{"id":10001,"date":"2024-10-08T15:02:32","date_gmt":"2024-10-08T15:02:32","guid":{"rendered":"https:\/\/cheapwindowsvps.com\/blog\/how-to-check-the-software-installation-and-removal-history-in-windows\/"},"modified":"2026-06-05T12:56:14","modified_gmt":"2026-06-05T12:56:14","slug":"how-to-check-the-software-installation-and-removal-history-in-windows","status":"publish","type":"post","link":"http:\/\/cheapwindowsvps.com\/blog\/how-to-check-the-software-installation-and-removal-history-in-windows\/","title":{"rendered":"How to Check the Software Installation and Removal History in Windows"},"content":{"rendered":"

The Windows Event logs maintain a comprehensive record of software installations, updates, and removals on a computer. On a Windows hosted server<\/strong><\/a>, monitoring this history is especially important for maintaining compliance and tracking changes across multiple user accounts. These logs are also valuable for determining the specific user responsible for initiating any application installation or removal.<\/p>\n

Here\u2019s how you can access the application installation logs in Windows:<\/p>\n

    \n
  1. Launch the Event Viewer snap-in by entering eventvwr.msc<\/code> in the Run dialog.<\/li>\n
  2. Navigate to Windows Logs<\/strong> and then to Application<\/strong>.<\/li>\n
  3. Right-click on the log and choose Filter current log<\/strong>.<\/li>\n
  4. Select MsiInstaller as the event source.<\/li>\n
  5. Look for the following event IDs for information regarding software installation or removal:
    \nEventID 11707<\/strong> indicates Installation completed successfully<\/code>.
    \nEventID 11724<\/strong> indicates Removal completed successfully<\/code>.<\/li>\n
  6. To determine which user uninstalled or installed a program, open the Details<\/strong> tab in the event properties and switch to XML view<\/strong>. The Security UserID attribute will display the user\u2019s SID. Make sure to copy it.<\/li>\n
  7. Execute the following command to convert the user SID into an actual account name:
    \nwmic useraccount where sid='S-1-5-21-3414967564-454070197-2746421142-1001' get name<\/code><\/li>\n<\/ol>\n

    This command will return the account name of the user who triggered the installation or removal of the program.<\/p>\n

    To retrieve all software installation and removal events from the Event log, you can utilize the Get-WinEvent<\/a> cmdlet. For example, to display a record of successful software installations, you can use the following command:<\/p>\n

    Get-WinEvent -FilterHashtable @{LogName=\"Application\";ID=11707;ProviderName='MsiInstaller'} | Select TimeCreated,Message<\/code><\/p>\n

    To ensure that Event Viewer logs are stored at maximum depth, consider increasing the Windows Event Log size limit<\/a>.<\/p>\n

    Furthermore, Windows offers a more user-friendly tool for monitoring the history of application installations, removals, and updates, including those for Microsoft Store (UWP) apps, as well as the Windows Update logs<\/a>. This tool is known as the system Reliability Monitor<\/strong>.<\/p>\n

    The Reliability Monitor is a distinct graphical utility found in the Classic Control Panel that illustrates the system stability index along with comprehensive information regarding events that may impact the operating system’s stability, such as application crashes and software installation or removal activities.<\/p>\n

    To access the Reliability Monitor, navigate to Control Panel -> Security and Maintenance. Within the Maintenance<\/strong> section, select the View reliability history<\/strong> link (or execute the perfmon \/rel<\/code> command).<\/p>\n

    You can view updates, programs, and UWP apps that have been installed or removed on a daily or weekly basis. For further details about a specific event, click the View technical details<\/strong> button.<\/p>\n

    This script lists all program installation, removal, and update events (including Windows updates and APPX\/MSIX installations) that have occurred on the computer within the past 7 days in a visually interactive table via Out-GridView<\/a>.<\/p>\n

    $DaysAgo = (Get-Date).AddDays(-7)
    \n$RealiabilityFilter= “TimeGenerated > ‘$DaysAgo’ and (SourceName=’Microsoft-Windows-WindowsUpdateClient’ or SourceName=’MsiInstaller’)”
    \nGet-CimInstance -ClassName Win32_ReliabilityRecords -filter $RealiabilityFilter | Select TimeGenerated, ProductName, User, message | Out-GridView<\/p>\n

    Utilize Out-GridView’s built-in filters to narrow down events by a designated application, event, or user.<\/p>\n","protected":false},"excerpt":{"rendered":"

    The Windows Event logs maintain a comprehensive record of software installations, updates, and removals on a computer. On a Windows hosted server, monitoring this history is especially important\u2026<\/p>\n","protected":false},"author":1,"featured_media":10002,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[117,98,99],"tags":[],"class_list":["post-10001","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-powershell","category-windows-10","category-windows-11"],"_links":{"self":[{"href":"http:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/posts\/10001","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/comments?post=10001"}],"version-history":[{"count":2,"href":"http:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/posts\/10001\/revisions"}],"predecessor-version":[{"id":11336,"href":"http:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/posts\/10001\/revisions\/11336"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/media\/10002"}],"wp:attachment":[{"href":"http:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/media?parent=10001"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/categories?post=10001"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/tags?post=10001"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}