Hello Dears,
We came accross a log from windows server 2012 R2. it goes as follows
Received From: (<servername>) <ipaddress> ->WinEvtLog
Rule: 18146 fired (level 5) -> "Application Uninstalled."
User: NT AUTHORITY
Portion of the log(s):
2020 Nov 07 21:43:18 WinEvtLog: Application: INFORMATION(11724): MsiInstaller: SYSTEM: NT AUTHORITY: <servername>: Product: Sophos Virus Removal Tool -- Removal completed successfully. (NULL) (NULL) (NULL) (NULL) (NULL)
After we received this event, we to checked on the server but "sophos virus removal tool " was still there with a recent installation date.
Is this an upgrade process ?
Thank you in advance for your time
This thread was automatically locked due to age.
