64 bit windows makes things a little tougher with registry redirection, here’s some ugly relevance that should be more complete.
q: (IF (x64 of operating system) THEN ((values “displayname” of it, values “UninstallString” of it) of keys of key “HKLM\software\microsoft\windows\currentversion\uninstall” of native registry, (values “displayname” of it, values “UninstallString” of it) of keys of key “HKLM\software\microsoft\windows\currentversion\uninstall” of x32 registry) ELSE (values “displayname” of it, values “UninstallString” of it as strings) of keys of key “HKLM\software\microsoft\windows\currentversion\uninstall” of registry)
Thanks to Noah for some assistance in improving this:
q: (IF (x64 of operating system) THEN ((it as string) of (values “displayname” of it, values “uninstallstring” of it) of keys whose (exists (values “displayname” of it, values “uninstallstring” of it)) of key “HKLM\software\microsoft\windows\currentversion\uninstall” of native registry; (it as string) of (values “displayname” of it, values “uninstallstring” of it) of keys whose (exists (values “displayname” of it, values “uninstallstring” of it)) of key “HKLM\software\microsoft\windows\currentversion\uninstall” of x32 registry) ELSE ((it as string) of (values “displayname” of it, values “uninstallstring” of it as string) of keys whose (exists (values “displayname” of it, values “uninstallstring” of it)) of key “HKLM\software\microsoft\windows\currentversion\uninstall” of registry))
This version checks that there’s a value in there to report, and blocks Windows patches from showing up (you’ll still see Office patches though). I’m using this as an analysis now:
(it as string) whose (it as lowercase does not contain “spuninst.exe”) of (IF (x64 of operating system) THEN ((it as string) of (values “displayname” of it, values “uninstallstring” of it) of keys whose (length of (value “displayname” of it as string) > 0 and exists (values “uninstallstring” of it)) of key “HKLM\software\microsoft\windows\currentversion\uninstall” of native registry; (it as string) of (values “displayname” of it, values “uninstallstring” of it) of keys whose (length of (value “displayname” of it as string) > 0 and exists (values “uninstallstring” of it)) of key “HKLM\software\microsoft\windows\currentversion\uninstall” of x32 registry) ELSE ((it as string) of (values “displayname” of it, values “uninstallstring” of it as string) of keys whose (length of (values “displayname” of it as string) > 0 and exists (values “uninstallstring” of it)) of key “HKLM\software\microsoft\windows\currentversion\uninstall” of registry))
Yes at a group of computer names… Maybe I just have to wait longer. So I just paste the code from Jack above in an analysis and it should take care of it right?
I am new to BFX and need some help in uninstalling KB2464588, i have the uninstall string with me but need to create a relevance in which it should look for the KB article in Add/Remove and if found then the string or exe will run.