Stooker
(Fresh Scripter)
2013-09-30 01:36 PM
Application executable list showing last used

I've been running round in circles on this one, so hope someone can help.

For sometime now my Kix login script has collected installed application details by interrogating the HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall registry key. By looking at each key I gather an audit of applications that appear in Add/Remove programs.

I've now been asked to provide a 'last used' date for each application. The only way I've read that this could be obtained is by using the UDF fnGetFileProp to return the Date Last Accessed of an application's executable. Perhaps not the most reliable data, but it's all I've got!

My problem is that the Uninstall registry key doesn't give me a link to the application executable so that I can then query its Date Last Accessed property.

I've also quizzed the HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths registry key. It does provide a path to the executable, but not for all applications on the PC.

Soooo, I'm trying to produce a list of applications installed on a PC which includes its path to the executable to then query its Date Last Accessed.

I should say that the majority of my PCs are Windows XP Service Pack 3.


LonkeroAdministrator
(KiX Master Guru)
2013-09-30 03:16 PM
Re: Application executable list showing last used

just say not possible and move on.

Stooker
(Fresh Scripter)
2013-09-30 03:56 PM
Re: Application executable list showing last used

Useful - NOT. Back in the real world, anyone else have any help.

BillBarnard
(Starting to like KiXtart)
2013-09-30 05:30 PM
Re: Application executable list showing last used

Just log those .exe files that do exist, and ignore the rest.
These other registry entries don't seem to be proper installed apps on my machine.
Just references to various dlls and the like.


It_took_my_meds
(Hey THIS is FUN)
2013-10-01 01:02 AM
Re: Application executable list showing last used

Well it actually ISN'T possible. There is no reliable way to link the executable to the listing in the registry for all applications.

Arend_
(MM club member)
2013-10-01 11:55 AM
Re: Application executable list showing last used

Here is an OLD script I wrote back in the day, gathers software from HKLM, HKCU and WMI:
 Code:
$=SetOption('Explicit','On')
Global $NameArray[], $VenArray[], $VerArray[]

Function GetSoftReg($uninstall)
  Dim $i, $key, $x, $y, $ven, $ver
  $i = 0
  While EnumKey($uninstall,$i) <> "" And @ERROR = 0
    $key = EnumKey($uninstall,$i)
    $x = ReadValue($uninstall+$key,'DisplayName')
    If $x <> ""
      $ver = ReadValue($uninstall+$key,'DisplayVersion')
      $ven = ReadValue($uninstall+$key,'Publisher')
      If $ven = "" $ven = "NA" EndIf
      If $ver = "" $ver = "NA" EndIf
      $y = UBound($NameArray) + 1
      ReDim Preserve $NameArray[$y]
      ReDim Preserve $VerArray[$y]
      ReDim Preserve $VenArray[$y]
      $NameArray[$y] = $x
      $VerArray[$y] = $ver
      $VenArray[$y] = $ven
      ;? $NameArray[$y]
    EndIf
    $i = $i + 1
  Loop
EndFunction

;Reg: 'DisplayName','DisplayVersion','Publisher'
;WMI: 'Name','Vendor','Version'

Function GetSoftWMI
  Dim $objWMIService, $colItems, $objItem, $itm, $chk, $y, $x, $ven, $ver
  $objWMIService = GetObject("winmgmts:\\.\root\cimv2")
  $colItems = $objWMIService.ExecQuery("Select * from Win32_Product",,48)
  For Each $objItem in $colItems
    $chk = "False"
    For Each $itm in $NameArray
      If $itm = $objItem.Name
        $chk = "True"
      EndIf
    Next
    If $chk = "False"
      $ver = $objItem.Version
      $ven = $objItem.Vendor
      If $ven = "" $ven = "NA" EndIf
      If $ver = "" $ver = "NA" EndIf
      $y = UBound($NameArray) + 1
      ReDim Preserve $NameArray[$y]
      ReDim Preserve $VerArray[$y]
      ReDim Preserve $VenArray[$y]
      $NameArray[$y] = $objItem.Name
      $VerArray[$y] = $ver
      $VenArray[$y] = $ven
    EndIf
  Next
EndFunction

GetSoftReg("HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\")
GetSoftReg("HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\")
GetSoftWMI

$=RedirectOutput("D:\Software.log")
Dim $i
For $i = 0 to UBound($NameArray)
  ? $NameArray[$i]
Next


LonkeroAdministrator
(KiX Master Guru)
2013-10-01 04:53 PM
Re: Application executable list showing last used

Arend, and this script of yours has used dates included in it?

stooker, you can go at it by having a resident script running on the computer ALL THE TIME and watching what products are running. or replace all exe files with kix32.exe and script that logs the start and then starts the actual exe.

those are pretty much your only options for this kind of info.

so yes, it is possible. will you do it the way it is possible? most likely not. will you ask for better solutions? most likely.
so again, not possible and move on is the best answer here.

just to explain myself a bit more, the file last accessed can not be used. it gets changed by you checking it! so if not on the same run, but the next time the script runs it will be the script run time. how useless is that?


Arend_
(MM club member)
2013-10-01 09:04 PM
Re: Application executable list showing last used

Lonkero, no it doesn't.
I forgot, it's added in a later version that I cant find right now but you can replace 'Publisher' with 'installdate' for the registry items.
And replace 'Vendor' with 'installdate' for the WMI items.

But Last used date, no..


Arend_
(MM club member)
2013-10-01 09:15 PM
Re: Application executable list showing last used

Here is an article that mentions Last Used Date, but it doesn't seem to list all software to me. For me it only lists 1 piece of software that isn't even installed :P
Last Used Date


NTDOCAdministrator
(KiX Master)
2013-10-15 05:06 AM
Re: Application executable list showing last used

Well I know that there are many applications including backup software, antivirus, logging applications that do modify the "Last Access" date. Any viewing, copying or moving of the documents, images and other files automatically alters last accessed date stamp of the file which then invalidates using it.

My old script for computer software inventory does similar to Arends but attempts to remove duplicates (have not tested Arend's code but it may already do it) as you will find duplicates in that list.

But using FSO for Last Access Date will be unreliable at best.

There are some WMI scripts that can also monitor application launch that you could probably look at implementing.