3

Say I have a file on my system that was put there by a Windows Installer, but I'm not sure which one (in this case it was one of the many sub installers of Microsoft SQL Server).

Is there anything I can query that will tie back that file to the installer so I can uninstall it?

  • No; There isn't. You can tell by which directory it's in though and run the uninstaller in that folder. – Ramhound May 27 '17 at 1:47
  • 2
    It's definitely possible to query an MSI to find the files and folders it registers, but I'm not sure if you need special tools for that. – RJHunter May 27 '17 at 5:54
  • Compare the date of the file was created and installation of any app (appwiz.cpl). – Biswapriyo May 27 '17 at 16:25
0

I don't think you can trace each and every individual file to the MSI installer. However, what you can do is trace an Install Location, if it's populated by the MSI in this registry key

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\]

Here is a script which can help you with that.

#Get MOF File Method
$mof = @'
#PRAGMA AUTORECOVER

[dynamic, provider("RegProv"),
ProviderClsid("{fe9af5c0-d3b6-11ce-a5b6-00aa00680c3f}"),ClassContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall")]
class InstalledProducts {
[key] string KeyName;
[read, propertycontext("DisplayName")] string DisplayName;
[read, propertycontext("DisplayVersion")] string DisplayVersion;
[read, propertycontext("InstallDate")] string InstallDate;
[read, propertycontext("InstallLocation")] string InstallLocation;
[read, propertycontext("InstallSource")] string InstallSource;
[read, propertycontext("Publisher")] string Publisher;
[read, propertycontext("EstimatedSize")] string EstimatedSize;
[read, propertycontext("UninstallString")] string UninstallString;
[read, propertycontext("WindowsInstaller")] string WindowsInstaller;
};

[dynamic, provider("RegProv"),
ProviderClsid("{fe9af5c0-d3b6-11ce-a5b6-00aa00680c3f}"),ClassContext("local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432node\\Microsoft\\Windows\\CurrentVersion\\Uninstall")]
class InstalledProducts32 {
[key] string KeyName;
[read, propertycontext("DisplayName")] string DisplayName;
[read, propertycontext("DisplayVersion")] string DisplayVersion;
[read, propertycontext("InstallDate")] string InstallDate;
[read, propertycontext("InstallLocation")] string InstallLocation;
[read, propertycontext("InstallSource")] string InstallSource;
[read, propertycontext("Publisher")] string Publisher;
[read, propertycontext("EstimatedSize")] string EstimatedSize;
[read, propertycontext("UninstallString")] string UninstallString;
[read, propertycontext("WindowsInstaller")] string WindowsInstaller;
};
'@
$mof | Out-file -encoding ascii $env:TMP\InstalledProductsMof.txt -Force
mofcomp.exe $env:TMP\InstalledProductsMof.txt 

Get-WmiObject -Namespace root\default -class InstalledProducts | Select DisplayName,DisplayVersion,InstallDate,InstallLocation, InstallSource,Publisher,EstimatedSize,UninstallString,WindowsInstaller 

# CLEAN-UP: Remove the WMI Classes you just created

Remove-WmiObject -Namespace root\default -class InstalledProducts 
Remove-WmiObject -Namespace root\default -class InstalledProducts32 

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.