Is there a Windows 7 uninstall log that shows who uninstalled what?

Is it possible to know who uninstalled a specific application from Windows 7 event logs?

3 Answers

There is no 100% way to do this, such as if it was using a custom made installer that didn't log anything, but fortunately most installers use Microsoft's installer service (MSIs). The Installer Service logs everything into the event viewer.

1. Right click on "Computer" on your desktop / start menu and hit "Manage".
2. Under "System Tools", expand "Event Viewer", "Windows Logs", and select "Application".
3. On the right, click "Filter Current Log"
4. In the new dialog, for the "Event sources" drop down list, select "MsiInstaller"

That will filter the log to any Windows installer related actions. If you know an approximate date / time you can look there. Or, you can click "Find..." on the right to try and search for a particular string. The event text will look something like this:

Windows Installer removed the product. Product Name: <product>. Product Version: <version>. Product Language: 1033. Manufacturer: <manufacturer>. Removal success or error status: 0.

Once you've found it, the user performing the action will be displayed under "User".

Go to your event viewer, go to application event log, right click on it and select filter current log, then select MSIINSTALLER. This should give you what you need

Windows does not keep a uninstall log, sometimes the program will leave one behind that may give some information, but I do not believe you will be able to find who did the deed.