Question

I need to develop a process that will detect if the users computer has certain programs installed and if so, what version. I believe I will need a list with the registry location and keys to look for and feed it to the program which is not a problem. Is there a better way to accomplish this?

My first thought was to check in the registry in the uninstallation entries but it seems one of the apps I wish to detect does not have one. What is the standard location for all registry using applications to make an entry in?

Answer 1

User-specific settings should be written to HKCU\Software, machine-specific settings to HKLM\Software. Under these keys, structure [software vendor name]\[application name] (e.g. HKLM\Software\Microsoft\Internet Explorer) may be the most common, but that’s just a convention, not a law of nature.

Many (most?) applications also add their uninstall entries to HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\[app name], but again, not all applications do this.

These are the most important keys; however, contents of the registry do not have to represent the installed software exactly – maybe the application was installed once, but then was manually deleted, or maybe the uninstaller didn’t remove all traces of it. If you want to be sure, check the filesystem to see if the application still exists where its registry entries say it is.

Edit:

If you’re a member of the group Administrators, you can check the HKEY_USERS hive – each user’s HKCU actually resides there (you’ll need to know the user SID, or go through all of them).

Note: As @Brian Ensink says, ‘installed’ is a bit of a vague concept – are we trying to find what the user could run? Some software doesn’t even write to the Registry at all: search for ‘portable apps’ to see apps that have been specifically modified to run directly from media (CD/USB) and not to leave any traces on the computer. We may also have to scan the disks, and network disks, and anything the user downloads, and world-accessible Windows shares in the Internet (yes, such things exist legitimately – \\live.sysinternals.com\tools comes to mind). In this direction, there’s no real limit of what the user can run, unless prevented by system policies.