Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I need to figure out who installed a particular program (Adobe Flash) on a server.

How can I do that?

share|improve this question
    
Do that many people have admin rights on the server to install software? –  Grant Aug 20 '12 at 19:55
1  
The question I'm trying to answer is whether it was one of my people or one of the server owners staff. We have no reason to install anything Adobe related (it's a DB server) during our setup process. They also think we installed a linux based web server. They are basing this off of the file stamps of directories. I'd like to give them a way to actually determine who did this. –  Chris Lively Aug 20 '12 at 20:06

2 Answers 2

up vote 3 down vote accepted

Depending on your logging level, you may be able to look through the event logs and see who called the installer.

In fact, I just installed Adobe Reader on a default 2008 R2 VM, and did find that it recorded the user who installed the program. Sort of.

EventID 1040, Source: MsiInstaller UserID: [GUID].

MsiINstaller

Correlate that GUID to a user, and you're golden.

If, of course, you're in the unfortunate position of not having that log entry, your best bet is to go through and see if you can determine when, precisely, it was installed, and correlate that with the Security Event Logs to determine with had an interactive logon session at that time.

The Adobe installer logs might be more helpful in narrowing down the precise time of install too, as it's possible your logging level didn't even log a non-MS application installation in the Event Logs. Either way, it's probably a matter of finding the precise time, and going through the Security logs to determine who had an open type 2 or type 10 logon during that time.

It's really kind of a pain, and if you're the one who's going to be relegated to log diving, it might not be a horrible idea to do a quick cost/benefit breakdown of how much it's going to cost to ferret out this [not-entirely-conclusive] information, because it's not exactly a smoking gun. It'll give you a pretty strong case as to who did it, but unless you have a high enough logging level to see which user called the installer, it's not going to be considered definitive proof. (Or at least I've never seen it taken that way.)

share|improve this answer

Check in c:\users\\downloads and in the user temp directories for adobe related files.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.