Detecting installed application

myITforum.com Community Forum

Home Forums Blogs Live Support chat Search Articles Wiki FAQ Email Lists Register Login My Profile Inbox Address Book My Subscription My Forums

Photo Gallery Member List Search Calendars FAQ Ticket List Log Out

All Forums RSS Feed Subscription:

Detecting installed application

View related threads: (in this forum | in all forums)

Logged in as: Guest

Printable Version

All Forums >> [Management Products] >> System Center Products >> System Center Configuration Manager >> Detecting installed application

Page: [1]

Message

<< Older Topic Newer Topic >>

Detecting installed application - 4/14/2008 8:38:28 AM

Peekstra

Posts: 29
Score: 0
Joined: 2/7/2008
Status: offline

I'm currently trying to create some collections which contain PCs failing a baseline item, for example antivirus.

To detect the application and version (Symantec Endpoint protection 11) I created a configuration item which checks for the size of the file vpshell2.dll in the "c:\program files\symantec antivirus" directory.

Next, I created a new collection and (as the SCCM administrator companion book describes) add a query to it which checks if the localized displayname matches the configuration item AND check if the compliance state is equal to Non compliant

This seemed to work fine but then I discovered that the AV program wasn't detected on several systems because it sometimes is installed in "c:\Program Files\Symantec\Symantec Endpoint Protection\"

So my question is, how can I reliably detect this application.... I've considered running a wildcard match searching c:\program files and below or creating two groups (really ugly).

Searching the c:\program files doesn't seem to be very efficient so I would like to know if there's an easier way to solve this. Something like checking for both locations and only include the PC when both items are not compliant.

Is there an easy way to do this?

thanks!

Peekstra

PS I've also tried different detection methods like a registry key version number but I coulnd't find it. Also, the installer uses an exe file so no MSI detection is possible (?)

Post #: 1

RE: Detecting installed application - 4/14/2008 9:51:35 AM

jsandys

Posts: 296
Score: 13
Joined: 3/24/2005
From: San Antonio, TX
Status: offline

Does the app show up in Add/Remove Programs? Check HKLM\software\microsoft\windows\current version\uninstall. Note that even though the app installs with an exe, this exe is probably just a wrapper for an msi.

You can also use software inventory to inventory vpshell2.dll; software inventory is not necessarily limited to a specific path and can use wildcards.

_____________________________

Jason
________________________________________
http://ihaveablog.wordpress.com

(in reply to Peekstra)

Post #: 2

RE: Detecting installed application - 4/14/2008 10:25:49 AM

Peekstra

Posts: 29
Score: 0
Joined: 2/7/2008
Status: offline

Thanks for the HKLM link jsandys! The AV application is listed here including a version key which makes things very easy (I that the exe was indeed a wrapper for the MSI which shows in the uninstall key).

Also, using software inventory seems like a good idea for programs which don't store their info in the registry.

thanks again!

Peekstra.

(in reply to jsandys)

Post #: 3

RE: Detecting installed application - 4/14/2008 10:37:52 AM

Peekstra

Posts: 29
Score: 0
Joined: 2/7/2008
Status: offline

Whoops, I thought that I could just query the value of a registry key, but you can only check if it exists or not?

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FB8A4E30-9915-4814-ADF9-42E00D9FDC3D}\displayversion contains the value 11.0.1000.1375 but I can only check if this key exists?

Or is it common that the "{FB8A4E30-9915-4814-ADF9-42E00D9FDC3D}" keyname "contains" the program version?

(in reply to Peekstra)

Post #: 4

RE: Detecting installed application - 4/14/2008 10:59:21 AM

mcarriere893

Posts: 3618
Score: 300
Joined: 4/12/2002
From: Manitoba, Canada
Status: offline

Hey Peekstra, any software showing up under the uninstall key will certainly be in the hardware inventory (ARP). Check out various Asset Intelligence and software reports in your console. Good thing about using ARP (add rem programs), is that you don't need to specify locations to look, like you should do when querying against files.

You can probably quite simply just create a subselect query for your collection of systems that "do not have" your AV product and/or version. Tons of subselect examples in the forums.

_____________________________

Mark Carriere
Microsoft MVP-SMS
www.SMSUG.ca

(in reply to Peekstra)

Post #: 5

RE: Detecting installed application - 4/16/2008 5:01:47 AM

Peekstra

Posts: 29
Score: 0
Joined: 2/7/2008
Status: offline

Hi,

I've succesfully created the subselections with the ARP info, thanks!

It's strange though that you can't check the registry values directly from the baseline... SCCM seems a bit incomplete here to me and it can also be quite confusing that you can accomplish the tasks thing in (too?) many ways (for a humble beginner

).

I'll also consider checking the registry value in the baseline via a VBS script.

thanks.

(in reply to mcarriere893)

Post #: 6

RE: Detecting installed application - 4/16/2008 9:58:44 AM

mcarriere893

Posts: 3618
Score: 300
Joined: 4/12/2002
From: Manitoba, Canada
Status: offline

quote:

It's strange though that you can't check the registry values directly from the baseline

I don't (probably just me) get what you mean?
The ARP portion of hardware inventory does go into the registry (HKLM\software...\Uninstall) and grab regsitry data. If a REG_SZ called DisplayName exists for a product, then it is collected, and availabe as "Version" in the ARP class.

For even more info, check out the "Installed Software" class! It contains ARPName, Product version, installed location, source, etc, etc. That might be more valuable for you to use if you don't have complete control over the location where all previous installs were done.

As always, ConfigMgr is very configurable, so you can extend your inventories via the mof, or mifs as required/desired.

_____________________________

Mark Carriere
Microsoft MVP-SMS
www.SMSUG.ca

(in reply to Peekstra)

Post #: 7

RE: Detecting installed application - 4/16/2008 10:02:30 AM

jsandys

Posts: 296
Score: 13
Joined: 3/24/2005
From: San Antonio, TX
Status: offline

I think Peekstra is using Desired Configuration Management thus some of the confusion on your part Mark.

_____________________________

Jason
________________________________________
http://ihaveablog.wordpress.com

(in reply to mcarriere893)

Post #: 8

RE: Detecting installed application - 4/16/2008 10:11:44 AM

mcarriere893

Posts: 3618
Score: 300
Joined: 4/12/2002
From: Manitoba, Canada
Status: offline

That's what I thought, just not assumed. That would be kinda a weird thing to use for this type of need as the info is already available with inventories... why re-invent the wheel?...unless inventories are not enabled, so DCM could be utilized

_____________________________

Mark Carriere
Microsoft MVP-SMS
www.SMSUG.ca

(in reply to jsandys)

Post #: 9

RE: Detecting installed application - 4/16/2008 10:17:00 AM

Peekstra

Posts: 29
Score: 0
Joined: 2/7/2008
Status: offline

I understand now that all the registry key info is available via the hardware info collection process. So it's no problem for me to create a group based on a product version with a query (and if the info isn't present, SCCM can be extended).

It's still not clear to me how I can get the disered configuration function to work. What I was trying to do is add a configuration item to the baseline to have it check if the latest version of a program is installed. I was then using that information to create a collection (but I now accomplish that with the ARP query).

So is it possible to check for a program version in the desired configuration management...? And if so, how?

thanks,

Peekstra.

EDIT: I wasn't clear on that I'm trying to get the desired config management to work. In the book there was an example about creating collections using the desired config info. I just didn't realize then that it isn't a very efficient way to do this.

< Message edited by Peekstra -- 4/16/2008 10:22:48 AM >

(in reply to mcarriere893)

Post #: 10

RE: Detecting installed application - 4/16/2008 1:44:08 PM

mcarriere893

Posts: 3618
Score: 300
Joined: 4/12/2002
From: Manitoba, Canada
Status: offline

Well, probably (I think) the quickest baseline item would be an Application Configuration Item. I see you have an msi for the app, so use the detection method "Use Windows Installer (MSI) detection". Open the msi and the product code and version will auto fill, or find the values in the registry and manually enter them.

I don't think you'd need any objects or settings as you would just get back "Not detected" if it is not installed.

As far as the collection query (among other items you want to return), use SMS_G_System_CI_ComplianceState.IsDetected (where 0 is not detected and 1 is detected).

Without using the msi detection method, you may need to look at using a general compliance item, and using a script to check for the existance of the specific keys and data (like the specific uninstall key, and then perhaps the DisplayVersion). I don't have that app installed, but I find that typically different versions of apps get a different uninstall key instead of just changing the data (like displayname, displayversion, etc).

One thing you may need to consider re DCM vs Inventory for this type of scenario is their schedules. If inventory is taken every day and DCM once a week, obviously you'd be going the inventory route so that your collection data would be update faster.

I'm sure there are other admins who are more of a DCM expert than I. Perhaps check out the Microsoft technet (ConfigMgr) forums if no one hwere can give you any additional/better advice.

_____________________________

Mark Carriere
Microsoft MVP-SMS
www.SMSUG.ca

(in reply to Peekstra)

Post #: 11

RE: Detecting installed application - 4/17/2008 11:06:26 AM

Peekstra

Posts: 29
Score: 0
Joined: 2/7/2008
Status: offline

Thanks for all the info Mark!

The problem was that the MSI was bundled in an executable but I discovered the MSI on the AV server.

I'm already using the SMS_G_System_CI_ComplianceState.IsDetected which works fine (it's no problem yet that the data can be 1 week old but I can then use the alternative).

I still hope that a future release of SCCM will add an option to read a registry key value to DCM which will make checking a version for programs without an MSI a bit easier.

It's also a good idea to forbid installation of software without an MSI installer, I'll be working on that...