3

Recently a Windows Update was done on one of our Windows 2003 production servers and we don't know which user ran the update.

Is possible to identify who ran the update in event viewer or somewhere else?

Vasili Syrakis
  • 4,558
  • 3
  • 22
  • 30
T3chn1nja
  • 31
  • 3
  • if you know when they were applied, you might be able to track back in the security log and look for login events from prior to that time. Lots of EventVwr-FU. – MikeAWood Feb 07 '14 at 03:09
  • @MikeAWood Actually, you can often do one better by seeing an event which tells you which user called the Windows Update service that installed the updates, depending on your logging level. – HopelessN00b Feb 07 '14 at 21:17

1 Answers1

5

Have a look at the subkeys of the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Server 2003 registry key. There is an InstalledBy and InstalledDate value in each subkey. Assuming you know which updates were installed you should have no trouble identifying the user account that performed the installations.

Evan Anderson
  • 141,881
  • 20
  • 196
  • 331