Determine Date and Who Installed a Role or Feature

T.J. used Ask the Experts™
I'm finding some roles and features installed on servers that should not be there. Things like remote access and IIS for example. I'm trying to determine when they were installed and what user was logged in to do it?

I've played around with some powershell commandlets that show the installed features but I can seem to find who did it and when they did it. This is on server 2012 R2.

Thanks for suggestions.
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Seth SimmonsSr. Systems Administrator
look in the setup event log for event id 1610 and 1611
Scott CSenior Engineer

Is there anything in the Event logs?  Try installing a benign role or service and see if anything shows up there.

If not, I'm not sure what if anything you can do to find out.  Administrators are supposed to be able to be trusted and follow the rules and protocols.
Senior Solution Architect
Most Valuable Expert 2015
Top Expert 2015
Roles specifically are event 1610 and Features are 1611. You can either use Event Viewer or Server manager to view this information.


Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial