/build/static/layout/Breadcrumb_cap_w.png

Systems Management Question


KACE is detecting that software is installed on devices that have had it removed.

09/16/2020 251 views

Kace has KB150236 that says:

The inventory information for installed software comes from the enumeration of the registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall and not what is listed in Add/Remove programs.

Their solution says:
Delete the key in the registry associated with the software.

Does anybody have a better solution than manually cleaning the registry after uninstalling software?

1 Comment   [ + ] Show comment

Comments

  • Here is KACE's response, it's actually fairly reasonable.
    ------------------------------------------------------------------------------------------------
    The issue mentioned on the KB Article is due to the nature of how some software vendors have setup their programs to behave this way.

    When a program is uninstalled, it should remove the Uninstall string from the registry. If the string is not removed, then the software vendor is at fault, or the uninstall didn’t complete successfully.

    The workaround mentioned on this KB is for remediating vendors that don’t remove that registry.

    If you have this issue with an specific vendor, I recommend you to contact them and see if this is a known issue on their end.
    ------------------------------------------------------------------------------------------------


    my reply
    ------------------------------------------------------------------------------------------------
    Yes, I generally blame the vendor for not cleaning up fully.

    However, the offending programs (while still present in the registry) are no longer listed in Add/Remove Programs. So, if Windows realizes the programs are no longer installed, why can’t KACE do the same?
    -------------------------------------------------------------------------------------------------


    their reply
    -------------------------------------------------------------------------------------------------
    KACE takes the list from the registry, not the Add/Remove programs, precisely because there are other software vendors that don’t list their program under Add/Remove, which then ends up being another issue, and also software that is user-specific that appear on the list, but aren’t accessible by the agent (the agent runs as the SYSTEM user), so the registry ends up being the most neutral place to look for software that is installed.

    Alternatively, there’s also the Software Catalog that tracks installs a little differently. It goes along the lines of checking if the .exe is actually there, instead of going through the registry.
    --------------------------------------------------------------------------------------------------

All Answers

0

That's quite a staggering error by Kace there! ARP entries are compiled from that key, the one in the 32-bit branch and the one in HKCU.

If entries there are getting left behind, it's the vendor's installer failing to clean up properly. This is why all our deployments are driven by CMDs, rather than just the bare vendor setup EXE or MSI - we can ensure any clean-up required gets done. You'd be shocked at how appallingly bad some vendor's installation packages are!

Answered 09/17/2020 by: anonymous_9363
Red Belt

0

This is clearly the fault of the Software/App vendor.

But there are other issues as well. 

There are some vendors that change the MSI-Key when they update their programs. This is going to cause repeated installs due to changed uninstall-informations. 

Therefore instead on relying on informations from others we use mechanics where we check the .exe version or registry information for the Software we install.

reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{23170F69-40C1-2702-1604-000001000000}" /v DisplayName /reg:64 | find "7-Zip 16.04 (x64 edition)"

IF not errorlevel 1 (

    ECHO "7-Zip 16.02 (x64 edition) found"

    ECHO "7-Zip 16.02 (x64 edition) found" >> %LogFile%

SET Check2=1

) ELSE (

    ECHO "7-Zip 16.02 (x64 edition) not found"

    ECHO "7-Zip 16.02 (x64 edition) not found" >> %LogFile%

SET Check2=0

)


Based on this check we write our "Own" registry key as a breadcrumb and rely on this info to identify installed Software.  

ECHO Check1: %Check1%

ECHO Check2: %Check2%

IF %Check1%==1 IF %Check2%==1 (

ECHO Installation succeeded!

ECHO Installation succeeded! >> %LogFile%

ECHO reg add "HKLM\Software\%Customer%\InstalledPackages" /v "%ProductName%" /d "1" /t REG_SZ /f /reg:32

reg add "HKLM\Software\%Customer%\InstalledPackages" /v "%ProductName%" /d "1" /t REG_SZ /f /reg:32

) ELSE (

ECHO ERROR: Installation DID NOT succeed, check logs!

ECHO ERROR: Installation DID NOT succeed, check logs! >> %LogFile%

)

For Uninstalls we also use our own scripts and we check the regestry as well as the file systems.

Answered 09/23/2020 by: SporrerS1977
Senior White Belt

 
This website uses cookies. By continuing to use this site and/or clicking the "Accept" button you are providing consent Quest Software and its affiliates do NOT sell the Personal Data you provide to us either when you register on our websites or when you do business with us. For more information about our Privacy Policy and our data protection efforts, please visit GDPR-HQ