WMI Query for an Installed Application

Last night, I was reading an excellent blog post by Darren Mar-Elia on why the Win32_Product class sucks.  This got me asking the question: If you wanted to create a WMI query to determine whether or not a particular application was installed on a machine, how would you do it?  A quick Google search turned up nothing useful.  Not one to shy away from a puzzle, I set out to figure a solution.

My initial approach was to try StdRegProv, but alas, the class contains only methods.  While such a class could be used in a script, it is an automatic no-go for queries (since a query only reads properties).  Now this is starting to look like the evil Sudoku puzzle I agonized over last week… 

Others on the Interweb suggested using Win32_RegistryAction class.  This is a bad idea, since the class enumerates across the ENTIRE registry.  Wanna talk slow?  Hell, you’re better off using Win32_ProductClass over this dog.  Besides, I couldn’t ever get the damn thing to work.

So instead, query the file system.  The advantage to this method is that it’s fast.  Oh, did I mention that it’s fast?  Speed cannot be underappreciated, especially if your query is tied to a GPO.  Nothing says admin-hater like a user who has to wait ten minutes to log on.

As an example, if you want to see if Office 2007 is installed (in this case, Word).  Easy enough.  Create a query as follows:

Namespace: root\cimv2
Query: SELECT * FROM CIM_Datafile WHERE Name = ‘C:\\Program Files\\Microsoft Office\\Office12\\WINWORD.EXE’

Be sure to note that you need double whacks!  If you’re really rambunctious, you can also specify that you’re looking for a particular version by adding a

AND Version = ‘X.X.X.X’

which is useful if you checking for a patch.  Of course, you have to know where the application is installed.  You DID standardize your install packages, didn’t you?

Oh and one more thing… don’t get too crazy with WMI queries in your GPOs… these suckers get eval’d EVERY refresh cycle.  So use them as little as possible and tear them down when you don’t need them anymore.

Don’t say I never helped you out…



  1. Posted March 6, 2012 at 2:17 pm | Permalink | Reply

    .. ” suggested using Win32_RegistryAction class. This is a bad idea, since the class enumerates across the ENTIRE registry. Wanna talk slow? ” …


    “Besides, I couldn’t ever get the damn thing to work.”
    Neither can I. I can get it to dump the entire friggin registry, but I can not get a query to slect one key, let alone one entry. Piece of $41t.

  2. Abraham Adriano
    Posted January 10, 2014 at 4:43 pm | Permalink | Reply

    What WMI class or alternative would you suggest if we want to get info of all application installed if Win32_RegistryAction and Win32_Product class is not recommended?

    • Posted January 10, 2014 at 5:24 pm | Permalink | Reply

      Unfortunately, your only option may be to use Win32_Product for what you need. The only other way that comes to mind, is to have some type of script that iterates over the keys in HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: