EventID that logs software installation on workstation

Question

EventID that logs software installation on workstation

T Crha 396

Hello,
I am trying to monitor changes that users are making to their workstations, especially when they install a software. I am hoping that each installation will generate an event within event log on that particular workstation, but I am not able to tell which one is it.
For example, event "ID 11707 - Installation operation completed successfully" looks exactly like what I need, but when I tried to install for example wireshark from .exe file, it didnt log this event at all. And, in a discussion about this I found that "Default Windows Installer packages (MSI's) write to the application log with information about the outcome of the install. Not all EXE installers will be configured to write their output log to the application log."

So, anyone knows what event ID will tell me when a user did install something on his/her computer?

Thank you,
Tomas

Robin Adair Taylor Harris 0 Reputation points

2023-06-01T00:07:43.29+00:00

After my divorce I found my X's name on an event viewer and it concerned me. It was in my computer management. It read, Application installer - 9/9/13 Msi Installer event 11729 George Harris. Yes, it was a long time ago but why would his name show up on my computer? My computer has never been in his possession. It still bothers me and does have access to this computer????

1 answer

Your answer

Robin Adair Taylor Harris 0 Reputation points

2023-06-01T00:07:43.29+00:00

After my divorce I found my X's name on an event viewer and it concerned me. It was in my computer management. It read, Application installer - 9/9/13 Msi Installer event 11729 George Harris. Yes, it was a long time ago but why would his name show up on my computer? My computer has never been in his possession. It still bothers me and does have access to this computer????

Answer 1

Limitless Technology 39,931

Hello there,

Open Event viewer and search the application log for the 11707 event ID with MsiInstaller Event Source to find latest installed software.

4697(S): A service was installed in the system.This event generates when new service was installed in the system.

More details here https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4697

---------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept it as an answer--

T Crha 396 Reputation points

2022-08-31T09:47:42.093+00:00

Hello,
thank you for your answer, but thats exactly what I pointed out in the description - this event is not triggered on every installation, for example when I installed wireshark from an .exe installer, this event was not triggered
So there has to be some other Event ID that logs this kind of activity

Share via

EventID that logs software installation on workstation

1 answer

Your answer