Is there a way to find distinct program installs in the Windows Event log? I have tried looking for a specific ID to look for but cannot find one that references installs.
If not, is there an easy way to access installed program data on a Windows machine?
Windows Event Log – Installs
event-logwindows
Related Solutions
1) I've been using the same batch file script since Vista, and it still works fine under 8. It's similar to yours, but does ALL the logs regardless of their name:
WEVTUTIL EL > .\LOGLIST.TXT
for /f %%a in ( .\LOGLIST.TXT ) do WEVTUTIL CL %%a
del .\LOGLIST.TXT
You will have to right-click the batch file and run it elevated ("as administrator").
2) You can enlarge individual logs by right-clicking them in Event Viewer and editing the Properties:
Nirsoft's MyEventViewer is an alternative to the MS Event Viewer. It takes some time to open and sort all events (~80 seconds to load 100,000 events on my PC), it eventually displays them all. It has sort and find capabilities, so it should save you from carpal tunnel issues.
Edit: developer's recommended tool is now FullEventLogView. From the website:
FullEventLogView vs MyEventViewer
MyEventViewer is a very old tool originally developed for Windows XP/2000/2003. Starting from Windows Vista, Microsoft created a new event log system with completely new programming interfaces. The old programming interface still works even on Windows 10, but it cannot access the new event logs added on Windows Vista and newer systems. MyEventViewer uses the old programming interface, so it cannot display many event logs added on Windows 10/8/7/Vista. FullEventLogView uses the new programming interface, so it displays all events.
Best Answer
You can filter by EventID to see specific types of events. There are many Windows Installer Event IDs corresponding to different sorts of actions. 1033 indicates a product was installed, 1034 indicates a product was uninstalled.
For Windows Installer you can also filter by Source. MsiInstaller is the source for all Windows Installer events.
InstallShield tends to be a wrapper for MSI scripts, so it would generally have the same event IDs. However, other installer packages will generally not use the same EventIDs. For any installer you'll need to find the appropriate event ids it uses (if any).
UPDATE details: Oh, and those are all found in the event viewer under Application.
UPDATE response: The Windows Event IDs do not change from OS to OS as these are determined by the application. In this case, Windows Installer.
I tested on my XP box and a 2003 server and they both used 1033 for install and 1034 for uninstall.
You may try installing a windows update patch or similar. Something small, like a root certificate update or the like. Then check the event logs for corresponding entries. This will allow you to see if the logs have been cleared since the last install.
UPDATE further details, alternate IDs: There is a plethora of information online regarding event IDs, including lists of all possible EventIDs for MSI Installers. Looking briefly I'm not really sure what the difference is between 1033/1034 and 11707/11708 IDs. MS documentation seems to show that the two different types indicate the same thing, namely the successful install or uninstall, but contain different sorts of information.