Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Am I correct, that if a program is installed on a Server and shows up in the 'Add Remove/Program programs', then it must have been installed when a user has logged onto the server either at the physical console, or using RDP and not when a user has accessed the server via a share?

And if so, then this should show up as Event ID's 528.

In other words, if I just look at Event ID 528, I can get a list of suspects. Is this correct?

share|improve this question
Programs can be installed without a user's interactive logon -- i.e Scheduled Task, batch file, remote agent -- Using credentials such as BUILTIN\SYSTEM. – jscott Aug 25 '10 at 15:20
up vote 1 down vote accepted

In general, yes. You probably want to look at the logon type as well to determine how the user accessed the server. I'm thinking that you want to look for logon types 2, 10, and possibly 5.

share|improve this answer
You said 'In general, yes'. What are the non-general conditions? – sgmoore Aug 25 '10 at 16:05
I just meant that in general you can find logon information in the security log if you have logon auditing enabled but that this might not help you solve your mystery. – joeqwerty Aug 25 '10 at 17:07

That will cover the most typical use cases, however apps can be installed by remote processes (such as PSExec, batch scripting, or a remote deployment tool such as CA Unicenter.) They will not necessarily log that event code.

What you describe is a fine place to start, however.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.