 1033. Manufacturer: Igor Pavlov. Removal success or error status: 0.
What is Event ID 1034
The Event ID 1034 event logs the name of application that has been uninstalled and the user account who uninstalled it.
Thanks Prajwal, very helpful also to find it in Windows Admin Center
hello Prajwal,
Thanks for this information, its really helpful. i had a doubt on this last screen shot.
when i open the event its showing system infront of user name , how can i identify who has removed that application instead of System
Check the other events and see if you can find the username.
Will the uninstallation of an extension e.g. a chrome extension also appear when the event source is filtered using “MsiInstaller”? Please assist
No, I don’t think so.