Recently we had an issue with an employee installing unapproved software on his work machine. We noticed the change with KACE, and promptly removed it with Scripting. However the software is still listed in the K1000 on that machine. I have checked the physical machine and there is no sign of the software.

-Trevor

Answer Summary:
Cancel
0 Comments   [ + ] Show Comments

Comments

Please log in to comment

Community Chosen Answer

4

To be precise, check 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall 

to confirm if the key for the uninstalled software is removed

Answered 07/10/2012 by: AbhayR
Fourth Degree Black Belt

  • Inventory is based on Add/Remove Programs (ARP) data which is indeed found here in the registry-- if it is not here, it won't show up with out a custom inventory rule
Please log in to comment

Answers

2

Has Inventory run on the machine since the software was uninstalled?  If not, force an Inventory on it and see if that changes things.

If it's still listed after an Inventory update, I'd check Add/Remove Programs and HKLM\SOFTWARE to see if it might still be listed there.

John

Answered 07/09/2012 by: jverbosk
Red Belt

  • Yes, an inventory update has been run/forced. I will double check HKLM\Software and Add/Remove Programs and post back the results
  • The inventory information for installed software comes from the enumeration of the registry entry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall and not what is listed in Add/Remove programs
Please log in to comment
0

Thank you everyone, we discovered the issue was a problem with the agent updating the inventory to the appliance.

Answered 07/11/2012 by: ais14
White Belt

Please log in to comment
Answer this question or Comment on this question for clarity