Anyone have an Analyses that can show me software that has been uninstalled? A cherry on top would be if it could also show the user that performed the uninstallation, but I’ll settle for the first option. This would help me greatly!
Thanks in advance.
I have this to leverage a Java uninstall:
(description of it, time generated of it, user sid of it) of records whose (event id of it = 1034 AND now - time generated of it < 1 * day AND source of it contains "MsiInstaller" AND description of it contains "Java") of application event log
I haven’t tested this, but I would imaging if you remove the AND description of it contains "Java" this may return what you are needing.
there’s a bug somewhere here, I tried with no luck.
This is a query against the Windows Application Event Log. If you check in Event Viewer, are any of these log entries present?