I didnt realize it was 12 yr old thread, sorry.
I agree about targeting based on older than baseline would be a clean way
It is giving more coverage on installation date but it in some case it is unable to capture the date. Q: ((if (exists value “displayname” of it AND exists value “displayname” of it as string) then (value “displayname” of it as string) else (“No Display Name”)), (if (exists value “InstallDate” of it AND exists value “InstallDate” of it as string) then (value “InstallDate” of it as string) else (“No Install Date”)), ((((current date - date (last 2 of it & " " & (month (last 2 of first 6 of it as integer) as three letters) & " " & first 4 of it)) of first 8 of (values “InstallDate” of it as string))) as string | “Bad or missing install date”)) of keys whose (exists value “UninstallString” of it AND ((not exists value “SystemComponent” of it) OR (exists value “SystemComponent” of it AND name of it starts with “{” AND name of it contains “}” AND (exists match (regex “(9|A|B|C)(0|1)1(2|4)\d\d\d\d-(0011|0012|0013|0014|0017|002E|002F|0030|0031|0033|0035|003A|003B|0044|0051|0052|0053|0057|00BA |00CA|10D7|110D)-(0000|0409)-(0|1)000-(0|1)000000FF1CE$”) of preceding text of first “}” of following text of first “{” of name of it))) AND (if (exists value “DisplayName” of it AND exists value “DisplayName” of it as string) then ((it does not contain “Hotfix” AND it does not contain “Security Update for” AND it does not contain “Update for” AND it does not contain “Security Update for Windows” AND it does not contain “Update for Windows” AND it does not contain “Security Update for Microsoft” AND (length of it > 0) AND (number of substrings " " of it < length of it)) of (value “DisplayName” of it as string)) else true)) of keys “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall” of (if x64 of operating system then (x32 registry; x64 registry) else registry)
When it doesn’t capture the instructions date, what does it show?
Does that installdate value actually exist in the registry?
I.e. if the InstallDate value is actually not present in the Registry, I expect the query is displaying “No Install Date”, and there is no data there for us tor retrieve.