Is there a Windows 7 uninstall log that shows who uninstalled what?

Is it possible to know who uninstalled a specific application from Windows 7 event logs?

Answer

There is no 100% way to do this, such as if it was using a custom made installer that didn't log anything, but fortunately most installers use Microsoft's installer service (MSIs). The Installer Service logs everything into the event viewer.

1. Right click on "Computer" on your desktop / start menu and hit "Manage".


2. Under "System Tools", expand "Event Viewer", "Windows Logs", and select "Application".


3. On the right, click "Filter Current Log"


4. In the new dialog, for the "Event sources" drop down list, select "MsiInstaller"

That will filter the log to any Windows installer related actions. If you know an approximate date / time you can look there. Or, you can click "Find..." on the right to try and search for a particular string. The event text will look something like this:

Windows Installer removed the product. Product Name: . Product Version: . Product Language: 1033. Manufacturer: . Removal success or error status: 0.

Once you've found it, the user performing the action will be displayed under "User".