Uninstall Registry Keys Question

This topic contains 5 replies, has 4 voices, and was last updated by Profile photo of Jack Neff Jack Neff 6 months ago.

  • Author
    Posts
  • #41550
    Profile photo of Lery
    Lery
    Participant

    I had a request to retrieve the values in the following registry keys from Windows 7, Windows 8, Windows 2008 machines:

    HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\ and HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\

    I came up with the following. It seems to satisfy this request just fine.

    If ((Get-WmiObject win32_processor).AddressWidth -eq 32){   
                    $keys = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*"
                } Else {   
                    $keys = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*","HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"
                }
    Get-ItemProperty $keys |  Select-Object DisplayName, DisplayVersion, Publisher, InstallDate
    

    Any objections to doing this?

    If not objections, any idea how I can get rid of the blank lines that are returned because some entries in the registry keys do not have a display name, display version, publisher or installdate?

  • #41573
    Profile photo of Yuan Li
    Yuan Li
    Participant

    Can you just filter out the empty entries? For example

    Get-ItemProperty $keys |  where-object {$_.displayname -ne $null} |Select-Object DisplayName, DisplayVersion, Publisher, InstallDate
    
    • #41585
      Profile photo of Lery
      Lery
      Participant

      Thanks Yuan Li, that worked well for the empty lines.

      Any comment if the way I'm gathering this information is OK or not OK in any way?

      I know I could use remote registry, but I'm not allowed to mess with services. I have used WMI to query win32_product, but that causes reconfiguration errors in event viewer and Microsoft supposedly says not do that. So I think this is my only option.

  • #41704
    Profile photo of Jack Neff
    Jack Neff
    Participant

    I don't see anything wrong with what you're doing. I have used both the registry method and the wmi method in the past. The wmi method never gave me problems, not sure what MS article you're referring to. The registry way is waaay faster but you have to filter out all the "Updates" and "Service Packs" if you don't want to see those.

    If you have to manually run this script on hundreds of machines b/c you can't enable remote registry or WinRM that would be no bueno. Only methods I know for running a script on a list of machines with those constraints is :
    * Machine GPO logon script (requires a restart which is problematic when you're talking servers)
    * SCCM application deployed as required (but if you had sccm you could simply run a software report)
    * PSExec tool (Don might kick me off the forum for mentioning this)

  • #41774
    Profile photo of Christian Sandfeld
    Christian Sandfeld
    Participant

    @Jack Neff: The problem with querying the Win32_Product WMI class is that it will cause the MSI provider to perform a consistency check of all installed packages. This is also why it is so slow. Check https://support.microsoft.com/kb/974524 for details.

    The KB article lists Win32reg_AddRemovePrograms as alternative, but I think that classe is provided by the SCCM client (not 100% sure though).

  • #41786
    Profile photo of Jack Neff
    Jack Neff
    Participant

    Did not know that, thanks for the info!

You must be logged in to reply to this topic.