How Can I Identify Who Installed or Copied an Unauthorized Application?

Your process query may not catch the event because the application could have been installed by a different executable, extracted from an archive, deployed by a management tool, or copied directly. Search more broadly around the suspected time instead of filtering only on the application name. Useful data sources include DeviceProcessEvents, DeviceFileEvents, DeviceLogonEvents, and DeviceNetworkEvents. Look for file creation in the application directory, archive utilities, robocopy, xcopy, PowerShell, remote management tools, and elevated or remote processes. Also verify that the device was reporting telemetry during the period you’re investigating.

Start by establishing the application’s first-seen or installation timestamp, then compare it with interactive logons, administrator logons, remote sessions, and process activity around that time. Windows Installer event 11707 can identify completed MSI installations, but it won’t help if someone simply copied the program files. Also check whether the account shown is the actual technician or a shared administrative account.

If the files were copied rather than installed, endpoint telemetry may not identify the original source by itself. Preserve the affected machine first and investigate a forensic image or restored copy offline so evidence is not overwritten. Windows artifacts such as Prefetch, Amcache, UserAssist, SRUM, security audit logs, and file metadata can help show when the program was first executed, which account ran it, and whether it was launched through a remote session. Make sure you have the relevant audit policies enabled before relying on missing events.

Don’t assume the help desk was responsible until you correlate the evidence. The employee could have copied or installed the software, or a deployment system could have done it automatically. Check software-management records, scheduled tasks, service creation, remote-support logs, and Defender’s device timeline. If multiple technicians use one shared admin account, you may only be able to prove which account or session performed the action—not which individual—unless there are separate sign-in records or ticketing data.