(imported topic written by Gman8291)
Hi im looking to run an analyses against our computers that shows installed applications and date installed.
This is so we can then see applications installed in last week/month of a certain group and then remove any that are not authorised.
Ive started off with the below just for a basic list:
Q: (values “displayname” of it, names of it, values “InstallDate” of it) of keys of key “HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall” of native registry
A: Microsoft Forefront Endpoint Protection 2010 Evaluation Version, Microsoft Security Client, 20110817
But this gives date in the wrong format this got me looking and i saw a post that allows to convert this date string into how many days from todays date. Which would be perfect.
Q: current date - date (( last 2 of it & " " & first 3 of (month (last 2 of first 6 of it as integer) as string) & " " & first 4 of it) of (first 8 of “20110817”))
A: 51 days
If i could somehow incorporate that into the Relevance for “Install Windows Applications” it would be really useful, but i keep getting errors. So instead of saying :Installed 20110817 it would say 10days or something…
Q: (if it = “” then nothing else it) of unique values of ((if (exists value"DisplayName" of it AND exists value “DisplayName” of it as string) then (value “DisplayName” of it as string) else ("")) & (if (exists value “DisplayVersion” of it AND exists value “DisplayVersion” of it as string) then (" | Version: " & value “DisplayVersion” of it as string) else ("")) & (if (exists value “InstallDate” of it AND exists value “InstallDate” of it as string) then (" | Installed: " & value “InstallDate” of it as string) else (""))) of keys whose (exists value “UninstallString” of it AND ((not exists value “SystemComponent” of it) OR (exists value “SystemComponent” of it AND name of it starts with “{” AND name of it contains “}” AND (exists match (regex “(9|A|B|C)(0|1)1(2|4)\d\d\d\d-(0011|0012|0013|0014|0017|002E|002F|0030|0031|0033|0035|003A|003B|0044|0051|0052|0053|0057|00BA |00CA|10D7|110D)-(0000|0409)-(0|1)000-(0|1)000000FF1CE$”) of preceding text of first “}” of following text of first “{” of name of it))) AND (if (exists value “DisplayName” of it AND exists value “DisplayName” of it as string) then ((it does not contain “Hotfix” AND it does not contain “Security Update for” AND it does not contain “Update for” AND it does not contain “Security Update for Windows” AND it does not contain “Update for Windows” AND it does not contain “Security Update for Microsoft” AND (length of it > 0) AND (number of substrings " " of it < length of it)) of (value “DisplayName” of it as string)) else true)) of keys “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall” of (if x64 of operating system then (x32 registry; x64 registry) else registry)
A: 7-Zip 4.65 | Version: 4.65.00.0 | Installed: 20110512
A: Adobe Creative Suite 5.5 Web Premium | Version: 5.5
Im trying to incorporate this:
(if (exists value “InstallDate” of it AND exists value “InstallDate” of it as string) then current date - date (( last 2 of it & " " & first 3 of (month (last 2 of first 6 of it as integer) as string) & " " & first 4 of it) of first 8 of ((values “InstallDate” of keys of key “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall” of registry) as string))
But just cant get the relevance correct…
Any input would be much appreciated, or if anyones done this.
Thanks
Thank again.