2

I'm trying to recreate an environment (more specifically, to document a reproducable environment). I have a sneaking suspicion that some installed things may have stomped on the same registry value or values, and would like to test that by reproducing the order in which various components are installed.

However, I'm having trouble figuring out in what particular order things were installed. I found the reg key "HKEY_LOCAL_MACHINE_SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall", which seems to have subkeys for installed things, and those subkeys (sometimes) include InstallDate. However, that only has day resolution, so I can't tell the order of things installed on the same day.

Ctime can change, can't it? So that's out. Otherwise, I'm out of ideas.

This is on Win7. I'm a unix guy, please have patience.

Anyone have any ideas?

5

This should do. Open up Powershell:

Get-WmiObject Win32_ReliabilityRecords | 
    Where-Object { $_.Message.StartsWith('Windows Installer installed') } |
    Select TimeGenerated,Message | FL

As long as the reliability counters are enabled, which I believe they should be by default on Windows 7, this gives you a perfect list of exactly when software has been installed.

You can also see this data in a graphical representation with perfmon /rel

Example output:

TimeGenerated : 20141112045116.000000-000 
Message       : Windows Installer installed an update. Product Name: Microsoft Office Shared MUI (English) 2013. Product Version: 15.0.4569.1506.
                Product Language: 1033. Manufacturer: Microsoft Corporation. Update Name: Update for Microsoft Office 2013 (KB2881008) 64-Bit
                Edition. Installation success or error status: 0.

TimeGenerated : 20141112045110.000000-000 
Message       : Windows Installer installed an update. Product Name: Microsoft Office Professional Plus 2013. Product Version: 15.0.4569.1506.
                Product Language: 0. Manufacturer: Microsoft Corporation. Update Name: Update for Microsoft PowerPoint 2013 (KB2889936) 64-Bit
                Edition. Installation success or error status: 0.

TimeGenerated : 20141112045100.000000-000 
Message       : Windows Installer installed an update. Product Name: Microsoft PowerPoint MUI (English) 2013. Product Version: 15.0.4569.1506.
                Product Language: 1033. Manufacturer: Microsoft Corporation. Update Name: Update for Microsoft PowerPoint 2013 (KB2889936) 64-Bit
                Edition. Installation success or error status: 0.

TimeGenerated : 20141111002348.000000-000 
Message       : Windows Installer installed the product. Product Name: EMET 5.1. Product Version: 5.1. Product Language: 1033. Manufacturer:
                Microsoft Corporation. Installation success or error status: 0.

Does that date/time format annoy you? Try this:

Get-WmiObject Win32_ReliabilityRecords | 
    Where-Object { $_.Message.StartsWith('Windows Installer installed') } | 
    Select @{n='TimeGenerated';e={[System.Management.ManagementDateTimeConverter]::ToDateTime($_.TimeGenerated )}},Message | FT -AutoSize

11/11/2014 10:51:24 PM Windows Installer installed an update. Product Name: Microsoft Office Professional Plus 2013. Product Version: 15.0.4569.15...
11/11/2014 10:51:16 PM Windows Installer installed an update. Product Name: Microsoft Office Shared MUI (English) 2013. Product Version: 15.0.4569...
11/11/2014 10:51:10 PM Windows Installer installed an update. Product Name: Microsoft Office Professional Plus 2013. Product Version: 15.0.4569.15...
11/11/2014 10:51:00 PM Windows Installer installed an update. Product Name: Microsoft PowerPoint MUI (English) 2013. Product Version: 15.0.4569.15...
11/10/2014 6:23:48 PM  Windows Installer installed the product. Product Name: EMET 5.1. Product Version: 5.1. Product Language: 1033. Manufacturer...

Note that this will list both product installs and patches. Tweak the string around "Windows Installer installed..." if you want to only catch either updates or product installs.


Edit: Just a couple more things to note. First, this data is aggregated from Event Log data... so if you've cleared your event logs, this data will disappear. Second... the date time format as reported by Get-WMIObject ... Powershell has a newer version of this cmdlet called Get-CIMInstance that automatically converts these date/times for you into a more readable form... but Windows 7 didn't originally ship with Get-CIMInstance. You'd need to upgrade to Powershell 3 first, or just use the conversion technique I showed above.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.