Windows Windows Server

How to detect if an application was uninstalled on windows: Find out who has uninstalled an application via Windows Event Viewer

Featured-image_new-1
How to find out who uninstalled an application via Windows Event Viewer

The apps installed on your Windows Server, which is running in production, could be crucial. As an administrator, you don’t want anyone to uninstall an application from the server without your permission. What happens if you discover that a certain program has been removed from your Windows Server? How would you find the person who uninstalled the program?

You can determine who uninstalled a program from a Windows Server with the help of a Windows built-in tool, the Windows Event Viewer, without using any outside program. Windows doesn’t maintain a track of application uninstallations. At least not for all of the programs you remove. Event IDs 1034 and 11724 are the most useful in this situation, even if the event log only records partial uninstalls. The Event IDs 1034 and 11724 record the name of the program that was uninstalled as well as the user account that did so.

Here are other related guides on Windows Server: How to find out who restarted Windows Server, How to uninstall Internet Explorer from your Windows PC or Windows ServerHow to install Windows Server 2022 on VirtualBoxHow to Install Web Server IIS in Windows Server 2019Network File System: How to install NFS Server on Windows Server, and How to Migrate Roles and Features to Windows Server 2022 using WSMT.

Using the steps in this article, you should be able to track down the user who uninstalled an application from your Windows Server system.

How to Find Who Uninstalled a Program from the Windows Server

Here are quick steps to find who uninstalled an application from the Server or your Windows 10 or 11 PC.

To open the Event Viewer, press Win + R to launch the Run dialog box and type eventvwr.

image0-1
Run dialog box

In the Event Viewer, click on Windows Logs and select Application.

image1-6
Windows Event Viewer

You’ll see a list of application events that have occurred in the center pane. In the right pane, click on Filter Current Log.

image2-4
Filtering the event log

Filter the logs with Event ID 1034 or 11724 and click the OK button.

image3-5
Filtering the event log

You will most likely notice a large number of logs with MsiInstaller as the source. Scroll down to find Event ID 11724. The Event ID 11724 clearly identifies the application that was uninstalled as well as the user account that did it.

image4-5
Event viewer showing uninstalled app details

The person who uninstalled the program should be revealed via one of the events.

I hope you find this post helpful. If you have any questions, feel free to leave them in the comment section below.

Subscribe
Notify of
guest

0 Comments
Inline Feedbacks
View all comments
0
Would love your thoughts, please comment.x
()
x