How To Tell Which User Installed Or Removed An App In Windows
Windows logs just about every event that happens when someone is using it. The log isn’t of much interest to the average user but for anyone troubleshooting an app or having trouble running a process, it’s very useful. If you ever need to find out which user has installed or uninstalled an app on Windows the e event log is what you turn to. Here’s what you need to do.
You will need Administrative rights to view the log. Right-click This PC (My Computer on Windows 7) and select Manage from the context menu. Provide administrative permission if prompted. Expand System Tools>Event Viewer>Windows Logs and select Application. The pane on the right will appear blank at first as Windows loads the events logged. It might seem for a second as though the window has frozen but give it a minute. Once it’s loaded you will see a very long list of events that is obviously too much to sift through manually.
Look at the right-most pane and click the ‘Filter Current Log’ option under Actions.
A new window called Filter Current Log will open. Scroll down to the ‘Event Sources’ drop-down and open it. Check the MsiInstaler option and click Apply.
MsiInstaller is the service that is responsible for installing and uninstalling apps on Windows. If a user installed or uninstalled an app, this service would have logged an event. The list of events you see after applying the filter will be exclusively those relating to app installations and removals. It’s a smaller list to manually sift through. If you have a rough idea when a particular app installation or removal happened, you can specify a date range from the ‘Logged’ dropdown in the log filter.
Select a log entry and look at the pane below it that gives you details of the event. You can see what app was removed, the date and time it was removed, and the user that removed it.
There is a shortcoming to this process; not all apps are installed via the MsiInstaller service so not all install/uninstall activity will be logged here. This works on Windows 7 and above.
Thank you for this tip!
I also found that WindowsUpdateClient is “installing” programs, and logging it in “Windows Logs > System”. So that may be a place to look if you can’t find an event from MsiInstaller.
…and after filtering you can add the column for “User” and sort further. Thanks for the tip!