2] Event viewer One of the straightforward ways to know about software installation or removal is via Event Viewer, as it gives you detailed logs with user information.

Event ID 4648, A logon was attempted using explicit credentials, occurs when a process attempts to authenticate to an account ...

Earlier this month, Microsoft warned that, starting with the June 2025 Windows 11 preview update, users would see Windows Firewall errors in the Event Viewer.