Hi there...few installations are not getting registered in the registry and as a result its not possible to get those alerts in LEM. I have a scirpt which can get the number of count (from the registry location - \Software\Microsoft\Windows\CurrentVersion\Uninstall\ & \Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ where it will get recorded once the software is installed & have that logged in the event based on your preference). Currettly I have pointed that to log in Application Logs in the Event Viewer. You can run this script using Windows Powershell. The main idea is to get the script run once a week (Using task Schedular) and if the count increases, then we do an audit in the computer.
if (!([diagnostics.process]::GetCurrentProcess().Path -match '\\syswow64\\'))
{
$uninstallPath = "\Software\Microsoft\Windows\CurrentVersion\Uninstall\"
$uninstallWow6432Path = "\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\"
@(
if (Test-Path "HKLM:$uninstallWow6432Path" ) {Get-ChildItem "HKLM:$uninstallWow6432Path" -Recurse | Measure-Object | Out-File "C:\PS Output\Total6432.csv"}
if (Test-Path "HKLM:$uninstallpath" ) {Get-ChildItem "HKLM:$UninstallPath" -Recurse | Measure-Object | Out-File "C:\PS Output\Total32.csv"}
)
Write-EventLog -LogName Application -Source ApplicationInstall -EventId 1234 -EntryType Warning -Message "Application Installed" | Get-Content 'C:\PS Output\Total32.csv'
Write-EventLog -LogName Application -Source ApplicationInstall -EventId 1234 -EntryType Warning -Message "Application Installed" | Get-Content 'C:\PS Output\Total6432.csv'
}
I would like to get specifically software name appear in the even logs as other MSIInstaller will do. I am also looking to changing the script, but if you guys also please contribute / update and give some update that would be great to fix the issue.