pwsh..Search Applications

Use PowerShell to find list of installed software quickly

PowerShell: Check installed software list <u>locally</u>

1. Get installed software list with Get-WmiObject

In this method, a simple query:

Get-WmiObject -Class Win32_Product

Filter the data to find specific applications from a single vendor, together with their versions, for example:

Get-WmiObject -Class Win32_Product | where vendor -eq CodeTwo | select Name, Version
The above works well but it is sloooooow.

2. Query registry for installed software

A short script that returns the list of applications together with their versions:

$InstalledSoftware = Get-ChildItem "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall"
foreach($obj in $InstalledSoftware){write-host $obj.GetValue('DisplayName') -NoNewline; write-host " - " -NoNewline; write-host $obj.GetValue('DisplayVersion')}

The above command will list all the software installed on the LM – local machine. However, applications can be installed per user as well. To return a list of applications of the currently logged user, we change HKLM to HKCU (CU stands for “current user”):

$InstalledSoftware = Get-ChildItem "HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall"
foreach($obj in $InstalledSoftware){write-host $obj.GetValue('DisplayName') -NoNewline; write-host " - " -NoNewline; write-host $obj.GetValue('DisplayVersion')}

3. Getting the list of recently installed software from the Event Log

To check only the recently installed software, we use the following cmdlet to search through the Event Log.

Get-WinEvent -ProviderName msiinstaller | where id -eq 1033 | select timecreated,message | FL *

PowerShell: Get a list of installed software remotely

1. Get installed software list with remote Get-WmiObject command

The below cmdlet is the easiest one but can take some time to finish. Using a list and $pcname as the variable:

Get-WmiObject Win32_Product -ComputerName $pcname | select Name,Version

2. Check installed software with remote registry query

Remote registry queries are slightly more complicated and require the Remote Registry service to be running.

$pcname = "compName"

Foreach ($key in $SubKeys){
$obj = New-Object PSObject
$obj | Add-Member -MemberType NoteProperty -Name "ComputerName" -Value $pcname
$obj | Add-Member -MemberType NoteProperty -Name "DisplayName" -Value $($thisSubKey.GetValue("DisplayName"))
$obj | Add-Member -MemberType NoteProperty -Name "DisplayVersion" -Value $($thisSubKey.GetValue("DisplayVersion"))
$list += $obj
$list | where { $_.DisplayName } | select ComputerName, DisplayName, DisplayVersion | FT

3. Check recently installed software list from the Event Log remotely

Can check a user’s event log remotely by adding a single attribute (-ComputerName) to the cmdlet used before:

Get-WinEvent -ComputerName $pcname -ProviderName msiinstaller | where id -eq 1033 | select timecreated,message | FL *

Check if a GPO-deployed software was applied successfully

If we apply a certain software version via GPO, then we can easily check if this GPO was successfully applied to a user or not. All we need is the GPResult tool and names of the target computer and user:

gpresult /s "PCNAME" /USER "Username" /h "Target location of the HTML report"

Finally, we look for the GPO name and check if it is present under Applied GPOs or Denied GPOs.

Excellent article from BobCares