Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Recently a Windows Update was done on one of our Windows 2003 production servers and we don't know which user ran the update.

Is possible to identify who ran the update in event viewer or somewhere else?

share|improve this question
if you know when they were applied, you might be able to track back in the security log and look for login events from prior to that time. Lots of EventVwr-FU. – MikeAWood Feb 7 '14 at 3:09
@MikeAWood Actually, you can often do one better by seeing an event which tells you which user called the Windows Update service that installed the updates, depending on your logging level. – HopelessN00b Feb 7 '14 at 21:17

Have a look at the subkeys of the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Server 2003 registry key. There is an InstalledBy and InstalledDate value in each subkey. Assuming you know which updates were installed you should have no trouble identifying the user account that performed the installations.

share|improve this answer
Alternatively, consider the Win32_QuickFixEngineering WMI class. – Ryan Ries Feb 7 '14 at 3:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.