Querying Installed Software Remotely

Administrators perform software audits to ensure that licensing agreements are followed, detect unauthorized software, and prepare for upgrades and migrations. To facilitate software audits, you can install a variety of third-party utilities and agents, some of which, in addition to gathering a list of installed software, can also collect information, such as the amount of free disk space, service status, and BIOS version, and even deploy software. However, at times you might want to remotely determine which software is installed on a workstation or server. The Control Panel Add/Remove Programs applet looks at one registry subkey (and its values), and you can query this subkey to display a list of installed applications. The script QueryInstalledSoftware.cmd, which Listing 1 shows, uses this querying process to easily and quickly perform a low-cost software audit.

Using Reg.exe to Query the Subkey
The HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall subkey contains the values that Add/Remove Programs uses to display a computer's installed software. You can use the reg.exe utility to remotely query this subkey. (Reg.exe used to be part of the Microsoft Windows NT 4.0 Resource Kit but now is part of Windows 2000 Support Tools.) You can also use reg.exe to locally and remotely add, delete, and update subkeys from the command line. The Uninstall subkey contains values that represent applications and contain information such as software name, installation source, and uninstall string. The displayname value contains the software name that Add/Remove Programs displays. To use reg.exe to query the subkey, you can type the following command on the command line:

Reg Query HKLM\SOFTWARE   Microsoft\Windows   CurrentVersion\Uninstall
   /S \\compname

(Although this command appears on several lines here, you would enter it on one line on the command line. The same holds true for the other multiline commands in this article.) This command outputs all the Uninstall subkey values for the specified computer (compname). Because you don't need all this output, you can massage the output to display only the displayname values. The simplest way to do this is to pipe the output of the Reg Query command to the Find command: . . .

The XP version of reg.exe does query the registries of remote computers. The syntax is \\computer\FullKey. Only HKLM and HKU are available on remote computers.

Eric Case February 17, 2004

Just FYI. The WXP vergion of REG.EXE does allow you to query remote machines. It just has a slightly different syntax. Instead of 
 
<DD>Reg query HKLM\.... \\%machine% 
 it is expecting 
 
<DD>Reg query \\%machine%\HKLM\.... 
 
Same as the version that comes with W2K resource kit.

Eric J. Wang February 18, 2004

I keep getting the following error when I run this program: Installed Software for
*machine name*. The syntax of the command is incorrect. I believe the code in callout B in QueryInstalledSoftware.cmd
is in error but I just can't "see" the actual error.
A note from Steve: Without more information, it's hard to tell whether there’s an error with the code or if the code was copied incorrectly. If you email me (steve@seguis.com) a copy of the script you’re using and the command you’re typing to execute the script, I should be able to find out. 

B. Nicholl March 05, 2004

If you change the code: 
 
<DD>If %ERRORLEVEL% EQU 0 Echo %targetcomp% is 
<DD>unavailable at this time & Goto :EOF 
 
to 
 
<DD>If %ERRORLEVEL% EQU 1 Echo %targetcomp% is 
<DD>unavailable at this time & Goto :EOF 
 
it's going to continue the script.

Gustavo Pinto March 16, 2004

This is the right command-line code to get remote computer info 
 
<DD>For /f "tokens=1,2,*" %%i in 
<DD>('Reg Query \\%targetcomp%\HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall 
<DD> /S ^| Find /I "DisplayName" ^| Find /V /I "Quiet"')

Gustavo Pinto March 16, 2004

for /f "tokens=*" %%a in ('reg query hklm\software\microsoft\windows\currentversion\uninstall') do (
for /f "tokens=*" %%b in ('reg query %%a /v displayname ^| find "displayname" /I') do echo "%%b")

browolf May 24, 2006 (Article Rating:

)

Having made the changes noted by Gustavo, I still get a "syntax of the command is incorrect" error running the batch. However, if I run the 'Reg Query...' component on it's own at the command prompt, I get output.

I'm really not sure what's wrong!

nqetech February 28, 2008 (Article Rating:

)

You must log on before posting a comment.

If you don't have a username & password, please register now.