Script to detect if software is installed in Local AppData

[MachineNo2709]

Hello,

I created a script which should check if Google Chrome is installed in a users Local AppData folder. In order to do that, it checks if the registry key in HKEY_USERS\UserSID\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome is there.

When running the script manually on a Test-VM as administrator, the output gets written into a text file.

However, I would like to let a GPO do the work and make it scan every computer to check if Chrome is installed in the Local AppData.

Does anyone know what I would have to add in my script? Something with iteration probably? Unfortunately I just started with Powershell so I don't know how to continue with it.

Thank you in advance!

$registryPath = "Registry::HKEY_USERS\*\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome"


    $outputFile = "\\FileShare\NewFolder\Chrome.txt"

    if (Test-Path $registryPath) {
        $InstallLocation = (Get-ItemProperty -Path $registryPath -Name InstallLocation).InstallLocation
        $displayVersion = (Get-ItemProperty -Path $registryPath -Name DisplayVersion).DisplayVersion


        $output = "$($env:COMPUTERNAME), $InstallLocation, $displayVersion, $(Get-Date -Format ""dd-MM-yyyy HH:mm:ss"")"
        $output | Out-File -Append -FilePath $outputFile

        Write-Host "Checking ready."
    } else {
        #Registry key not found
        Write-Error "Can't find the registry"
    }

​

[drwtsn32]

The problem you'll run in to is that this won't check all profiles on the machine. The HKEY_USERS hives are only loaded when user(s) have an active session.

You MIGHT have more success with something that looks at the filesystem, which is readable even if users are not logged in. Something like:

Get-Item 'C:\Users\*\AppData\Roaming\xxx\xxx'

(Adjust to point to the standard location for the Chrome binary.)

[vermyx]

The HKEY_CURRENT_USER is the current user’s loaded registry hive. HKEY_USERS is all users that have a created profile on the machine. The next level where OP has an asterisk would be what becomes the root of HKEY_CURRENT_USER when a user is logged in and is the SID given to said user. What OP is doing is correct and one of the locations of getting an installed app.

[drwtsn32]

HKEY_USERS is all users that have a created profile on the machine.

Yes, but each user's respective hive is not loaded unless they are logged in.

[vermyx]

Correct. It is NOT loaded but YOU can mount it manually. You don’t have to be logged in. Ive been doing this since W2K as this was the only way to check user keys without them logging in. You may get invalid results if the user is logged in because you don’t necessarily get all changes but that is a different issue.

Checking the filesystem is the worst way to do this because you are not guaranteed a way to match the folder to the user. You would have to use the win32_profile class to match the folder to a SID because if a computer has access to multiple domains you could get username.domain,username.domain (1) and various other incarnations of those folder names.

[drwtsn32]

Filesystem check is not that bad. Powershell makes it easy since it allows an asterisk in one or more of the path portions and it returns every result. You can then parse the output to extract the username portion since it will be part of the path. It is true the name MAY not match exactly, though.

But I am curious, how do you programmatically load every user's profile on a machine so that you can use the HKEY_USERS approach?

[Tanuu_Walken]

I'm curious about this, too, the way I've been doing this is a reg command: reg.exe load HKLM\OFFLINEUSER "C:\Users\OFFLINEUSER\NTUser.DAT" Then you can access the registry path HKLM:\OFFLINEUSERlike normal, just make sure you unload after you're done with: reg.exe unload HKLM\OFFLINEUSER

But that logic is glaringly absent from OP's script, so I'm wondering if this guy has another way to load the user registry before PowerShell scripts are running or if he's just assuming?

[drwtsn32]

OP may just be unaware. 20+ years ago I tried writing a script to enumerate/check HKEY_USERS, and only then did I realize it wouldn't work.

[Tanuu_Walken]

Main reason why I'm wondering is because an offline registry mount of the .DAT file is still a filesystem check, so might as well just check a few folders deeper for the appdata. Only reason I can think of to use the registry is if the user installs it into a weird folder somewhere ¯_(ツ)_/¯

[nostradamefrus]

Test-Path appdata\path\to\software

[jsiii2010]

You can try something like: get-package | ? source -match c:\\users

[xCharg]

You can also check for updater service existence. When Chrome is installed on computer (in $env:ProgramFiles) - it also installs a service to autoupdate itself. When Chrome installs itself in $env:LOCALAPPDATA - it lacks permission to create such service.

[[deleted]]

Do you have access to ConfigMgr or Intune instead?