-2

an application was uninstalled by system account on a windows server 2008 machine. We did not do it. Looking the event viewer we did not learn anything more. How do I find out what happened.

Improve this question

2 Answers 2

Reset to default
0

Look for EventID: 11724

In case the program was uninstalled using Microsoft Installer you will find events from source "MsiInstaller".

I think that no other installer write events to Event Log. Maybe there will be some custom .log files from 3rd party un/installer.

Improve this answer
1
  • Thanks for your reply, that is exactly what i am looking for, EventID:11724, but SYSTEM comes up as the user WHO uninstalled the application. Under what circumstances SYSTEM is registered as a user who does uninstall a specific application? In our case a program was unistalled which monitored the status of Xerox printers called Xerox Device Agent Lite Production and XDAInstaller.msi was deleted. I have not been able to find anything more up to this point
    – Nick
    Commented Feb 15, 2015 at 11:18
0

Please explain the name and details of the software which was uninstalled. By that way i can tell you where to look for the logs or history of the software.

Improve this answer
1
  • The program that was unistalled is called Xerox Device Agent Lite Production, which monitored the status of Xerox printers. Aditionally the XDAInstaller.msi was deleted
    – Nick
    Commented Feb 15, 2015 at 11:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .