I have another department logging onto a server without authorization. I want to determine if they added a feature without following the proper procedure.
Determine the date time a feature was installed on Windows 2008 R2
windows-server-2008-r2
windows-server-2008-r2
I have another department logging onto a server without authorization. I want to determine if they added a feature without following the proper procedure.
Best Answer
You can use Event Viewer for this. Open Event Viewer, then expand Windows Logs, and click on Setup.
You'll want to create a filter that looks for these keywords: Microsoft-Windows-ServerManager or just ServerManager or Event IDs 1611 & 1610. Preferably filtering for the event IDs.
Example of Features added screenshot in the Event Viewer on my lab server:
See here as well.