Discovered Software Location

Question

Hello!Our company has been having an ongoing issue with fully understanding the Discovered Software/Software Catalog inside of KACE. KACE has two software tabs: Software and Software Catalog. Specifically, the issue we are having is with software versions. Our users use Chrome, Firefox, and Edge web browsers. In the software tab in KACE, it appears as if these applications are up-to-date and the updates we are pushing out are working. However, in the software catalog, it shows a handful of devices that have older versions still installed, despite confirming that these older versions are not running on the user's devices. I understand that it is possible that older executables or registry keys could be buried somewhere in these devices, and that is what KACE is discovering. The problem is, I have not found an easy way to determine how to uninstall/remove these older versions from user devices if this is the case. The easiest way for me to fix this would be if KACE had a way to tell me the file path/location of where it is detecting these older versions. That way I could manually path into those devices, locate, and delete them. KACE does not seem to report this information, though.I am open to any suggestions from the community. What would you do in this situation? Or does KACE have a way of telling me where I can find and remove this discovered software?Thank you!

Answer

After speaking with Quest Support several times, they were never able to give me the answer I was looking for. They were unable to provide me with a method to located software detected on the machine in Software or Software Catalog. I finally was able to do this on my own after a long effort. I hope this can help someone in the future!

1. Software

The software tab is the original method KACE provided tousers for identifying software on managed devices. The software tab correlates to the Installed Programs list when clicking on each individual device inside of KACE. It is mostly accurate, but does have some flaws.

1.1 How it works

The software tab detects software on a device by scanning its uninstaller registry key.

1.2 Flaws

If any software is installed on the machine, but an uninstaller registry key is not created, KACE will not detect the software on the machine in the software tab.

1.3 Locate and Remove

There are two sets of registry keys locations that could potentially be used for installed software: 32 bit or 64 bit.

32 Bit Applications HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

64 Bit Applications HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\

Listed will be all the registry keys with the title of the software, and install paths. Verify that you have already attempted to properly uninstall the software. Next, visit the install path and delete any associated files with exactly what you are trying to delete, such as an older version of Chrome. After this is done, delete the registry key, and force inventory at least twice. The software should be removed from the list in the software tab.

2. Software Catalog

The software catalog tab is far more intuitive than the software tab. The software catalog tab correlates to the Discovered Software list when clicking on each individual device inside of KACE. It is the newer of the two, and relies on a full scan of the device, rather than looking for uninstallers exclusively.

2.1 How it works

Software catalog will log software on a device if it finds any registry key, executable, or checksum stored anywhere on the device. This includes if a software is technically unusable or deleted from the machine, but still has an old file buried deep on the machine.

2.2 Flaws

While the software catalog is much better at catching unapproved software, old versions, etc., its full scan of the device fails to distinguish whether or not the software is usable, its origin, nor does it give you a method of uninstallation directly through the SMA. As the software catalog detects almost anything, it is common for unapproved software or older versions to appear in this tab, but not provide a location to remove.

2.3 Locate and Remove

I have created a script in KACE to locate the originof software listed in the software catalog. I created this based off of another support article. It uses the KACE agent’s inventory executable and send the logs to a specific folder in the C drive. This log will detail every detected software, and where it found it.

Path into the machine you wish to log, and create a new folder directly in the C drive named KTEST. If this folder already exists, make sure to delete any old logs. Create and run the script below against the machine, and wait. When this is completed, a software file will be created in the folder. You can open in notepad. Ctrl + F and search key words like version names or the name of the software you wish to locate. A file path will be listed next to each.

Go to Scripting | Choose Action | New
Name the script
Run as Local System
Allow run without a logged-in user
+New Task
Verify
1. Add
2. Verify a directory exists
3. Directory: C:\KTEST
4. Save Changes
On Success
1. Add
  1. Launch a program
  2. Directory: C:\Program Files\Quest\KACE
  3. File: Inventory.exe
  4. Check box next to Wait for completion
  5. Parameters: -D -U -H -L C:\KTEST
  6. Save Changes

Once you know the file path, you will be able to path directly into that location and delete the specific folders/files it detects as an older version/unapproved software. Run at least two force inventories against the machine to update the software catalog on that individual machine.

2.4 The Software is in the Recycle Bin of a User

Sometimes the file path listed will be in the recycle bin. Because you are unable to path into the recycle bin directly, there is a command you can run to take care of this. You can either create a KACE script to run against the machine, or run the command against the machine directly through CMD.

rd /s %systemdrive%\$Recycle.bin