topic Re: Tracking software install/removal in Getting Data In

Tracking software install/removal

tmontney — Tue, 29 Sep 2020 20:57:44 GMT

For Windows, I've been trying to track installs/removals. MSI was a breeze. I'm attempting now anything that isn't MSI. I'm tracking changes in the following paths:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall

Two issues arose:

Uninstalled items just delete the whole key. I'd need to do a back-reference to determine what that was.
Programs that upgrade tend to do another CreateKey. It's difficult to differentiate between Installs and Upgrades.

Here's an example of my search for detecting installs.

index="winregmon" process_image!=*msiexec* registry_type="SetValue" *displayname*
| join type=left max=0 host data [
search index="winregmon" process_image!=*msiexec* (registry_type="CreateKey" OR registry_type="DeleteKey") latest=-16m
| dedup host
| rename registry_type as last_registry_type
| rename data AS deleted_data]
| dedup host data
| eval Date=strftime(_time, "%m-%d-%Y")
| eval Time=strftime(_time, "%H:%M:%S")
| table host data Date Time last_registry_type

In my various modifications of this search, either I detect installs + upgrades (i just want installs) or I miss data all together. I'm aware the search above isn't right, just for reference. My idea:

Find the most recent registry change, per host
Back-reference to the last Key modification event, Create/Delete
If Create, it's an upgrade. If Delete, it's an install.
Only show Installs (DeleteKey being the last event, for that host)

Re: Tracking software install/removal

DalJeanis — Tue, 21 Aug 2018 20:10:14 GMT

what is your question?

Re: Tracking software install/removal

tmontney — Tue, 21 Aug 2018 20:13:07 GMT

How to track software install/removal? If from the registry, how do I back-search? Given my OP, how do I make my existing search work to tell me when new software is installed?

Re: Tracking software install/removal

somesoni2 — Tue, 21 Aug 2018 20:31:27 GMT

Do you think may be monitoring WIndows event logs to this would be better?
https://support.solarwinds.com/Success_Center/Log_Event_Manager_(LEM)/Knowledgebase_Articles/Monitor_software_installation_and_uninstallation_events

Re: Tracking software install/removal

tmontney — Wed, 22 Aug 2018 14:49:34 GMT

That's MSI. As mentioned in my OP, I've already covered MSI (note I exclude msiexec in my search, too). Granted, I've encouraged everyone when installing to install by MSI (so it can be tracked). But I still want to catch non-MSI installs.

Re: Tracking software install/removal

radparik — Wed, 19 May 2021 15:38:49 GMT

@tmontney how did you catch MSI installs? I am trying to create alerts to track MSI Installations and MSI Removals.

Thanks!