I want to be able to use one query to get the DisplayName and DisplayVersion together from the uninstall key. Is there an “easy” way to do this (see below)?
I can do this:
if (exists values “DisplayVersion” of keys whose(value “DisplayName” of it as string starts with “Microsoft .NET”) of keys “HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall” of (x32 registries; x64 registries)) then ((it as string) of values “DisplayName” of keys whose(value “DisplayName” of it as string starts with “Microsoft .NET”) of keys “HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall” of (x32 registries; x64 registries)) else “n/a”
to get this:
Microsoft .NET Runtime - 6.0.36 (x64)
Microsoft .NET Host - 8.0.13 (x64)
Microsoft .NET Host FX Resolver - 6.0.36 (x64)
Microsoft .NET Host FX Resolver - 8.0.13 (x64)
Microsoft .NET Runtime - 8.0.13 (x64)
Microsoft .NET Runtime - 6.0.36 (x64)
Microsoft .NET Host - 6.0.36 (x64)
and I can do this:
if (exists values “DisplayVersion” of keys whose(value “DisplayName” of it as string starts with “Microsoft .NET”) of keys “HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall” of (x32 registries; x64 registries)) then ((it as string) of values “DisplayVersion” of keys whose(value “DisplayName” of it as string starts with “Microsoft .NET”) of keys “HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall” of (x32 registries; x64 registries)) else “n/a”
To get this:
6.0.36.34214
64.52.27977
48.144.23141
64.52.27977
64.52.27977
48.144.23141
48.144.23141
Is there a (single) query that can combine these two queries to produce this (tab separated) list?
Must you get the ‘n/a’ result for computers that have no Microsoft .NET, or is an empty result ok? Much easier to just produce the empty results than to have the if/then/else.
Using the pipe operator ‘|’ to handle cases where the DisplayVersion is not present, and using percent-encoding the ‘%09’ symbol as the ASCII value for a TAB, we can do
(concatenation "%09" of (value "DisplayName" of it as string; value "DisplayVersion" of it as string | "unknown")) of keys whose (value "DisplayName" of it as string starts with "Microsoft .NET") of keys "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" of (x32 registries; x64 registries)
This will give you slightly more information than you requested but this is what we pull in with our application analysis, so that it pulls in information for multiple OS Types.
if (name of operating system as lowercase contains “win”) then (unique values of (substrings separated by “;” of ((concatenation “;” OF ((unique values of ((if (exists value “DisplayName” of it AND exists value “DisplayName” of it as string) then (value “DisplayName” of it as string) else ( “” )) & (if (exists value “Publisher” of it) then ( " | " & value “Publisher” of it as string) else ( “” )) & (if (exists value “DisplayVersion” of it) then ( " | " & value “DisplayVersion” of it as string) else ( “” )) & (if (exists value “InstallDate” of it) then ( " | " & value “InstallDate” of it as string) else ( “” ))) of keys whose (exists value “UninstallString” of it AND (not exists value “SystemComponent” of it OR exists value “SystemComponent” whose (it as string = “0”)of it) AND (it does not contain “Hotfix” AND it does not contain “Security Update for” AND it does not contain “Update for” AND it does not contain “Security Update for Windows” AND it does not contain “Update for Windows” AND it does not contain “Security Update for Microsoft” AND (length of it > 0) and (number of substrings " " of it < length of it)) of (value “DisplayName” of it as string)) of key “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall” of registry) )) ;(concatenation “;” OF ((unique values of ((if (exists value “DisplayName” of it AND exists value “DisplayName” of it as string) then (value “DisplayName” of it as string) else ( “” )) & (if (exists value “Publisher” of it) then ( " | " & value “Publisher” of it as string) else ( “” )) & (if (exists value “DisplayVersion” of it) then ( " | " & value “DisplayVersion” of it as string) else ( “” ))& (if (exists value “InstallDate” of it) then ( " | " & value “InstallDate” of it as string) else ( “” ))) of keys whose (exists value “UninstallString” of it AND (not exists value “SystemComponent” of it OR exists value “SystemComponent” whose (it as string = “0”)of it) AND (it does not contain “Hotfix” AND it does not contain “Security Update for” AND it does not contain “Update for” AND it does not contain “Security Update for Windows” AND it does not contain “Update for Windows” AND it does not contain “Security Update for Microsoft” AND (length of it > 0) and (number of substrings " " of it < length of it)) of (value “DisplayName” of it as string)) of key “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall” of native registry)))))) else if (name of operating system as lowercase contains “aix”) then (unique values of ((lpp_name of it & " | " & " | " & version of it as string & “.ppc”) of filesets of products of object repository ; ((unique values of (name of it & " | " & " | " & version of it as string & “.” & architecture of it) of packages of rpm) as string))) else if (name of operating system as lowercase contains “sun”) then (unique values of (param “PKGINST” of it & " | " & " | " & version of it as string) of pkginfos of pkgdb) else if (name of operating system as lowercase contains “red” or name of operating system as lowercase contains “suse” or name of operating system as lowercase contains “oracle”) then ((unique values of (name of it & " | " & " | " & version of it as string & “.” & architecture of it) of packages of rpm) as string) else “OS not supported”