Add/remove program or Uninstall log files of Windows XP

Posted on 2011-10-23
Last Modified: 2012-05-12

When a software is uninstalled using the uninstaller that comes with it or using
"Add/Remove Programs" from Control Panel, which are the logfiles which log
down the uninstallation ? (ie indicating date/time of uninstallation & who did it)?

Pls provide the exact logfile name(s) & the folder(s) it's located
Question by:sunhux
    LVL 9

    Accepted Solution

    Depends on the software you are uninstalling, it may have it's own log file. However there isn't any centralized log in XP for recording that. You can use third party solution if you want to keep a log though.

    Author Comment


    Can you provide an example, say I'm uninstalling MS Office 2003, what is its logfile
    name & in which folder it's located?

    Author Comment


    I just used "Add/Remove Programs" to uninstall "FIle Scavenger" & the following
    logs are today's date.  Any chance one of them would have logged down the

    10/24/2011  09:24 AM               120 asl.092416_24Oct11.log
    10/24/2011  11:59 AM            66,843 updater.log
    10/24/2011  11:59 AM            47,364 aumLib.log
    10/24/2011  01:30 PM             1,589 WCESCOMM.LOG
    10/24/2011  01:30 PM           964,339 WCESLog.log
    10/24/2011  01:46 PM         1,025,888 WCESMgr.log
    10/24/2011  01:08 PM           635,472 eps.log
    10/24/2011  09:16 AM           159,397 EPSDriver.log
    10/24/2011  09:16 AM             2,495 SMax.log
    10/24/2011  01:41 PM         1,196,184 ssapi.log
    10/24/2011  01:41 PM            36,723 Conn_20111024.log
    10/24/2011  09:08 AM           766,294 engine.log
    10/24/2011  09:17 AM           425,253 rr.log
    10/24/2011  09:08 AM                 0 0.log
    10/24/2011  09:07 AM               159 wiadebug.log
    10/24/2011  09:07 AM                50 wiaservc.log
    10/24/2011  01:43 PM         1,628,672 WindowsUpdate.log
    10/24/2011  09:07 AM                 0 PASSWD.LOG
    10/24/2011  12:52 PM            42,690 userenv.log
    10/24/2011  09:07 AM           833,004 tvDebug.log
    10/24/2011  01:04 PM           589,382 ReportingEvents.log
    10/24/2011  01:47 PM           131,072 edb.log
    10/24/2011  11:53 AM         2,114,688 TPAPSLOG.LOG
    10/24/2011  11:37 AM           798,336 TPHDLOG0.LOG
    10/24/2011  09:07 AM            11,034 FrameWork.log
    10/24/2011  01:48 PM            18,952 wbemcore.log
    10/24/2011  09:17 AM             7,764 wbemess.log
    10/24/2011  09:11 AM            23,281 wmiprov.log
    10/24/2011  01:00 PM             1,812 MSI631dc.LOG
    LVL 91

    Assisted Solution

    In case the program was uninstalled using Microsoft Installer you will find events from source "MsiInstaller".
    in registry, look in  Local User_Software

    also :
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Uninstall
    There will be a series of entries like {C048FF98-29A3-8F10-19EA840218C2}. For each of these entries, you can read the subkey DisplayName to get the user-readable name of the program such as "Adobe Reader 9.0".
    Other subkeys of interest:
     ModifyPath - contains path to the program that allows you to modify the installation, such as enabling plugins, etc.
     UninstallString - contains the command to uninstall the program.
    Be sure to check these strings before you execute them, as they may be null or contain values like "Not Available."

    you can also use a nother uninstaller  : REVO :      
    LVL 9

    Assisted Solution

    Try Total Uninstall from It records down all changes during uninstall.
    LVL 91

    Assisted Solution

    Revo is 30 day FREE - and afaik better than normal uninstallers ; but i don't know (never checked) if it records the uninstalls

    Author Comment


    > also :
    > HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Uninstall
    > There will be a series of entries like {C048FF98-29A3-8F10-19EA840218C2}. For each of these
    > entries, you can read the subkey DisplayName

    So the above entries only give an indication that a program was previously there &
    was uninstalled but not the actual logs/date of when it was uninstalled?  These entries
    will remain there permanently or they can be removed?

    Author Closing Comment


    Featured Post

    Free Trending Threat Insights Every Day

    Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

    Join & Write a Comment

    Many people tend to confuse the function of a virus with the one of adware, this misunderstanding of the basic of what each software is and how it operates causes users and organizations to take the wrong security measures that would protect them ag…
    Container Orchestration platforms empower organizations to scale their apps at an exceptional rate. This is the reason numerous innovation-driven companies are moving apps to an appropriated datacenter wide platform that empowers them to scale at a …
    This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
    With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

    746 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    14 Experts available now in Live!

    Get 1:1 Help Now