Detecting installed programs via registry

Question

I need to develop a process that will detect if the users computer has certain programs installed and if so  what version  I believe I will need a list with the registry location and keys to look for and feed it to the program which is not a problem  Is there a better way to accomplish this   My first thought was to check in the registry in the uninstallation entries but it seems one of the apps I wish to detect does not have one  What is the standard location for all registry using applications to make an entry in

User · Answer

An application does not need to have any registry entry. In fact, many applications do not need to be installed at all. U3 USB sticks are a good example; the programs on them just run from the file system.

As noted, most good applications can be found via their uninstall registry key though. This is actually a pair of keys, per-user and per-machine (HKCU/HKLM - Piskvor mentioned only the HKLM one). It does not (always) give you the install directory, though.

If it's in HKCU, then you have to realise that HKEY_CURRENT_USER really means "Current User". Other users have their own HKCU entries, and their own installed software. You can't find that. Reading every HKEY_USERS hive is a disaster on corporate networks with roaming profiles. You really don't want to fetch 1000 accounts from your remote [US|China|Europe] office.

Even if an application is installed, and you know where, it may not have the same "version" notion you have. The best source is the "version" resource in the executables. That's indeed a plural, so you have to find all of them, extract version resources from all and in case of a conflict decid on something reasonable.

So - good luck. There are dozes of ways to fail.

User · Answer

HKEY CURRENT USER Software Microsoft Windows NT CurrentVersion AppCompatFlags Compatibility Assistant Persisted

User · Answer

User-specific settings should be written to HKCU Software  machine-specific settings to HKLM Software  Under these keys  structure  software vendor name   application name   e g  HKLM Software Microsoft Internet Explorer  may be the most common  but that s just a convention  not a law of nature   Many  most   applications also add their uninstall entries to HKLM Software Microsoft Windows CurrentVersion Uninstall  app name   but again  not all applications do this   These are the most important keys  however  contents of the registry do not have to represent the installed software exactly - maybe the application was installed once  but then was manually deleted  or maybe the uninstaller didn t remove all traces of it  If you want to be sure  check the filesystem to see if the application still exists where its registry entries say it is   Edit   If you re a member of the group Administrators  you can check the HKEY USERS hive - each user s HKCU actually resides there  you ll need to know the user SID  or go through all of them    Note  As  Brian Ensink says   installed  is a bit of a vague concept - are we trying to find what the user could run  Some software doesn t even write to the Registry at all  search for  portable apps  to see apps that have been specifically modified to run directly from media  CD USB  and not to leave any traces on the computer  We may also have to scan the disks  and network disks  and anything the user downloads  and world-accessible Windows shares in the Internet  yes  such things exist legitimately -   live sysinternals com tools comes to mind   In this direction  there s no real limit of what the user can run  unless prevented by system policies

User · Answer

User-specific settings should be written to HKCU Software  machine-specific settings to HKLM Software  Under these keys  structure  software vendor name   application name   e g  HKLM Software Microsoft Internet Explorer  may be the most common  but that s just a convention  not a law of nature   Many  most   applications also add their uninstall entries to HKLM Software Microsoft Windows CurrentVersion Uninstall  app name   but again  not all applications do this   These are the most important keys  however  contents of the registry do not have to represent the installed software exactly - maybe the application was installed once  but then was manually deleted  or maybe the uninstaller didn t remove all traces of it  If you want to be sure  check the filesystem to see if the application still exists where its registry entries say it is   Edit   If you re a member of the group Administrators  you can check the HKEY USERS hive - each user s HKCU actually resides there  you ll need to know the user SID  or go through all of them    Note  As  Brian Ensink says   installed  is a bit of a vague concept - are we trying to find what the user could run  Some software doesn t even write to the Registry at all  search for  portable apps  to see apps that have been specifically modified to run directly from media  CD USB  and not to leave any traces on the computer  We may also have to scan the disks  and network disks  and anything the user downloads  and world-accessible Windows shares in the Internet  yes  such things exist legitimately -   live sysinternals com tools comes to mind   In this direction  there s no real limit of what the user can run  unless prevented by system policies

User · Answer

You could use MSI API to enumerate everything installed by Windows Installer but that won t list all the software available on a machine   Without knowing more about what you need I think the concept of  installed  is a little vague   There are many ways to deploy software to a system ranging from big complicated installers to ZIP files and everything in between

User · Answer

You can use a PowerShell script to look at registers and get the installed program details  The script bellow will generate a file with the complete list of installed programs  Save it with   ps  extension and double click the file       Generates a full list of installed programs       Temporary auxiliar file   tmpFile    tmp txt     File that will hold the programs list   fileName    programas-instalados txt     Columns separator   separator          Delete previous files  Remove-Item  tmpFile Remove-Item  fileName    Creates the temporary file  Create-Item  tmpFile    Searchs register for programs - part 1  loc   Get-ChildItem HKLM  Software Microsoft Windows CurrentVersion Uninstall  names    loc  foreach-object  Get-ItemProperty    PsPath  foreach   name in  names        IF -Not  string   IsNullOrEmpty  name DisplayName                    line    name DisplayName  separator  name DisplayVersion  separator  name InstallDate         Write-Host  line         Add-Content  tmpFile   line n                     Searchs register for programs - part 2  loc   Get-ChildItem HKLM  Software Wow6432Node Microsoft Windows CurrentVersion Uninstall  names    loc  foreach-object  Get-ItemProperty    PsPath  foreach   name in  names        IF -Not  string   IsNullOrEmpty  name DisplayName                    line    name DisplayName  separator  name DisplayVersion  separator  name InstallDate         Write-Host  line         Add-Content  tmpFile   line n             Sorts the result  removes duplicate lines and   generates the final file  gc  tmpFile   sort   get-unique  gt   filename

User · Answer

You can use a PowerShell script to look at registers and get the installed program details  The script bellow will generate a file with the complete list of installed programs  Save it with   ps  extension and double click the file       Generates a full list of installed programs       Temporary auxiliar file   tmpFile    tmp txt     File that will hold the programs list   fileName    programas-instalados txt     Columns separator   separator          Delete previous files  Remove-Item  tmpFile Remove-Item  fileName    Creates the temporary file  Create-Item  tmpFile    Searchs register for programs - part 1  loc   Get-ChildItem HKLM  Software Microsoft Windows CurrentVersion Uninstall  names    loc  foreach-object  Get-ItemProperty    PsPath  foreach   name in  names        IF -Not  string   IsNullOrEmpty  name DisplayName                    line    name DisplayName  separator  name DisplayVersion  separator  name InstallDate         Write-Host  line         Add-Content  tmpFile   line n                     Searchs register for programs - part 2  loc   Get-ChildItem HKLM  Software Wow6432Node Microsoft Windows CurrentVersion Uninstall  names    loc  foreach-object  Get-ItemProperty    PsPath  foreach   name in  names        IF -Not  string   IsNullOrEmpty  name DisplayName                    line    name DisplayName  separator  name DisplayVersion  separator  name InstallDate         Write-Host  line         Add-Content  tmpFile   line n             Sorts the result  removes duplicate lines and   generates the final file  gc  tmpFile   sort   get-unique  gt   filename

User · Answer

HKEY CURRENT USER Software Microsoft Windows NT CurrentVersion AppCompatFlags Compatibility Assistant Persisted

User · Answer

In addition to all the registry keys mentioned above  you may also have to look at HKEY CURRENT USER Software Microsoft Installer Products for programs installed just for the current user

User · Answer

An application does not need to have any registry entry. In fact, many applications do not need to be installed at all. U3 USB sticks are a good example; the programs on them just run from the file system.

As noted, most good applications can be found via their uninstall registry key though. This is actually a pair of keys, per-user and per-machine (HKCU/HKLM - Piskvor mentioned only the HKLM one). It does not (always) give you the install directory, though.

If it's in HKCU, then you have to realise that HKEY_CURRENT_USER really means "Current User". Other users have their own HKCU entries, and their own installed software. You can't find that. Reading every HKEY_USERS hive is a disaster on corporate networks with roaming profiles. You really don't want to fetch 1000 accounts from your remote [US|China|Europe] office.

Even if an application is installed, and you know where, it may not have the same "version" notion you have. The best source is the "version" resource in the executables. That's indeed a plural, so you have to find all of them, extract version resources from all and in case of a conflict decid on something reasonable.

So - good luck. There are dozes of ways to fail.

User · Answer

User-specific settings should be written to HKCU Software  machine-specific settings to HKLM Software  Under these keys  structure  software vendor name   application name   e g  HKLM Software Microsoft Internet Explorer  may be the most common  but that s just a convention  not a law of nature   Many  most   applications also add their uninstall entries to HKLM Software Microsoft Windows CurrentVersion Uninstall  app name   but again  not all applications do this   These are the most important keys  however  contents of the registry do not have to represent the installed software exactly - maybe the application was installed once  but then was manually deleted  or maybe the uninstaller didn t remove all traces of it  If you want to be sure  check the filesystem to see if the application still exists where its registry entries say it is   Edit   If you re a member of the group Administrators  you can check the HKEY USERS hive - each user s HKCU actually resides there  you ll need to know the user SID  or go through all of them    Note  As  Brian Ensink says   installed  is a bit of a vague concept - are we trying to find what the user could run  Some software doesn t even write to the Registry at all  search for  portable apps  to see apps that have been specifically modified to run directly from media  CD USB  and not to leave any traces on the computer  We may also have to scan the disks  and network disks  and anything the user downloads  and world-accessible Windows shares in the Internet  yes  such things exist legitimately -   live sysinternals com tools comes to mind   In this direction  there s no real limit of what the user can run  unless prevented by system policies

User · Answer

You could use MSI API to enumerate everything installed by Windows Installer but that won t list all the software available on a machine   Without knowing more about what you need I think the concept of  installed  is a little vague   There are many ways to deploy software to a system ranging from big complicated installers to ZIP files and everything in between

User · Answer

An application does not need to have any registry entry. In fact, many applications do not need to be installed at all. U3 USB sticks are a good example; the programs on them just run from the file system.

As noted, most good applications can be found via their uninstall registry key though. This is actually a pair of keys, per-user and per-machine (HKCU/HKLM - Piskvor mentioned only the HKLM one). It does not (always) give you the install directory, though.

If it's in HKCU, then you have to realise that HKEY_CURRENT_USER really means "Current User". Other users have their own HKCU entries, and their own installed software. You can't find that. Reading every HKEY_USERS hive is a disaster on corporate networks with roaming profiles. You really don't want to fetch 1000 accounts from your remote [US|China|Europe] office.

Even if an application is installed, and you know where, it may not have the same "version" notion you have. The best source is the "version" resource in the executables. That's indeed a plural, so you have to find all of them, extract version resources from all and in case of a conflict decid on something reasonable.

So - good luck. There are dozes of ways to fail.

User · Answer

Seems like looking for something specific to the installed program would work better  but HKCU Software and HKLM Software are the spots to look

User · Answer

You could use MSI API to enumerate everything installed by Windows Installer but that won t list all the software available on a machine   Without knowing more about what you need I think the concept of  installed  is a little vague   There are many ways to deploy software to a system ranging from big complicated installers to ZIP files and everything in between

User · Answer

On 64-bit systems the x64 key is   HKEY LOCAL MACHINE SOFTWARE Microsoft Windows CurrentVersion Uninstall   Most programs are listed there   Look at the keys  DisplayName DisplayVersion  Note that the last is not always set   On 64-bit systems the x86 key  usually with more entries  is   HKEY LOCAL MACHINE SOFTWARE Wow6432Node Microsoft Windows CurrentVersion Uninstall

User · Answer

On 64-bit systems the x64 key is   HKEY LOCAL MACHINE SOFTWARE Microsoft Windows CurrentVersion Uninstall   Most programs are listed there   Look at the keys  DisplayName DisplayVersion  Note that the last is not always set   On 64-bit systems the x86 key  usually with more entries  is   HKEY LOCAL MACHINE SOFTWARE Wow6432Node Microsoft Windows CurrentVersion Uninstall

User · Answer

Seems like looking for something specific to the installed program would work better  but HKCU Software and HKLM Software are the spots to look

User · Answer

In addition to all the registry keys mentioned above  you may also have to look at HKEY CURRENT USER Software Microsoft Installer Products for programs installed just for the current user

User · Answer

Win32 Product never shows everything  only software installed via an MSI installer  as far as I can tell    There are lots of software packages that get installed via other installers that don t show up in there   another way is needed

User · Answer

On 64-bit systems the x64 key is   HKEY LOCAL MACHINE SOFTWARE Microsoft Windows CurrentVersion Uninstall   Most programs are listed there   Look at the keys  DisplayName DisplayVersion  Note that the last is not always set   On 64-bit systems the x86 key  usually with more entries  is   HKEY LOCAL MACHINE SOFTWARE Wow6432Node Microsoft Windows CurrentVersion Uninstall

User · Answer

Seems like looking for something specific to the installed program would work better  but HKCU Software and HKLM Software are the spots to look

User · Answer

An application does not need to have any registry entry. In fact, many applications do not need to be installed at all. U3 USB sticks are a good example; the programs on them just run from the file system.

As noted, most good applications can be found via their uninstall registry key though. This is actually a pair of keys, per-user and per-machine (HKCU/HKLM - Piskvor mentioned only the HKLM one). It does not (always) give you the install directory, though.

If it's in HKCU, then you have to realise that HKEY_CURRENT_USER really means "Current User". Other users have their own HKCU entries, and their own installed software. You can't find that. Reading every HKEY_USERS hive is a disaster on corporate networks with roaming profiles. You really don't want to fetch 1000 accounts from your remote [US|China|Europe] office.

Even if an application is installed, and you know where, it may not have the same "version" notion you have. The best source is the "version" resource in the executables. That's indeed a plural, so you have to find all of them, extract version resources from all and in case of a conflict decid on something reasonable.

So - good luck. There are dozes of ways to fail.

User · Answer

Win32 Product never shows everything  only software installed via an MSI installer  as far as I can tell    There are lots of software packages that get installed via other installers that don t show up in there   another way is needed

User · Answer

User-specific settings should be written to HKCU Software  machine-specific settings to HKLM Software  Under these keys  structure  software vendor name   application name   e g  HKLM Software Microsoft Internet Explorer  may be the most common  but that s just a convention  not a law of nature   Many  most   applications also add their uninstall entries to HKLM Software Microsoft Windows CurrentVersion Uninstall  app name   but again  not all applications do this   These are the most important keys  however  contents of the registry do not have to represent the installed software exactly - maybe the application was installed once  but then was manually deleted  or maybe the uninstaller didn t remove all traces of it  If you want to be sure  check the filesystem to see if the application still exists where its registry entries say it is   Edit   If you re a member of the group Administrators  you can check the HKEY USERS hive - each user s HKCU actually resides there  you ll need to know the user SID  or go through all of them    Note  As  Brian Ensink says   installed  is a bit of a vague concept - are we trying to find what the user could run  Some software doesn t even write to the Registry at all  search for  portable apps  to see apps that have been specifically modified to run directly from media  CD USB  and not to leave any traces on the computer  We may also have to scan the disks  and network disks  and anything the user downloads  and world-accessible Windows shares in the Internet  yes  such things exist legitimately -   live sysinternals com tools comes to mind   In this direction  there s no real limit of what the user can run  unless prevented by system policies

User · Answer

You could use MSI API to enumerate everything installed by Windows Installer but that won t list all the software available on a machine   Without knowing more about what you need I think the concept of  installed  is a little vague   There are many ways to deploy software to a system ranging from big complicated installers to ZIP files and everything in between

User · Answer

Seems like looking for something specific to the installed program would work better  but HKCU Software and HKLM Software are the spots to look

User · Answer

On 64-bit systems the x64 key is   HKEY LOCAL MACHINE SOFTWARE Microsoft Windows CurrentVersion Uninstall   Most programs are listed there   Look at the keys  DisplayName DisplayVersion  Note that the last is not always set   On 64-bit systems the x86 key  usually with more entries  is   HKEY LOCAL MACHINE SOFTWARE Wow6432Node Microsoft Windows CurrentVersion Uninstall

[windows] Detecting installed programs via registry

Examples related to windows

Examples related to registry