Property to identify if Microsoft Teams is 32 bit or 64 bit

Content Authoring
1

Hi,

At our company we are trying to identify if Microsoft Teams client installed on computers is 32 bit or 64 bit, in order to do that was trying to make property in bigfix but no success.

We use Windows 10 and O365 (32bit), but as far as i can tell, Teams is agnostic of the OS and O365 flavour (32 or 64 bit).

The client is installed in “%LocalAppData%\Microsoft\Teams\current” so i can’t infer which version it is from the path of instalation. In registry i can’t find any clue to which version it is.

Does anybody have any clue or sugestions? Help would be greatly appreciated.

Thanks,

2

For a per-machine install, we’d usually check whether the registry entries exist in the x32 registries or x64 registries hives. In 'Updates for Windows Applications Extended`, the separate x32 and x64 Fixlets for PuTTY or VS Code or PowerBI are good examples of this.

Since it appears your Teams may be per-user installs, you may need to check the registry keys for logged-on users rather than HKEY_LOCAL_MACHINE. I’ll be back at a computer shortly, but it’s something like `current user keys of logged on users’.

For added fun, if these are indeed per-user installs, you’d only detect them while the user is logged on; and it may be possible for a single machine to have both architectures installed (one user with the x32 and another on the same machine with x64).

3

Thanks for the reply.

The examples that you gave about Putty, VS Code or PowerBI are great but don’t apply to this situation. :frowning:

We have per user instalation and it’s a pain. Looking at the registry in “HKEY_USERS\xxxxxxxx\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Teams”, i can get instalation path, version, etc, but no info about 32 or 64 bit client.

Created a property to look if the process Teams.exe is running and if so what version of the client its running but again can’t get de info that i want. I’m hitting a wall. :frowning:

4

The thing to get from the examples I cited was that they look specifically at ‘x32 registries’ or ‘x64 registries’ depending upon whether they target the 32-bit or 64-bit products.

5

You can see some of the differences in the Fixlet debugger…

32-bit per-machine applications:

q: (values "DisplayName" of it, pathname of it) of keys of keys "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" of x32 registries

A: Visual Studio Build Tools 2019, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\6fd5460c
A: Cisco WebEx Meetings, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\ActiveTouchMeetingClient
A: AnyDesk, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\AnyDesk

64-bit Per-Machine Applications:

q: (values "DisplayName" of it, pathname of it) of keys of keys "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" of x64 registries

A: 7-Zip 19.00 (x64), HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
A: Windows Driver Package - Lenovo Monitor  (11/09/2018 6.10.0.0), HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\B757445117C6A0C55D3FFFC6CF7A9C05A6A5D74E
A: Git, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Git_is1
A: Notepad++ (64-bit x64), HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Notepad++

Where it gets tricky is that there is no 32-bit redirection when looking at a per-user registry, there’s no built-in ‘x32 keys of logged on users’, only ‘user keys of logged on users’. So we have to detect the OS architecture and reflect “64-bit” on a 64-bit machine or 32-bit on a 32-bit machine when checking the “normal” Uninstall key

q: ((if x64 of operating system then "64-bit" else if x32 of operating system then "32-bit" else "Unknown"), values "DisplayName" of it, pathname of it) of keys of keys "Software\Microsoft\Windows\CurrentVersion\Uninstall" of user keys of logged on users

A: 64-bit, Atom, HKEY_USERS\S-1-5-21-474380057-1838352999-1581317240-10427\Software\Microsoft\Windows\CurrentVersion\Uninstall\atom
A: 64-bit, GitHub Desktop, HKEY_USERS\S-1-5-21-474380057-1838352999-1581317240-10427\Software\Microsoft\Windows\CurrentVersion\Uninstall\GitHubDesktop
A: 64-bit, GoToMeeting 10.19.0.19950, HKEY_USERS\S-1-5-21-474380057-1838352999-1581317240-10427\Software\Microsoft\Windows\CurrentVersion\Uninstall\GoToMeeting
A: 64-bit, Insomnia, HKEY_USERS\S-1-5-21-474380057-1838352999-1581317240-10427\Software\Microsoft\Windows\CurrentVersion\Uninstall\insomnia

And for 32-bit, we can check for the keys under the Wow6432Node key. If entries exist here, it’s definitely a 32-bit app (the Wow6432Node key should not exist on a 32-bit Windows machine)

q: ("32-bit", values "DisplayName" of it, pathname of it) of keys of keys "Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall" of user keys of logged on users
T: 0.000 ms

So, you can add some filters to find the five cases: Teams installed x32 System-Wide, x64 System-Wide, x32 Per-User on x32 system, x64 Per-User on x64 system, or x32 Per-User on x64 System:

// x32 System-Wide Teams Exists
q: exists keys whose (value "DisplayName" of it = "Microsoft Teams") of keys "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" of x32 registries
A: False
T: 0.035 ms

// x64 System-Wide Teams Exists
q: exists keys whose (value "DisplayName" of it = "Microsoft Teams") of keys "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" of x64 registries
A: False
T: 0.036 ms

// x64 Per-User Teams Exists
q: x64 of operating system and exists keys whose (value "DisplayName" of it = "Microsoft Teams") of keys "Software\Microsoft\Windows\CurrentVersion\Uninstall" of user keys of logged on users
A: True
T: 0.043 ms

// x32 Per-User Teams Exists on x32 Operating System
q: x32 of operating system and exists keys whose (value "DisplayName" of it = "Microsoft Teams") of keys "Software\Microsoft\Windows\CurrentVersion\Uninstall" of user keys of logged on users
A: False
T: 0.045 ms

// x32 Per-User Teams Exists on x64 Operating System
q: exists keys whose (value "DisplayName" of it = "Microsoft Teams") of keys "Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall" of user keys of logged on users
A: False
T: 0.038 ms
7

Here is a slightly different approach that I leverage when I need to truly know if an EXE file is not only 32-bit or 64-bit, but also if it is for ARM, x86, etc…

(item 1 of (("1d3","AM33");("8664","AMD64");("1c0","ARM");("aa64","ARM64");("1c4","ARMNT");("14c","I386");("200","IA64")) whose (item 0 of it as lowercase = (concatenation of ((it as hexadecimal) of bytes (integers in ((it+1, it) of ((((left shift 24 of (byte 63 of it as bit set) + left shift 16 of (byte 62 of it as bit set) + left shift 8 of (byte 61 of it as bit set) + (byte 60 of it as bit set)) as integer) of it) + 4))) of (file "PATH_TO_FILE_IN_QUESTION")) | "0"))) | "Unknown"

I386 = 32-bit (x86)
ARM = 32-bit (ARM)
AMD64 = 64-bit (x64)
ARM64 = 64-bit (ARM 64)
IA64 = 64-bit (Intel Itanium)

This is only a subset of the actual relevance to keep it simple.

For those interested in deep diving…

There is no direct inspector to determine the architecture of a binary file. What I have there is:

  1. Load 4 bytes from the file starting at offset 60 to obtain the PE binary header offset location. This represents a 32-bit integer but since you can only read byte-by-byte using relevance I have to do bit shifting to recreate the number.
  2. At the offset location calculated in step 1, skip ahead 4 bytes then read in the next 2 bytes. This is the COFF File Header Machine Types field.
  3. Using the Machine Type code, lookup the type name in the lookup table of machine types.
3 Likes
8

Hi Jason,

Thanks for the time that you took to construct that answer.

I have been testing with the diferent code that you posted, but unfortunely MS Teams doesn’t register anything under the key “software\wow6432Node…” of the user, even if we install x32 Teams client. So we just get a bunch of false positives. :frowning:

image
image1270×837 57.1 KB

I guess that trying to figure out which version is installed just by looking at registry keys it’s a no go. Then we have another variable, we have machines that are used by multiple users. Just to keep things interesting. :smiley:

Best regards,

9

Hello Mike,

Thanks for the answer.

I tried the property and if i point it to a specific path/file it works like a charm. Was trying to adapt it to look at multiple user folders so i could find out if all users of a same machine are using the same type of Teams client. I tried something like this but without sucess.

(item 1 of ((“1d3”,“AM33”);(“8664”,“AMD64”);(“1c0”,“ARM”);(“aa64”,“ARM64”);(“1c4”,“ARMNT”);(“14c”,“I386”);(“200”,“IA64”)) whose (item 0 of it as lowercase = (concatenation of ((it as hexadecimal) of bytes (integers in ((it+1, it) of ((((left shift 24 of (byte 63 of it as bit set) + left shift 16 of (byte 62 of it as bit set) + left shift 8 of (byte 61 of it as bit set) + (byte 60 of it as bit set)) as integer) of it) + 4))) of (files “teams.exe” of folders “AppData\Local\Microsoft\Teams\current” of folders whose(exists folders “AppData\Local\Microsoft\Teams\current” of it) of folder “C:\Users”)) | “0”))) | “Unknown”

Dont know if this is possible… any help is appreciated.

Thanks.

Best regards.