Analyses to show removed or uninstalled software

Snojack 2022-09-22 16:24:38 UTC #1

Anyone have an Analyses that can show me software that has been uninstalled? A cherry on top would be if it could also show the user that performed the uninstallation, but I’ll settle for the first option. This would help me greatly!

Thanks in advance.

baynes74 2022-09-22 16:37:12 UTC #2

I have this to leverage a Java uninstall:

(description of it, time generated of it, user sid of it) of records whose (event id of it = 1034 AND now - time generated of it < 1 * day AND source of it contains "MsiInstaller" AND description of it contains "Java") of application event log

I haven’t tested this, but I would imaging if you remove the AND description of it contains "Java" this may return what you are needing.

Snojack 2022-09-29 21:14:30 UTC #3

there’s a bug somewhere here, I tried with no luck.

JasonWalker 2022-09-29 22:16:23 UTC #4

This is a query against the Windows Application Event Log. If you check in Event Viewer, are any of these log entries present?