Uninstalled application still showing on Installed Application (Windows)

[jenuine]

Hello.

We have activated an analysis from BES Inventory and License. The Installed Applications - Windows.

We have deleted one application on a specific computer but it still showing in this property.

We restarted the besclient service, clear bigfix console cache. But still it is showing.

Hoping to get some ideas here.

[JasonWalker]

That Analysis also catches per-user installations. If the application has a per-user option I’d check whether any logged-on user accounts have the application installed, or references to it in their registries.

[Aram]

One other consideration: that property has an evaluation interval of once per day, so, this could potentially be due to timing. Sending that one Client a refresh will cause it to re-evaluate everything and send the results to the BigFix Server.

[jenuine]

the application was uninstalled a month ago but still it is showing on the Installed Application Windows Properties.

[JasonWalker]

Then the application is very likely still installed. Probably a per-user installation. Check which users are logged on, and whether the application is installed under one of their user profiles.

[jenuine]

May I ask how can we check and what are the registries need to be checked?

[orbiton]

Just to make sure - The computer “Last Report Time” is updated? If you take the Relevance statement and execute it on the the specific local machine with Fixlet Debugger - Do you still get the same result?

[jgallas]

Although rare it is also possible that the uninstall didn’t complete entirely. I have had a couple of applications leave the Uninstall key in the registry even though the app itself was removed from the Program Files folder. I have therefore created a fixlet to detect if the Uninstall key exists, but the Program Files folder is missing (indicating that it was indeed uninstalled) which then removes the registry key of the offending application.

[jenuine]

Hello.

We have checked that there’s still Mozilla Firefox on this registry including the extension.
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Mozilla

Are we also going to delete this extensions from this registries?

[dobby]

Hello. I have this scenario also. We have check there’s still registry keys found in the affected computer. These are the extensions from that application. can we delete those registry keys?

[dobby]

Is the fixlet you have mentioned is available on the console?

[jgallas]

It’s a custom fixlet that I created so it’s in my console but not in every one if that makes sense. Here it is as an example which could be adapted for other uses:

Relevance

exists values "DisplayName" whose (it is "Zscaler") of keys of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of ( x64 registries; x32 registries )

NOT exists folder "C:\Program Files\Zscaler"

Actionscript

action uses wow64 redirection false

dos reg delete "{pathname of keys whose (value "DisplayName" of it as string as lowercase contains "zscaler" as lowercase) of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of ( x32 registry; (if exists x64 registry then x64 registry else nothing) )}" /f

[JasonWalker]

May I ask how can we check and what are the registries need to be checked?

Take the relevance from the original analysis and split it up into its component pieces, so you get separate results for each registry path /WMI query. Run each query separately in the Fixlet Debugger or WebUI Query app. Be sure to run in “Local Client Evaluation Mode”.

[JasonWalker]

Here are the queries separated out, see which of these gets the product you think has been removed. Then we can work on that query to show you which registry path is being detected

q: ( (value "DisplayName" of it as string & (if (exists value "DisplayVersion" of it) then (" | " & value "DisplayVersion" of it as string) else (""))) of keys whose ((not exists value "SystemComponent" of it OR value "SystemComponent" of it as string != "1") AND (not exists value "WindowsInstaller" of it OR value "WindowsInstaller" of it as string != "1") AND exists value "UninstallString" of it AND not exists value "ParentKeyName" of it AND exists value "DisplayName" of it) of key "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" of native registry)

q:  (if x64 of operating system then((value "DisplayName" of it as string & (if (exists value "DisplayVersion" of it) then (" | " & value "DisplayVersion" of it as string) else (""))) of keys whose ((not exists value "SystemComponent" of it OR value "SystemComponent" of it as string != "1") AND (not exists value "WindowsInstaller" of it OR value "WindowsInstaller" of it as string != "1") AND exists value "UninstallString" of it AND not exists value "ParentKeyName" of it AND exists value "DisplayName" of it) of key "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" of registry) else nothing) 

q: ((value "DisplayName" of it as string & (if (exists value "DisplayVersion" of it) then (" | " & value "DisplayVersion" of it as string) else (""))) of keys whose ((not exists value "SystemComponent" of it OR value "SystemComponent" of it as string != "1") AND (not exists value "WindowsInstaller" of it OR value "WindowsInstaller" of it as string != "1") AND exists value "UninstallString" of it AND not exists value "ParentKeyName" of it AND exists value "DisplayName" of it) of keys "Software\Microsoft\Windows\CurrentVersion\Uninstall" of keys whose (exists key "Software\Microsoft\Windows\CurrentVersion\Uninstall" of it) of key "HKU" of registry) 

q: ((value "ProductName" of item 0 of it as string & (if (exists value "DisplayVersion" of it) then (" | " & value "DisplayVersion" of it as string) else ("")) of key "InstallProperties" of item 1 of it) of it whose ((not exists value "SystemComponent" of it OR value "SystemComponent" of it as string != "1") of key "InstallProperties" of item 1 of it AND exists value "ProductName" of item 0 of it) of (keys of item 0 of it, keys of item 1 of it) whose (name of item 0 of it = name of item 1 of it) of (key "Software\Microsoft\Installer\Products" of item 0 of it, key "Products" of item 1 of it) of (keys of key "HKU" of it, keys of key "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData" of it) whose ((exists key "Software\Microsoft\Installer\Products" of item 0 of it and exists key "Products" of item 1 of it)) of native registry)

q: (elements of (set of ((value "DisplayName" of it as string & (if (exists value "DisplayVersion" of it) then (" | " & value "DisplayVersion" of it as string) else (""))) of it whose ((not exists value "SystemComponent" of it OR value "SystemComponent" of it as string != "1") AND (exists value "WindowsInstaller" of it AND value "WindowsInstaller" of it as string = "1") AND exists value "DisplayName" of it) of keys "InstallProperties" of items 1 of (keys of key "HKLM\Software\Classes\Installer\Products" of it, keys of key "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products" of it) whose (name of item 0 of it = name of item 1 of it) of native registry) - set of ((value "DisplayName" of it as string & (if (exists value "DisplayVersion" of it) then (" | " & value "DisplayVersion" of it as string) else (""))) of keys whose ((exists value "SystemComponent" of it AND value "SystemComponent" of it as string = "1") AND (exists value "WindowsInstaller" of it AND value "WindowsInstaller" of it as string = "1") AND exists value "UninstallString" of it AND not exists value "ParentKeyName" of it AND exists value "DisplayName" of it) of key "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" of native registry ; (if (x64 of operating system) then((value "DisplayName" of it as string & (if (exists value "DisplayVersion" of it) then (" | " & value "DisplayVersion" of it as string) else (""))) of keys whose ((exists value "SystemComponent" of it AND value "SystemComponent" of it as string = "1") AND (exists value "WindowsInstaller" of it AND value "WindowsInstaller" of it as string = "1") AND exists value "UninstallString" of it AND not exists value "ParentKeyName" of it AND exists value "DisplayName" of it) of key "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" of registry) else nothing))))

q: ( (value "DisplayName" of it as string & (if (exists value "DisplayVersion" of it) then (" | " & value "DisplayVersion" of it as string) else (""))) of items 1 of (keys of key "HKLM\Software\Classes\Installer\Products" of it, keys of key "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" of it) whose ((value "ProductName" of item 0 of it = value "DisplayName" of item 1 of it) AND ((not exists value "SystemComponent" of it OR value "SystemComponent" of it as string != "1") AND (exists value "WindowsInstaller" of it AND value "WindowsInstaller" of it as string = "1") AND exists value "UninstallString" of it AND not exists value "ParentKeyName" of it AND exists value "DisplayName" of it) of item 1 of it) of native registry ; (value "DisplayName" of it as string & (if (exists value "DisplayVersion" of it) then (" | " & value "DisplayVersion" of it as string) else (""))) of items 1 of (keys of key "HKLM\Software\Classes\Installer\Products" of native registry, keys of key "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" of registry) whose ((value "ProductName" of item 0 of it = value "DisplayName" of item 1 of it) AND ((not exists value "SystemComponent" of it OR value "SystemComponent" of it as string != "1") AND (exists value "WindowsInstaller" of it AND value "WindowsInstaller" of it as string = "1") AND exists value "UninstallString" of it AND not exists value "ParentKeyName" of it AND exists value "DisplayName" of it) of item 1 of it) ; (value "DisplayName" of it as string & (if (exists value "DisplayVersion" of it) then (" | " & value "DisplayVersion" of it as string) else (""))) of items 1 of (keys of key "HKLM\Software\Classes\Installer\Products" of it, keys "Software\Microsoft\Windows\CurrentVersion\Uninstall" of keys whose (exists key "Software\Microsoft\Windows\CurrentVersion\Uninstall" of it) of key "HKU" of it) whose ((value "ProductName" of item 0 of it = value "DisplayName" of item 1 of it) AND ((not exists value "SystemComponent" of it OR value "SystemComponent" of it as string != "1") AND (exists value "WindowsInstaller" of it AND value "WindowsInstaller" of it as string = "1") AND exists value "UninstallString" of it AND not exists value "ParentKeyName" of it AND exists value "DisplayName" of it) of item 1 of it) of native registry )