Uninstallation Logs

Question

Post reply

Uninstallation Logs

Raghavender Chavva

SSCrazy Eights

Points: 8669
More actions
April 5, 2017 at 5:59 am

#342202

Hi All,
Is there any way we can find who has uninstalled SQL Server.
I have checked Windows logs but could not find anything.
Will there be any logs ?
Thank You.
Regards,
Raghavender Chavva

Viewing 7 posts - 1 through 6 (of 6 total)

You must be logged in to reply to this topic. Login to reply

Raghavender Chavva SSCrazy Eights Points: 8669 More actions · Answer 1

Hi Team,

Any Help please.

Thank You.

Regards,
Raghavender Chavva

Sue_H SSC Guru Points: 90860 More actions · Answer 2

I would have guessed it would be in the Application log if anywhere. I remember your post last week and did run setup to change things on an instance and then ran a powershell script against all of the event logs - as in the how ever many hundreds of logs in Applications and Services Logs\Microsoft\Windows. I never did find anything. Doesn't mean it doesn't get logged there somewhere but I didn't find anything. Did you find anything left behind? And folders, files, etc? I thought there were some remnants of something after an uninstall - I didn't want to uninstall and test that myself. If there are, you could check the modified date and try to match that up with the logins. But it won't guarantee anything, won't be fun either.

Sue

aprathour.89 Default port Points: 1495 More actions · Answer 3

Hi Raghavender,

Several log files generates under below path during SQL server Uninstall.

C:\Program Files\Microsoft SQL Server\100\Setup Bootstrap\Log\ (Path may vary depending on your SQL version and installation setting, you need to go to XXX\XXXX\Setup Bootstrap\Log)

Check below log files and search for keyword LogonUser in files. you will find the user name in these files who has uninstalled the SQL.

sql_common_core_Cpu64_1
sql_engine_core_inst_Cpu64_1
SqlBrowser_Cpu32_1
SqlSupport_Cpu64_1

Please reply if this post resolves your query.

-----------------
Aditya Rathour
SQL DBA

Not Everything that is faced can be changed,
but nothing can be changed until it is faced.

Raghavender Chavva SSCrazy Eights Points: 8669 More actions · Answer 4

Seems all the folders and files were deleted after uninstallation. There is no SQL related folders exists on the server.
In windows event viewer I could not find anything related to UN-installation, but I am sure previously SQL server was there on that server.

Thank You.

Regards,
Raghavender Chavva

aprathour.89 Default port Points: 1495 More actions · Answer 5

Raghavender Chavva - Monday, April 24, 2017 4:00 AM
Seems all the folders and files were deleted after uninstallation. There is no SQL related folders exists on the server.
In windows event viewer I could not find anything related to UN-installation, but I am sure previously SQL server was there on that server.

If files and folders were deleted then I don't see any other way to determine the user who has uninstalled SQL server.

-----------------
Aditya Rathour
SQL DBA

Not Everything that is faced can be changed,
but nothing can be changed until it is faced.

Tom Uellner SSCrazy Points: 2995 More actions · Answer 6

Raghavender Chavva - Monday, April 24, 2017 4:00 AM
Seems all the folders and files were deleted after uninstallation. There is no SQL related folders exists on the server.
In windows event viewer I could not find anything related to UN-installation, but I am sure previously SQL server was there on that server.

The only thing I can think of is to check the Windows Logs for security and see who was logged in around the time SQL Server was uninstalled. That will only give you a group of users logged in at that time and will not definitively say who uninstalled but it might help you narrow it down.

-Tom