View Software Installation and Uninstallation History on Windows 11

A comprehensive record of all software installations, updates, and deletions on your PC can be located within the Windows Event Logs. These logs also detail which user was responsible for initiating any software installations or deletions.

Checking Software Installation and Removal History in Windows 11

You can follow these three methods to access the software installation or uninstallation history on a Windows 11 or Windows 10 computer:

1. Utilizing Windows Logs
2. Using PowerShell
3. Accessing Reliability Monitor

1] Windows Logs

The Event Viewer in Windows logs nearly every action, including software installations and removals:

• To open the Event Viewer snap-in, execute eventvwr.msc.
• Expand Windows Logs and select Application.
• Right-click on the log and choose Filter Current Log.
• Select MsiInstaller as the event source to locate installation events.

• Look for these Event IDs to gain insight into installations or removals:
  • Event ID 11707 – Installation was successful.
  • Event ID 11724 – Removal completed successfully.

2] Utilizing PowerShell

You can use a PowerShell command to extract all software installation and uninstallation events from the Event Log. The WinEvent command can scan log files, filtering results based on source:

Get-WinEvent -FilterHashtable @{LogName="Application";ID=11707;ProviderName='MsiInstaller'} | Select TimeCreated,Message

3] Accessing the Reliability Monitor

Windows also provides a straightforward feature for examining the history of application installations, removals, and updates, including UWP apps from Microsoft Store and Windows Update logs:

Reliability Monitor is a graphical tool located in the Classic Control Panel, displaying the system stability index and offering detailed insights into events that affect the operating system’s stability (like application failures and software modifications).

• Access Control Panel -> Security and Maintenance.
• In the Maintenance area, click on View reliability history, or you can use the command perfmon /rel.
• Review which updates, applications, and UWP apps were installed or uninstalled during specific time frames (daily or weekly). For additional details, click on View technical details.

Hopefully, this information proves useful.

How can you find out who installed or uninstalled software?

Navigate to the Details tab within the event properties and switch to XML view mode. You’ll find the user’s Security ID (SID) listed under the Security UserID attribute. Copy this SID, and to retrieve the account name, input the following command in Command Prompt:

wmic useraccount where sid='S-1-5-21-3414967564-454070197-2746421142-1001' get name

This command will yield the name of the user who performed the software installation or uninstallation.

Does it capture all installation logs?

The log files comprise only installation events for applications packaged in MSI or MSP formats, or EXE files that utilize the MSI installer via msiexec.exe. The Windows Installer service (MSIServer) is tasked with overseeing the installation, servicing, rollback, and uninstallation of software on Windows. Certain applications distributed in EXE format may not employ the MSIServer service or record these events.

Source