Endpoint Protection

Hi, One of our managed SEP clients has been uninstalled and i wonder if there is any log about uninstallation because i am not sure if the user uninstalled it or not. As there is password protection for removal user shall not be able to remove SEP. I am trying to find how / who / when uninstalled it? Then i will look forward why? :) The client OS is Windows XP 64 bit. SEP is 11.0.5002.333 version. Regards,

you can use your eventviewer to check who uinstalled it
the process name would be msiexec.exe , put a filter you should be able to see that.

Any enty is present in start-->programs or in add/remove programs?

@Rafael
i am looking for more detailed information. As you know we can see installation logs under C:\Windows\Temp\SEP_Inst.log and i wonder if something like this can be found. It is really hard to find a useful information in Event Viewer.

Hi Osman,

the uninstall log is not created :) 
if you could create a filter in event viewer for Eventsource as Msiinstaller.

@Rafeeq
Sorry for mistype of your name in previous post. Still looking for Event Viewer and found nothing related to uninstall from last contact time. Just a new installation which i made today.

@AravindKM
No there was nothing in neither start->programs nor Add/Remove programs. In SEPM it seems last contact was 14 March. I realized that even the computer is running and attached to network its status is offline and when checked client found no SEP software. That's why i am trying to understand how it has been uninstalled. The user is not admin and the client has password protect.

Whether any folders/files of the programs still present in the clients?
Whether tamper protection was enabled?
Are you able to see teefer driver in device manager?