How to identify the login id used to install a application

Doodad Boy
Doodad Boy used Ask the Experts™
Some abnormal application installed. Found in control panel. How we may determine who(which ID) installed these
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Scott SilvaNetwork Administrator

Logs should show when it was installed. Best practice is to not allow regular users to install anything.

Then when you find when it was installed, look for who was logged in then.
IT Support Professional
go to event viewer (right click this pc - manage - event viewer - windows logs - applications.
then search for event log 11707 event ID with MsiInstaller Event Source to find latest installed software.
Shaun VermaakTechnical Specialist
Awarded 2017
Distinguished Expert 2018

Assuming the actual installer triggered events or wrote a log. The event log might have been overwritten too.

You can get the installed date by looking at the folder creation.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial