<div>
Is there anything in the Event logs? &nbsp;Try installing a benign role or service and see if anything shows up there.<br />
<br />
If not, I'm not sure what if anything you can do to find out. &nbsp;Administrators are supposed to be able to be trusted and follow the rules and protocols.
</div>


Is there anything in the Event logs?  Try installing a benign role or service and see if anything shows up there.

If not, I'm not sure what if anything you can do to find out.  Administrators are supposed to be able to be trusted and follow the rules and protocols.

<div>
<div class="content wysiwyg-content">
I'm finding some roles and features installed on servers that should not be there. Things like remote access and IIS for example. I'm trying to determine when they were installed and what user was logged in to do it?<br />
<br />
I've played around with some powershell commandlets that show the installed features but I can seem to find who did it and when they did it. This is on server 2012 R2.<br />
<br />
Thanks for suggestions.
</div>
</div>


I'm finding some roles and features installed on servers that should not be there. Things like remote access and IIS for example. I'm trying to determine when they were installed and what user was logged in to do it?

I've played around with some powershell commandlets that show the installed features but I can seem to find who did it and when they did it. This is on server 2012 R2.

Thanks for suggestions.

Determine Date and Who Installed a Role or Feature

Windows Server 2012 is the server version of Windows 8 and the successor to Windows Server 2008 R2. Windows Server 2012 is the first version of Windows Server to have no support for Itanium-based computers since Windows NT 4.0. Windows Server 2012, now in its second release (Windows Server 2012 Release 2) includes Foundation, Essentials, Standard and Datacenter, and does not support IA-32 or IA-64 processors.