Use PowerShell to find list of installed software quickly
PowerShell: Check installed software list <u>locally</u>
1. Get installed software list with Get-WmiObject
In this method, a simple query:
Get-WmiObject -Class Win32_ProductFilter the data to find specific applications from a single vendor, together with their versions, for example:
Get-WmiObject -Class Win32_Product | where vendor -eq CodeTwo | select Name, VersionThe above works well but it is sloooooow.
2. Query registry for installed software
A short script that returns the list of applications together with their versions:
$InstalledSoftware = Get-ChildItem "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall"
foreach($obj in $InstalledSoftware){write-host $obj.GetValue('DisplayName') -NoNewline; write-host " - " -NoNewline; write-host $obj.GetValue('DisplayVersion')}The above command will list all the software installed on the LM – local machine. However, applications can be installed per user as well. To return a list of applications of the currently logged user, we change HKLM to HKCU (CU stands for “current user”):
$InstalledSoftware = Get-ChildItem "HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall"
foreach($obj in $InstalledSoftware){write-host $obj.GetValue('DisplayName') -NoNewline; write-host " - " -NoNewline; write-host $obj.GetValue('DisplayVersion')}3. Getting the list of recently installed software from the Event Log
To check only the recently installed software, we use the following cmdlet to search through the Event Log.
Get-WinEvent -ProviderName msiinstaller | where id -eq 1033 | select timecreated,message | FL *PowerShell: Get a list of installed software remotely
1. Get installed software list with remote Get-WmiObject command
The below cmdlet is the easiest one but can take some time to finish. Using a list and $pcname as the variable:
Get-WmiObject Win32_Product -ComputerName $pcname | select Name,Version2. Check installed software with remote registry query
Remote registry queries are slightly more complicated and require the Remote Registry service to be running.
$pcname = "compName"
$list=@()
$InstalledSoftwareKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall"
$InstalledSoftware=[microsoft.win32.registrykey]::OpenRemoteBaseKey('LocalMachine',$pcname)
$RegistryKey=$InstalledSoftware.OpenSubKey($InstalledSoftwareKey)
$SubKeys=$RegistryKey.GetSubKeyNames()
Foreach ($key in $SubKeys){
$thisKey=$InstalledSoftwareKey+"\\"+$key
$thisSubKey=$InstalledSoftware.OpenSubKey($thisKey)
$obj = New-Object PSObject
$obj | Add-Member -MemberType NoteProperty -Name "ComputerName" -Value $pcname
$obj | Add-Member -MemberType NoteProperty -Name "DisplayName" -Value $($thisSubKey.GetValue("DisplayName"))
$obj | Add-Member -MemberType NoteProperty -Name "DisplayVersion" -Value $($thisSubKey.GetValue("DisplayVersion"))
$list += $obj
}
$list | where { $_.DisplayName } | select ComputerName, DisplayName, DisplayVersion | FT
3. Check recently installed software list from the Event Log remotely
Can check a user’s event log remotely by adding a single attribute (-ComputerName) to the cmdlet used before:
Get-WinEvent -ComputerName $pcname -ProviderName msiinstaller | where id -eq 1033 | select timecreated,message | FL *Check if a GPO-deployed software was applied successfully
If we apply a certain software version via GPO, then we can easily check if this GPO was successfully applied to a user or not. All we need is the GPResult tool and names of the target computer and user:
gpresult /s "PCNAME" /USER "Username" /h "Target location of the HTML report"Finally, we look for the GPO name and check if it is present under Applied GPOs or Denied GPOs.
Excellent article from BobCares