Track Software Installation History in Windows 11: A Comprehensive Guide

  • Thread Author
Ever wondered when that software you vaguely remember installing (or uninstalling) made its grand entrance—or exited the stage entirely? Tracking your software's installation and uninstallation history in Windows 11 can be incredibly useful, whether for troubleshooting, enhancing security, or simply storing fun facts. Here’s a deep dive into how to uncover that elusive history on your Windows machine.

Why it Matters​

Understanding the installation timeline of your software can provide insights, from monitoring surprises like rogue applications installing themselves to noting suspicious uninstallations that may indicate malware or user error. Windows cleverly keeps tabs on this activity, primarily through Windows Event Logs, and you can access this data in just a few easy steps.

Three Methods to Check Installation and Uninstallation History​

Let’s dive into the methods you can use to uncover the installation and uninstallation history on your Windows 11 (though these steps also apply to Windows 10).

1. Using Windows Logs via Event Viewer​

Windows Event Viewer is your first stopping point. It keeps a detailed log of software installations and deletions, which is more comprehensive than your average birthday party invitation.

Here’s how to do it:​

  • Press Win + R to open the Run dialog, type eventvwr.msc, and hit Enter. This launches the Event Viewer.
  • Navigate to Windows Logs > Application.
  • Right-click on the log and select Filter Current Log.
  • Choose MsiInstaller as the event source.
  • You can look for these key Event IDs:
    • 11707 – Installation completed successfully.
    • 11724 – Removal completed successfully.
These IDs function like badges of honor for software actions.

2. Utilizing PowerShell​

If you prefer command-line power over point-and-click interfaces, PowerShell is your go-to tool. It’s like asking a seasoned detective to uncover the data for you.

Executing a Command:​

Open PowerShell (you can just search for it in the Start menu) and type the following command:
Code:
 Get-WinEvent -FilterHashtable @{LogName="Application"; ID=11707; ProviderName='MsiInstaller'} | Select TimeCreated, Message
This command filters through the logs and fetches all events related to installation, allowing you to see when software was installed based on the timestamps.

Note:​

To ensure that your Event Viewer logs are stored at the maximum depth (and you don’t miss out on important events), consider increasing the Windows Event Log size.

3. Checking Reliability Monitor​

For those who prefer a user-friendly graphical interface, Reliability Monitor is like a reliability rating for your software installations and updates (with a hint of nostalgia from the classic Control Panel).

Steps to Access:​

  • Navigate to Control Panel > Security and Maintenance.
  • In the Maintenance section, click on View reliability history, or simply run the command:
Code:
 perfmon /rel
Reliability Monitor not only tracks traditional application installs and removals but also keeps an eye on Microsoft Store apps and updates. You can check the history based on specific time frames—be it days, weeks, or months. Clicking on View technical details reveals deeper insights into each event.

Identifying Who Installed or Uninstalled Software​

Curious to know who performed these installations or removals? You can find this out too! Go to the event properties’ Details tab, switch to XML view, and grab the user’s Security ID (SID).
To convert this SID to an actual username, utilize this command in Command Prompt:
Code:
 wmic useraccount where sid='YOUR_SID' get name
Replace YOUR_SID with the actual SID you've obtained. It’s like unmasking the superhero behind the software installation.

Limitations: Does It Capture All Install Logs?​

Keep in mind that not all install logs are captured. The logs specifically document installations related to applications packaged in MSI/MSP files or EXE files that leverage the MSI installer via msiexec.exe. Some applications, particularly those distributed in standard EXE format, might not log their events through the Windows Installer service (MSIServer).

Conclusion​

There you have it! Whether you’re troubleshooting, checking on rogue installations, or keeping a meticulous record of your software hoard, your Windows 11 machine has got your back. With just a few clicks or commands, the history of your installations and uninstallations is at your fingertips.
So go forth, explore those logs, and gain a newfound understanding of the software landscape you've cultivated on your system!
Source: The Windows Club How to check Software Install or Uninstall History in Windows 11
 


Back
Top