Possible Duplicate:
Tracking who installed Software on server.
Hello, I'm trying to figure out a way, on how to find who (username) installed specific program, which appears in the "Add/Remove Programs" of the Windows 2003 server. Is there a way to do it?
Edit: There is no event logs available to check through, what I'm looking for is a similar behavior as:
wmic qfe
Which lists the user, that installed the patch. Not always, since some patches appear as installed by the system, however still for manually installed patches, there are indication for the username.
I don't believe that's built into Windows. You could try gleaning information from the logfiles, see if there's any installation logs, or search for the installer if it was a program downloaded and saved to a particular home directory or see whose account "owns" the file. Basically you will have to try piecing together other evidence to see who most likely did it.