Get an Analyses of uninstalled Software

Content Authoring
1

Hi everyone,

I need a quick Analyses of all software that has been uninstalled on a windows computer. it would be great if it showed the date, time and user who uninstalled it. Would really appreciate any help!

Thanks,

Sno

2

Question is where on Windows that information is being recorded. I don’t think any registry record is being managed by MS for uninstallation events !!!

I noticed that event ID 11724 exists for this kind of event; the information below may be helpful, but until we locate the file, register entry, or log, we are unable to obtain the needed information.

Note: BigFix client is likely capable of querying event logs to gather information, but doing so extensively could lead to increased resource usage and potential performance issues hence try to search specific or limited info.

Q: (time generated of it, description of it) of records whose (event id of it = 11724) of application event log
A: ( Thu, 07 Sep 2023 20:50:10 +0530 ), Product: OpenSSL 3.1.2 (64-bit) -- Removal completed successfully.
A: ( Thu, 07 Dec 2023 14:30:26 +0530 ), Product: Office 16 Click-to-Run Licensing Component -- Removal completed successfully.
A: ( Sat, 23 Dec 2023 12:27:31 +0530 ), Product: Adobe Acrobat (64-bit) -- Removal completed successfully.
T: 3308.251 ms
3 Likes
3

You can add, user sid of it, to get the user name…

(time generated of it, description of it, user sid of it) of records whose (event id of it = 11724) of application event log
2 Likes
4

Hi VK and D.Dean, I’m trying to get this one to work against the setup event log for event ID 3 so that it can show me my failed packages but I’m doing something wrong here. below is what I have but I’m getting an error for the output. I also need it for event ID 2.

Can you help me, it would be a lifesaver.

Thanks.

(time generated of it, description of it, user sid of it) of records whose (event id of it = 3) of setup event log

5

Hi VK and D.Dean, I’m trying to get this one to work against the setup event log for event ID 3 so that it can show me my failed packages but I’m doing something wrong here. below is what I have but I’m getting an error for the output. I also need it for event ID 2.

Can you help me, it would be a lifesaver.

Thanks.

(time generated of it, description of it, user sid of it) of records whose (event id of it = 3) of setup event log

6

I do not believe there is an inspector for the “setup” event log.

I ask @JasonWalker to verify that.

https://developer.bigfix.com/relevance/reference/event-log.html

1 Like
7

To inspect the setup event log

(time generated of it, description of it, user sid of it) of records whose (event id of it = 3) of event log "setup"

4 Likes