You can find a complete history of software installations, updates, and removals on your computer in the Windows Event Logs. These logs also provide information about the specific user who initiated any application installations or removals.
How to check Software Install or Uninstall History in Windows 11
Follow these three methods to check the software installation or uninstall history on a Windows 11/10 PC:
- Windows Logs
- Power Shell
- Reliability Monitor
1] Windows Logs
Even Viewer in Windows logs almost everything, including software installations and removals:
- Run
eventvwr.mscto launch the Event Viewer snap-in. - Expand Windows Logs and select Application.
- Right-click on the log and select Filter Current Log.
- Choose MsiInstaller as the event source to find software installation events.
- Check for the following Event IDs for installation or removal information
- Event ID 11707 – Installation completed successfully.
- Event ID 11724 – Removal completed successfully.
Read: Error opening Installation Log File in Windows
2] PowerShell
Powershell command can help you retrieve all software installation and removal events from the Event Log. The WinEvent option can go through the log files, filter based on source, and show the result.
Get-WinEvent -FilterHashtable @{LogName="Application";ID=11707;ProviderName='MsiInstaller'} | Select TimeCreated,Message
Note: To ensure that Event Viewer logs are stored at maximum depth, consider increasing the Windows Event Log size limit.
3] Reliability Monitor
Windows offers a more user-friendly tool for viewing the history of application installations, removals, and updates, including Microsoft Store (UWP) apps and Windows Update logs:
Reliability Monitor is a graphical applet in the Classic Control Panel that displays the system stability index and provides detailed information about events impacting the operating system’s stability (such as application crashes and software changes).
- Navigate to Control Panel -> Security and Maintenance.
- In the Maintenance section, click View reliability history, or run the command
perfmon /rel. - Check which updates, programs, and UWP apps have been installed or removed over specific time frames (by day or week). Click the View technical details button for more information.
Read: Reliability Monitor not showing data, updating or working in Windows.
I hope this helps.
How do you identify who installed or uninstalled a software?
Go to the Details tab for the event properties and switch to XML view mode. The user’s Security ID (SID) is specified in the Security UserID attribute value. Copy this SID. To find the user name, run the following command in Command Prompt to convert the SID to an account name:
wmic useraccount where sid='S-1-5-21-3414967564-454070197-2746421142-1001' get nameThis command will return the user’s name who initiated the software installation or removal.
Does it capture all install logs?
The log files include only installation events for applications packaged in MSI/MSP files or EXE files that run the MSI installer via msiexec.exe. The Windows Installer service (MSIServer) is responsible for managing the installation, maintenance, rollback, and removal of software on Windows. Some applications distributed in EXE format do not utilize the MSIServer service or log these events.
