If, of course, you're in the unfortunate position of not having that log entry, your best bet is to go through and see if you can determine when, precisely, it was installed, and correlate that with the Security Event Logs to determine with had an interactive logon session at that time. Ĭorrelate that GUID to a user, and you're golden.
Sort of.ĮventID 1040, Source: MsiInstaller UserID. In fact, I just installed Adobe Reader on a default 2008 R2 VM, and did find that it recorded the user who installed the program. Depending on your logging level, you may be able to look through the event logs and see who called the installer.
