Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to know who and when uninstall the special program at windows server 2008 R2, but I can't find helpful post that describe how to do it, so I create this question, hope someone could help me!

share|improve this question

closed as off-topic by Chris S Oct 2 '13 at 13:44

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must be relevant to professional system administration. Server Fault is a site dedicated to professionals; novice questions are off-topic. Please see the Help Center for more information on topicality. The best advice we can give you is to hire a professional to help you out." – Chris S
If this question can be reworded to fit the rules in the help center, please edit the question.

    
what "special program"? How is installed/uninstalled? Who is the vendor? We will need some more information to assist well :) –  warren Feb 15 '12 at 6:56
    
You are right. I mean if someone uninstall any program from windows server 2008 R2, and I want to find the related info that recorded by system at anytime. In my case, the program is XAMPP. –  dazhi Feb 17 '12 at 1:43

2 Answers 2

Go to your event viewer, go to application event log, right click on it and select filter current log, then select MSIINSTALLER. This should give you what you need

share|improve this answer
    
I operated in accordance with you said and export the filtered event log to txt file, but I can't find word "xampp" in the file. I export all application's event log, only could find some word"xampp" that not related with uninstall, so seems the uninstall log of xampp didn't be recorded by windows 2008, that's inconvenient. Anyway thank you for your reply. –  dazhi Feb 19 '12 at 14:32
    
That's because this would only work for MSI-based software. –  Lucky Luke Feb 21 '12 at 0:15

While Ovi's suggestion would work for any MSI-based software, it won't work with software packages not based on MSI (and there are many, and for good reasons).

Our monitoring tool EventSentry can help you with this. As long as your XAMPP shows up in the control panel for all users, removing it can generate an alert in the application event log. You can also choose to get this alert emailed to you for example.

Of course this won't work after the fact, you will need to have EventSentry running while somebody removes the software.

We have a free version available (EventSentry Light) which includes that functionality as well. Disclaimer: I work for NETIKUS.NET.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.