Getting just the GUID of an uninstall string

[D.Dean]

I was able to retrieve the QUID from an uninstall string, but it is followed by a %00

How do I get rid of that?

q: unique values of ((following text of first "/X" of it | it) of (it as string) of values "UninstallString" of keys whose (((it as lowercase contains "chrome") of (value "DisplayName" of it as string as lowercase))) of keys "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" of (x32 registries;x64 registries) as string)
A: {B6F6FFE6-2F3E-3EDA-83A1-B6A491C80760}%00
T: 7.706 ms
I: plural string with multiplicity

We are having issues with chrome installs from BigFix (Bigfix is not the cause, the installer is) leaving behind the Uninstall reg keys entries for the old, removed, version of Chrome. When you try and update to new versions of chrome, it returns failed even though it updates. We are building an analysis to get the old GUIDs so we can delete them. Deleting them manually resolves the issues.

Adding another view of it...

[itsmpro92]

Take a look here:

Concatenation fails after retrieving value

The content of InstalledInstances contains trailing NUL characters, represented as %00%00 in the output. If you want to exclude them, you’ll have to perform some substring manipulation like: Q: (preceding text of first "%00" of (it as string), type of it) of (value "InstalledInstances" of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server" of native registry) A: MSSQLSERVER, REG_MULTI_SZ T: 0.361 ms I: singular ( substring, registry key value type ) The type of this registry k…

Q: (preceding text of first "%00" of (it as string)...

[D.Dean]

How would I fit that in with the "(following text of first "/X" of it | it) of (it as string) of values "UninstallString" of keys"?

[itsmpro92]

Try this approach:

(following text of first "/X" of preceding text of first "%00" of it | it)

[jgstew]

why not just get the name of the key itself? That should already just be the GUID if it is an MSI installed app.

names of keys whose(value "DisplayName" of it as string as lowercase contains "chrome") of keys "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" of (x32 registries;x64 registries)

Could filter it down to just GUIDs if there are also apps that are not MSI installed with results showing up too:

names whose(it starts with "{") of keys whose(value "DisplayName" of it as string as lowercase contains "chrome") of keys "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" of (x32 registries;x64 registries)

I have a template for MSI uninstall fixlets/tasks here: generate_bes_from_template/examples/Uninstall_MSI-Windows.bes.mustache at master · jgstew/generate_bes_from_template · GitHub

And a way to automatically generate them here: generate_bes_from_template/examples/generate_uninstallers.py at master · jgstew/generate_bes_from_template · GitHub

[D.Dean]

@jgstew

names whose(it starts with "{") of keys whose(value "DisplayName" of it as string as lowercase contains "chrome") of keys "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" of (x32 registries;x64 registries)

Because I didn't think of that.

That does what I need.

Thanks