Installed Applications date

[system]

(imported topic written by Gman8291)

Hi im looking to run an analyses against our computers that shows installed applications and date installed.

This is so we can then see applications installed in last week/month of a certain group and then remove any that are not authorised.

Ive started off with the below just for a basic list:

Q: (values “displayname” of it, names of it, values “InstallDate” of it) of keys of key “HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall” of native registry

A: Microsoft Forefront Endpoint Protection 2010 Evaluation Version, Microsoft Security Client, 20110817

But this gives date in the wrong format this got me looking and i saw a post that allows to convert this date string into how many days from todays date. Which would be perfect.

Q: current date - date (( last 2 of it & " " & first 3 of (month (last 2 of first 6 of it as integer) as string) & " " & first 4 of it) of (first 8 of “20110817”))

A: 51 days

If i could somehow incorporate that into the Relevance for “Install Windows Applications” it would be really useful, but i keep getting errors. So instead of saying :Installed 20110817 it would say 10days or something…

Q: (if it = “” then nothing else it) of unique values of ((if (exists value"DisplayName" of it AND exists value “DisplayName” of it as string) then (value “DisplayName” of it as string) else ("")) & (if (exists value “DisplayVersion” of it AND exists value “DisplayVersion” of it as string) then (" | Version: " & value “DisplayVersion” of it as string) else ("")) & (if (exists value “InstallDate” of it AND exists value “InstallDate” of it as string) then (" | Installed: " & value “InstallDate” of it as string) else (""))) of keys whose (exists value “UninstallString” of it AND ((not exists value “SystemComponent” of it) OR (exists value “SystemComponent” of it AND name of it starts with “{” AND name of it contains “}” AND (exists match (regex “(9|A|B|C)(0|1)1(2|4)\d\d\d\d-(0011|0012|0013|0014|0017|002E|002F|0030|0031|0033|0035|003A|003B|0044|0051|0052|0053|0057|00BA |00CA|10D7|110D)-(0000|0409)-(0|1)000-(0|1)000000FF1CE$”) of preceding text of first “}” of following text of first “{” of name of it))) AND (if (exists value “DisplayName” of it AND exists value “DisplayName” of it as string) then ((it does not contain “Hotfix” AND it does not contain “Security Update for” AND it does not contain “Update for” AND it does not contain “Security Update for Windows” AND it does not contain “Update for Windows” AND it does not contain “Security Update for Microsoft” AND (length of it > 0) AND (number of substrings " " of it < length of it)) of (value “DisplayName” of it as string)) else true)) of keys “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall” of (if x64 of operating system then (x32 registry; x64 registry) else registry)

A: 7-Zip 4.65 | Version: 4.65.00.0 | Installed: 20110512

A: Adobe Creative Suite 5.5 Web Premium | Version: 5.5

Im trying to incorporate this:

(if (exists value “InstallDate” of it AND exists value “InstallDate” of it as string) then current date - date (( last 2 of it & " " & first 3 of (month (last 2 of first 6 of it as integer) as string) & " " & first 4 of it) of first 8 of ((values “InstallDate” of keys of key “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall” of registry) as string))

But just cant get the relevance correct…

Any input would be much appreciated, or if anyones done this.

Thanks

[Noah]

(imported comment written by NoahSalzman)

q: (values “displayname” of it, names of it, (((current date - date (last 2 of it & " " & (month (last 2 of first 6 of it as integer) as three letters) & " " & first 4 of it)) of firsts 8 of (values “InstallDate” of it as string)))) of keys of key “HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall” of native registry

A: Tivoli Endpoint Manager Server, InstallShield_{1B1E6C4E-DB82-4B34-A721-E6EDDF34E507}, 107 days

A: Tivoli Endpoint Manager Installation Generator, InstallShield_{A0C28E1C-6E18-4F5F-A57A-644C24B10DA3}, 107 days

A: SQL Server 2008 R2 Management Studio, {020617D7-2F72-4D02-BF59-A5CBC1761177}, 274 days

A: SQL Server 2008 R2 Integration Services, {04D1DF8F-2D00-44F8-8094-5A8822354B89}, 274 days

A: SQL Server 2008 R2 Full text search, {06A7EA72-0F00-4D53-A81C-A5D925711141}, 274 days

A: Microsoft .NET Framework 4 Extended, {0A0CADCF-78DA-33C4-A350-CD51849B9702}, 232 days

A: IBM Tivoli Remote Control - Controller, {1021A16A-D269-4364-84D4-BE91468DB96F}, 225 days

A: SQL Server 2008 R2 Management Studio, {121475F5-2598-4574-8801-8F6B3D6A99BB}, 274 days

A: SQL Server 2008 R2 BI Development Studio, {143203CB-9E09-4D9D-91F1-D000EC6E1F87}, 274 days

[system]

(imported comment written by Gman8291)

Ah, thank you Noah. I was completely overcomplicating things for myself. That’s exactly what I wanted.

Really appreciate your help. Have a good weekend

Gordon

[Noah]

(imported comment written by NoahSalzman)

Glad to be of help. Getting the parentheses correct was a bit of a hassle, I’m not surprised it was giving you trouble.

[system]

(imported comment written by Gman8291)

That does tend to be where i fall down Thank again.

[system]

(imported comment written by Kenz91)

Noah I’ve tried your solution but for some reason I keep getting an error( E: Singular expression refers to nonexistent object) at the end of the list on almost all machines. Any idea what could be causing this?

[Noah]

(imported comment written by NoahSalzman)

You have a key that is missing a one of the values for display name or install date… I would guess.

[system]

(imported comment written by Kenz91)

The thing is though if I use this:

Q: (values “displayname” of it, names of it, values “InstallDate” of it) of keys of key “HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall” of native registry

I don’t get the error

If I use this:

Q: (values “displayname” of it, names of it, current date - date (( last 2 of it & " " & first 3 of (month (last 2 of first 6 of it as integer) as string) & " " & first 4 of it) of (first 8 of “20110817”))) of keys of key “HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall” of native registry

I do get the error

[Noah]

(imported comment written by NoahSalzman)

Well, if you want to pin down what is causing the error you will need to build up the “install date” logic until you find the problem.

This would be the first step:

q: (values “displayname” of it, names of it, firsts 8 of (values “InstallDate” of it as string)) of keys of key “HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall” of native registry

No error? Then move to step two:

q: (values “displayname” of it, names of it, ((last 2 of it & " " & (month (last 2 of first 6 of it as integer) as three letters) & " " & first 4 of it)) of firsts 8 of (values “InstallDate” of it as string)) of keys of key “HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall” of native registry

No error? Then try step three:

q: (values “displayname” of it, names of it, (date (last 2 of it & " " & (month (last 2 of first 6 of it as integer) as three letters) & " " & first 4 of it)) of firsts 8 of (values “InstallDate” of it as string)) of keys of key “HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall” of native registry

[system]

(imported comment written by Kenz91)

First one no error

Second one error occurrs

Is this happening because not everything has an “Install Date”?

[Noah]

(imported comment written by NoahSalzman)

I’m guessing there is an InstallDate string that has some bogus value, like all zeros or something like that.

[system]

(imported comment written by Kenz91)

Ok I went through every Installdate in that hive and I found one that had a date in the format mm-dd-yyyy. I edit the registry to make it like the others and I don’t get the error. Can you think of a way I could get it to skip over any invalid ones like this?

[Noah]

(imported comment written by NoahSalzman)

Try this. That syntax (using the | operator) will only work in 8.0 and up. But cases like this are

exactly

the reason we implemented it.

(values “displayname” of it, names of it, ((((current date - date (last 2 of it & " " & (month (last 2 of first 6 of it as integer) as three letters) & " " & first 4 of it)) of first 8 of (values “InstallDate” of it as string))) as string | “Bad or missing install date”)) of keys of key “HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall” of native registry

[system]

(imported comment written by Kenz91)

Thanks Noah. I’ve gotten closer to what I want but getting a new error. Here is what I have.

Q: (values “displayname” of it, (if (exists value “InstallDate” of it AND exists value “InstallDate” of it as string) then (value “InstallDate” of it as string) else (“No Install Date”)), ((((current date - date (last 2 of it & " " & (month (last 2 of first 6 of it as integer) as three letters) & " " & first 4 of it)) of first 8 of (values “InstallDate” of it as string))) as string | “Bad or missing install date”)) of keys whose (exists value “UninstallString” of it AND ((not exists value “SystemComponent” of it) OR (exists value “SystemComponent” of it AND name of it starts with “{” AND name of it contains “}” AND (exists match (regex “(9|A|B|C)(0|1)1(2|4)\d\d\d\d-(0011|0012|0013|0014|0017|002E|002F|0030|0031|0033|0035|003A|003B|0044|0051|0052|0053|0057|00BA |00CA|10D7|110D)-(0000|0409)-(0|1)000-(0|1)000000FF1CE$”) of preceding text of first “}” of following text of first “{” of name of it))) AND (if (exists value “DisplayName” of it AND exists value “DisplayName” of it as string) then ((it does not contain “Hotfix” AND it does not contain “Security Update for” AND it does not contain “Update for” AND it does not contain “Security Update for Windows” AND it does not contain “Update for Windows” AND it does not contain “Security Update for Microsoft” AND (length of it > 0) AND (number of substrings " " of it < length of it)) of (value “DisplayName” of it as string)) else true)) of keys “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall” of (if x64 of operating system then (x32 registry; x64 registry) else registry)

A: Administration Tools Pack, 20081229, 1022 days

A: Rainbow iKey Driver v3.4.5.108, No Install Date, Bad or missing install date

A: Apple Application Support, 20110930, 17 days

A: Lotus Notes Client 8.5.1, 20091119, 697 days

A: Microsoft Visual C++ 2005 Redistributable, 20110629, 110 days

A: MSXML 4.0 SP2 Parser and SDK, 20081217, 1034 days

A: WIMGAPI, 20110516, 154 days

A: SafeNet Borderless Security PK Client, 20090805, 803 days

A: PacketTrap pt360 Tool Suite, 20090210, 979 days

A: DEP-IE-Enabled, No Install Date, Bad or missing install date

A: SMART Install Manager, 20090129, 991 days

A: MSXML 4.0 SP2 (KB954430), 20081217, 1034 days

A: Microsoft SQL Server Management Objects Collection , 20090728, 811 days

A: PowerPointFRClassButtons Version 1.1, 20110405, 195 days

A: SQLXML4, 20081217, 1034 days

A: SecureDoc Disk Encryption, 20090306, 955 days

A: Microsoft Office Professional Plus 2007, 20111007, 10 days

A: Microsoft Office 2007 Service Pack 2 (SP2), No Install Date, Bad or missing install date

E: Could not convert value to required type.

[Noah]

(imported comment written by NoahSalzman)

Haven’t seen that error before. There is a lone (unanswered)

Forum thread

that mentions that error.

I tried putting weird values into some of the DisplayName registry entries on my test box, but I was not able to reproduce the error.

I can only suggest that you try and figure out which value is causing the problem and then try and write around it.

[system]

(imported comment written by Kenz91)

Well I figured out what was going on. The reason I was getting the error was because there are some registry entries that don’t have a Displayname. Here’s what I did to fix it.

Q: ((if (exists value “displayname” of it AND exists value “displayname” of it as string) then (value “displayname” of it as string) else (“No Display Name”)), (if (exists value “InstallDate” of it AND exists value “InstallDate” of it as string) then (value “InstallDate” of it as string) else (“No Install Date”)), ((((current date - date (last 2 of it & " " & (month (last 2 of first 6 of it as integer) as three letters) & " " & first 4 of it)) of first 8 of (values “InstallDate” of it as string))) as string | “Bad or missing install date”)) of keys whose (exists value “UninstallString” of it AND ((not exists value “SystemComponent” of it) OR (exists value “SystemComponent” of it AND name of it starts with “{” AND name of it contains “}” AND (exists match (regex “(9|A|B|C)(0|1)1(2|4)\d\d\d\d-(0011|0012|0013|0014|0017|002E|002F|0030|0031|0033|0035|003A|003B|0044|0051|0052|0053|0057|00BA |00CA|10D7|110D)-(0000|0409)-(0|1)000-(0|1)000000FF1CE$”) of preceding text of first “}” of following text of first “{” of name of it))) AND (if (exists value “DisplayName” of it AND exists value “DisplayName” of it as string) then ((it does not contain “Hotfix” AND it does not contain “Security Update for” AND it does not contain “Update for” AND it does not contain “Security Update for Windows” AND it does not contain “Update for Windows” AND it does not contain “Security Update for Microsoft” AND (length of it > 0) AND (number of substrings " " of it < length of it)) of (value “DisplayName” of it as string)) else true)) of keys “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall” of (if x64 of operating system then (x32 registry; x64 registry) else registry)

A: SQLXML4, 20081217, 1036 days

A: SecureDoc Disk Encryption, 20090306, 957 days

A: Microsoft Office Professional Plus 2007, 20111007, 12 days

A: Microsoft Office 2007 Service Pack 2 (SP2), No Install Date, Bad or missing install date

A: No Display Name, No Install Date, Bad or missing install date

A: No Display Name, No Install Date, Bad or missing install date

A: No Display Name, No Install Date, Bad or missing install date

A: No Display Name, No Install Date, Bad or missing install date

A: No Display Name, No Install Date, Bad or missing install date

A: No Display Name, No Install Date, Bad or missing install date

A: No Display Name, No Install Date, Bad or missing install date

A: No Display Name, No Install Date, Bad or missing install date

A: No Display Name, No Install Date, Bad or missing install date

A: Compatibility Pack for the 2007 Office system, 20110810, 70 days

A: Microsoft Office InfoPath MUI (English) 2007, 20100518, 519 days

[system]

(imported comment written by Kenz91)

As kind of a branch off this is there an easy way to just come back with a count of the applications installed on each computer?

[Noah]

(imported comment written by NoahSalzman)

On Windows it would be:

number of regapps

On Mac it would be:

number of applications

Note that on Mac OS X Lion there is a bug preventing us from using the “application” inspector.

[mesee2]

Anyone have an example of this for targeting a single application?

• would like to build a policy / action that triggers on new install of an application then does something.

Use case is SQL DBAs installing SQL from original RTM and people starting to use before it is updated to current.
Similar is people installing Office from RTM and not updating.

Challenge is some systems are built and left idle for 1 day to 180 days before SQL or Office is installed.

• These are servers so need to ensure i only target the first day the app is installed to perform the update, after that it needs to fall into routine patch window. Which maintenance windows, etc.

[trn]

Not sure of the value of resurrecting such an old thread, but my thoughts would be to target any version below an acceptable minimum, and your regular patching can take over from there.