How to check Software Install or Uninstall History in Windows 11

If you go through the Windows Event Logs, you will find each and every time software was installed, updated, or removed from your computer. You can find out which user installed or removed a program from your system by going through these logs.

Windows 11: How to View the History of Software Installs and Uninstalls

In order to view the history of program installation or uninstall in Windows 11 or 10 PC, follow three steps:

Information from Windows Logs

The Power Shell

Dependability Tracker

1.[Windows Logs]

Viewing installed and removed applications on a Windows system is done by the Viewer, which logs almost every action taken:

To open Event Viewer snap-in, run eventvwr.msc.

Under the Windows Logs, find Application.

You can filter the current log by right-clicking it.

Now, to find the events which report on software installation, select MsiInstaller under source.

Now to get information on installed or removed software, search for the following Event IDs:

Installation completed successfully reported by Event ID 11707.

Event ID 11724 reports that the removal is done successfully.

See Also: Windows Installation Log File Not Opening Error

2. PowerShell

You can see all the events about the installation and uninstallation of any software from the Event Log with a Powershell command, and the WinEvent option is available for showing the output of source-based filtering of the log files.

Select the following parameters: TimeCreated,Message, and Get-WinEvent -FilterHashtable @{LogName="Application";ID=11707;ProviderName='MsiInstaller'}.

Note: Enlarging the Windows Event Log size limit will make records in Event Viewer be saved to maximum depth.

3. Reliability Monitoring

There is more friendly an interface in Windows which shows installations, uninstallations, and updating history of applications including Microsoft Store ones (UWP) and also Windows Update logs:

In the Classic Control Panel, there is an applet in graphical form called Reliability Monitor. It represents the System Stability Index and displays in detail all the information about the events that affect the stability of an operating system, like changes in programs and application crashes.

Open the Control Panel, then enter Security and Maintenance.

Click one of the links in the appropriate section of the Maintenance section, or run the command perfmon /rel to access the reliability history.

Determine which UWP apps as well as updates and programs installed and uninstalled throughout a point in time such as last day or last week. Click the "View technical details" button to drill in deeper.

What's the quickest way to work out who removed or installed the software?

On the Details tab, click the event properties in XML view mode. One of the properties that assigns the user's SID is Security UserID. Note this SID and Copy it. Once you have changed the SID to an account name you are able to pick up the user name by using the following inside of Command Prompt:

WMIC USERACCOUNT WHERE SID='S-1-5-21-3414967564-454070197-2746421142-1001' GET USERNAME

This command will provide the name of the user who initiated the installation or removal of software.

Is it possible to get a list of all installation logs?

Event logs include information about the installation of a program, in case of MSI/MSP files only, and in case of .EXE files, if the .EXE simply launches the MSI installer, using msiexec.exe. The Windows Installer service (MSIServer) controls and logs the events of install, maintain, rollback, and remove of programs. Not all .EXE-based applications use MSIServer services or monitor the above-mentioned events.

Altogether, these methods give you a pretty good idea about the whole history of your installed and uninstalled software on Windows 11.