Windows 2008 Event to trigger uninstall

Uninstall Trigger in Windows 2008 r2 system event logs.

I am trying to identify in event logs the trigger that is uninstall a software service that is happening every night.
There are no event id's that indicate an trigger for an installation.

What else should I look for ?
LVL 1
Bob BrownIT Asked:
Who is Participating?
 
Chirag NagrekarSystem AnalystCommented:
Check this solution.

Can you filter out events and find below event ids.

Uninstallation events can have an Event ID of 11724 or 1034. The InstallOperation field of these events indicate Removal completed.

https://support.solarwinds.com/Success_Center/Log_Event_Manager_(LEM)/Monitor_software_installation_and_uninstallation_events

Or you might want to filter message :

"Windows Installer removed the product. Product Name: <product>. Product Version: <version>. Product Language: 1033. Manufacturer: <manufacturer>. Removal success or error status: 0."

If they are not generated in event logs might be the software logs that captures the event and you can run script to get uninstallation information.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.