The apps installed on your Windows Server, which is running in production, could be crucial. As an administrator, you don’t want anyone to uninstall an application from the server without your permission. What happens if you discover that a certain program has been removed from your Windows Server? How would you find the person who uninstalled the program? Kindly refer to these exciting guides: How to Secure a Web Server on a Windows Virtual Machine in Azure using TLS/SSL Certificates Saved in Azure Kay Vault, how to Manage Windows Defender Antivirus Through Microsoft Endpoint Manager Admin Dashboard and Intune, and Workaround for there were no pages selected to print or the documents could not be printed from Adobe Acrobat Reader. In this article, you will learn how to detect if an application was uninstalled on Windows: Find out who has uninstalled an application via Windows Event Viewer.
Determine who uninstalled a program from a Windows Server with Windows built-in tool
You can determine who uninstalled a program from a Windows Server with the help of a Windows built-in tool, the Windows Event Viewer, without using any outside program. Windows doesn’t maintain track of application uninstallations. At least not for all of the programs you remove. Event IDs 1034 and 11724 are the most useful in this situation, even if the event log only records partial uninstalls. The Event IDs 1034 and 11724 record the name of the program that was uninstalled as well as the user account that did so.
Here are other related guides on Windows Server: How to find out who restarted Windows Server, How to uninstall Internet Explorer from your Windows PC or Windows Server, How to install Windows Server 2022 on VirtualBox, How to Install Web Server IIS in Windows Server 2019, Network File System: How to install NFS Server on Windows Server, and How to Migrate Roles and Features to Windows Server 2022 using WSMT.
Using the steps in this article, you should be able to track down the user who uninstalled an application from your Windows Server system.
How to Find Who Uninstalled a Program from the Windows Server
Here are quick steps to find who uninstalled an application from the Server or your Windows 10 or 11 PC.
To open the Event Viewer, press Win + R to launch the Run dialog box and type eventvwr.
In the Event Viewer, click on Windows Logs and select Application.
You’ll see a list of application events that have occurred in the center pane. In the right pane, click on Filter Current Log.
Filter the logs with Event ID 1034 or 11724 and click the OK button.
You will most likely notice a large number of logs with MsiInstaller as the source. Scroll down to find Event ID 11724. The Event ID 11724 clearly identifies the application that was uninstalled as well as the user account that did it.
The person who uninstalled the program should be revealed via one of the events.
I hope you find this post helpful on how to detect if an application was uninstalled on Windows: Find out who has uninstalled an application via Windows Event Viewer. If you have any questions, feel free to leave them in the comment section below.