How can I tell who installed/uninstalled Service Pack 4?

A. When Service Pack 4 is installed or uninstalled an Event is written to the System Event Log. The Event ID is 4353 so you could just create a filter (View - Filter Events) to view only Event ID 4353. It gives information of the person and time it was actioned.

The messages are

Windows NT Service Pack 4 was installed (Service Pack 3 was previously installed).


Windows NT Service Pack 4 was uninstalled. Restoring Windows NT to Service Pack 3.

Click here to view image

Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.