How does the K1000 detect installed software?
Recently we had an issue with an employee installing unapproved software on his work machine. We noticed the change with KACE, and promptly removed it with Scripting. However the software is still listed in the K1000 on that machine. I have checked the physical machine and there is no sign of the software.
-Trevor
Answers (3)
To be precise, check
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
to confirm if the key for the uninstalled software is removed
Comments:
-
Inventory is based on Add/Remove Programs (ARP) data which is indeed found here in the registry-- if it is not here, it won't show up with out a custom inventory rule - bkelly 12 years ago
-
Windows 10 has a different path:
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ - drunkanidaho 6 years ago
Has Inventory run on the machine since the software was uninstalled? If not, force an Inventory on it and see if that changes things.
If it's still listed after an Inventory update, I'd check Add/Remove Programs and HKLM\SOFTWARE to see if it might still be listed there.
John
Comments:
-
Yes, an inventory update has been run/forced. I will double check HKLM\Software and Add/Remove Programs and post back the results - ais14 12 years ago
-
The inventory information for installed software comes from the enumeration of the registry entry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall and not what is listed in Add/Remove programs - KevinG 12 years ago
Thank you everyone, we discovered the issue was a problem with the agent updating the inventory to the appliance.