67

I need to develop a process that will detect if the users computer has certain programs installed and if so, what version. I believe I will need a list with the registry location and keys to look for and feed it to the program which is not a problem. Is there a better way to accomplish this?

My first thought was to check in the registry in the uninstallation entries but it seems one of the apps I wish to detect does not have one. What is the standard location for all registry using applications to make an entry in?

Mark Stahler
  • 4,186
  • 6
  • 29
  • 29

9 Answers9

51

On 64-bit systems the x64 key is:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Most programs are listed there. Look at the keys: DisplayName DisplayVersion

Note that the last is not always set!

On 64-bit systems the x86 key (usually with more entries) is:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
Peter Brittain
  • 13,489
  • 3
  • 41
  • 57
coding Bott
  • 4,287
  • 1
  • 27
  • 44
40

User-specific settings should be written to HKCU\Software, machine-specific settings to HKLM\Software. Under these keys, structure [software vendor name]\[application name] (e.g. HKLM\Software\Microsoft\Internet Explorer) may be the most common, but that's just a convention, not a law of nature.

Many (most?) applications also add their uninstall entries to HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\[app name], but again, not all applications do this.

These are the most important keys; however, contents of the registry do not have to represent the installed software exactly - maybe the application was installed once, but then was manually deleted, or maybe the uninstaller didn't remove all traces of it. If you want to be sure, check the filesystem to see if the application still exists where its registry entries say it is.

Edit:

If you're a member of the group Administrators, you can check the HKEY_USERS hive - each user's HKCU actually resides there (you'll need to know the user SID, or go through all of them).

Note: As @Brian Ensink says, "installed" is a bit of a vague concept - are we trying to find what the user could run? Some software doesn't even write to the Registry at all: search for "portable apps" to see apps that have been specifically modified to run directly from media (CD/USB) and not to leave any traces on the computer. We may also have to scan the disks, and network disks, and anything the user downloads, and world-accessible Windows shares in the Internet (yes, such things exist legitimately - \\live.sysinternals.com\tools comes to mind). In this direction, there's no real limit of what the user can run, unless prevented by system policies.

Piskvor left the building
  • 91,498
  • 46
  • 177
  • 222
  • 16
    How does the add/remove programs list get populated? More than half of the apps I have listed do not have registry entries in the above locations (Microsoft apps excluded). – Mark Stahler Jan 09 '09 at 21:51
  • Additionally, non-admin users can install software that's willing to stay out of HKLM. This is quite common, it allows per-user installs. – MSalters Jan 12 '09 at 15:49
  • Some user installed apps like Chrome, GoToMeeting, Pixie, WinDirStat, and WebEx do not write to HKLM\...\Uninstall. HKCU is only for the current user, so unless the user is you, these will not contain entries for user (non-admin) installed software. – Bratch Jan 13 '11 at 16:00
  • @Bratch: Yes, you're correct. Added the HKEY_USERS - Administrators can access other users' HKCU that way; also, a paragraph about install-free apps. – Piskvor left the building Jan 13 '11 at 16:20
  • Didn't know about \\live.sysinternals.com\tools. Great tip ! Thanks. – mivk Sep 02 '18 at 15:46
10

You could use MSI API to enumerate everything installed by Windows Installer but that won't list all the software available on a machine. Without knowing more about what you need I think the concept of "installed" is a little vague. There are many ways to deploy software to a system ranging from big complicated installers to ZIP files and everything in between.

Brian Ensink
  • 11,092
  • 3
  • 50
  • 63
  • 1
    +1; using the MSI APIs instead of manually groveling the registry will be more reliable and less painful for you in the long run... – reuben Jan 14 '09 at 06:32
  • 5
    This is a good answer (for me at least), but it would have been even better if you'd included a link. – RenniePet Aug 21 '11 at 11:06
  • 3
    I agree with RenniePet; an example or at least a link to somewhere close would have been nice. – vossad01 Jul 22 '13 at 19:31
6

An application does not need to have any registry entry. In fact, many applications do not need to be installed at all. U3 USB sticks are a good example; the programs on them just run from the file system.

As noted, most good applications can be found via their uninstall registry key though. This is actually a pair of keys, per-user and per-machine (HKCU/HKLM - Piskvor mentioned only the HKLM one). It does not (always) give you the install directory, though.

If it's in HKCU, then you have to realise that HKEY_CURRENT_USER really means "Current User". Other users have their own HKCU entries, and their own installed software. You can't find that. Reading every HKEY_USERS hive is a disaster on corporate networks with roaming profiles. You really don't want to fetch 1000 accounts from your remote [US|China|Europe] office.

Even if an application is installed, and you know where, it may not have the same "version" notion you have. The best source is the "version" resource in the executables. That's indeed a plural, so you have to find all of them, extract version resources from all and in case of a conflict decid on something reasonable.

So - good luck. There are dozes of ways to fail.

MSalters
  • 173,980
  • 10
  • 155
  • 350
3

You can use a PowerShell script to look at registers and get the installed program details. The script bellow will generate a file with the complete list of installed programs. Save it with ".ps" extension and double click the file.

#
# Generates a full list of installed programs.
#

# Temporary auxiliar file.
$tmpFile = "tmp.txt"

# File that will hold the programs list.
$fileName = "programas-instalados.txt"

# Columns separator.
$separator = ","

# Delete previous files.
Remove-Item $tmpFile
Remove-Item $fileName

# Creates the temporary file.
Create-Item $tmpFile

# Searchs register for programs - part 1
$loc = Get-ChildItem HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall
$names = $loc |foreach-object {Get-ItemProperty $_.PsPath}
foreach ($name in $names)
{
    IF(-Not [string]::IsNullOrEmpty($name.DisplayName)) {      
        $line = $name.DisplayName+$separator+$name.DisplayVersion+$separator+$name.InstallDate
        Write-Host $line
        Add-Content $tmpFile "$line`n"        
    }
}

# Searchs register for programs - part 2
$loc = Get-ChildItem HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
$names = $loc |foreach-object {Get-ItemProperty $_.PsPath}
foreach ($name in $names)
{
    IF(-Not [string]::IsNullOrEmpty($name.DisplayName)) {      
        $line = $name.DisplayName+$separator+$name.DisplayVersion+$separator+$name.InstallDate
        Write-Host $line
        Add-Content $tmpFile "$line`n"
    }
}

# Sorts the result, removes duplicate lines and
# generates the final file.
gc $tmpFile | sort | get-unique > $filename
Arivan Bastos
  • 1,876
  • 1
  • 20
  • 28
1

Seems like looking for something specific to the installed program would work better, but HKCU\Software and HKLM\Software are the spots to look.

Nick
  • 13,238
  • 17
  • 64
  • 100
1

In addition to all the registry keys mentioned above, you may also have to look at HKEY_CURRENT_USER\Software\Microsoft\Installer\Products for programs installed just for the current user.

David Airapetyan
  • 5,301
  • 4
  • 40
  • 62
0

Win32_Product never shows everything, only software installed via an MSI installer (as far as I can tell.)

There are lots of software packages that get installed via other installers that don't show up in there. another way is needed.

Naikrovek
  • 171
  • 1
  • 8
0

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted

user10211111
  • 1