an application was uninstalled by system account on a windows server 2008 machine. We did not do it. Looking the event viewer we did not learn anything more. How do I find out what happened.


Look for EventID: 11724

In case the program was uninstalled using Microsoft Installer you will find events from source "MsiInstaller".

I think that no other installer write events to Event Log. Maybe there will be some custom .log files from 3rd party un/installer.

  • Thanks for your reply, that is exactly what i am looking for, EventID:11724, but SYSTEM comes up as the user WHO uninstalled the application. Under what circumstances SYSTEM is registered as a user who does uninstall a specific application? In our case a program was unistalled which monitored the status of Xerox printers called Xerox Device Agent Lite Production and XDAInstaller.msi was deleted. I have not been able to find anything more up to this point – Nick Feb 15 '15 at 11:18

Please explain the name and details of the software which was uninstalled. By that way i can tell you where to look for the logs or history of the software.

  • The program that was unistalled is called Xerox Device Agent Lite Production, which monitored the status of Xerox printers. Aditionally the XDAInstaller.msi was deleted – Nick Feb 15 '15 at 11:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.