Hello !
I am wondering how Windows retrieve the installation date of a product when there is no installDate value stored in the registry…
Of course none of the v3 and v4 PSADT functions are returning the value.
An example with the Draw.io software : both old and new Windows application screen are showing an install date :
No InstallDate information in the registry :
Does someone have an idea how to retrieve the info ? (Win32_Product has no info about Draw.io since it’s not an Msi application)
Ok, i think i have my anwser with this article : Leverage Registry Key Time Stamps via PowerShell - Scripting Blog [archived]
Auditing
The registry obviously contains a ton of information that is useful for auditing. Take a list of installed software, for example. Knowing the name and version of an application, and also the last time the installation was modified could be very helpful. It just so happens that you can get a pretty accurate list of installed software by querying the child keys under:
HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Some of these keys contain an InstallDate value, but not all of them. Looking at the last modified time of each key gives you a pretty reasonable guess as to the last time the application’s installation was modified. You can’t tell if it’s when the application was installed or patched, or if the key was manually modified, but knowing the time stamp can still be useful.
I tried to get the LastWriteTime for the registry keys with no InstallDate and the resulting values are identical to the ones displayed in the Installed Software Window. (I had to go P/Invoke with the RegQueryInfoKey API, because LastWriteTime doesn’t seem to be retrieved in plain Powershell)
2 Likes
