I want to know who and when uninstall the special program at windows server 2008 R2, but I can't find helpful post that describe how to do it, so I create this question, hope someone could help me!
2
-
what "special program"? How is installed/uninstalled? Who is the vendor? We will need some more information to assist well :)– warrenFeb 15, 2012 at 6:56
-
You are right. I mean if someone uninstall any program from windows server 2008 R2, and I want to find the related info that recorded by system at anytime. In my case, the program is XAMPP.– dazhiFeb 17, 2012 at 1:43
Add a comment
|
2 Answers
Go to your event viewer, go to application event log, right click on it and select filter current log, then select MSIINSTALLER. This should give you what you need
-
I operated in accordance with you said and export the filtered event log to txt file, but I can't find word "xampp" in the file. I export all application's event log, only could find some word"xampp" that not related with uninstall, so seems the uninstall log of xampp didn't be recorded by windows 2008, that's inconvenient. Anyway thank you for your reply.– dazhiFeb 19, 2012 at 14:32
-
While Ovi's suggestion would work for any MSI-based software, it won't work with software packages not based on MSI (and there are many, and for good reasons).
Our monitoring tool EventSentry can help you with this. As long as your XAMPP shows up in the control panel for all users, removing it can generate an alert in the application event log. You can also choose to get this alert emailed to you for example.
Of course this won't work after the fact, you will need to have EventSentry running while somebody removes the software.
We have a free version available (EventSentry Light) which includes that functionality as well. Disclaimer: I work for NETIKUS.NET.
answered Feb 21, 2012 at 0:19
