3 Replies Latest reply on Jun 17, 2014 3:11 AM by zman

    Username that installed an application


      Hi there,


      Does anybody know how to retrieve or include in the LDMS inventory data base the username of the user that installed manually a given application in a client computer? Maybe using the WMI tool from LDMS console?, in that case in what WMI path could that information be found?



        • 1. Re: Username that installed an application
          JonnyB SupportEmployee

          The closest thing i have found is a power shell command to get the owner of a folder (get-acl) How can I find out what user installed software? - Spiceworks

          I don't know that windows actually stores this information.

          • 2. Re: Username that installed an application
            IHGkbraun Apprentice

            I know that you can view the ID of the machine and user if it is a item that has passed through HIPS and in the trusted lists.This can be viewed from the core or in the HIPS trusted list activity.

            It's not automated but you can right click on the program item; and in its properties, the computer ID and other info will be able to be used to pinpoint that info.


            Hope it helps some.

            • 3. Re: Username that installed an application
              zman Master

              Tough one since exe and MSI present different information concerning installs. If you are concerned with just MSIs then you can scrape the application event log for 1033 ids and suck that into the inventory. This would require a lot of heavy scripting. Sysinternals psloglist would make it somewhat easier (simple command line psloglist -i 1033 application). You can use other command lines to filter on time frames etc... You could hook psloglist into one of the console extenders and have right click and display of the information, however, this would not allow for large scale reports. A major weakness is that the app and the installation information are stored in two separate areas of the OS. If I smoke the event log then I have lost that link.