I'm finding some roles and features installed on servers that should not be there. Things like remote access and IIS for example. I'm trying to determine when they were installed and what user was logged in to do it?
I've played around with some powershell commandlets that show the installed features but I can seem to find who did it and when they did it. This is on server 2012 R2.