How to Audit Installed Software from the Command Line
This article explains how to extract information installed on the local or remote PCs by executing Windows commands from the command-line prompt.
For various purposes it's required sometimes to have a software audit information as a list of all programs installed on a PC. It is possible to see this information in the Add/Remove Programs view in Windows, but for reports preparation and other tasks this information should be available in a file. Fortunately you don't need to create such file manually, because you can use WMI requests to get a software inventory information that you need.
Getting a Software Audit Information Using WMI
Windows Management Instrumentation (WMI) is a special system interface that provides an access for Windows components and external applications to the system information that includes software inventory data. This information can be accessed through a command-line using Windows Management Instrumentation Command-line (WMIC). For example, in order to get information about software installed on a computer you need to execute the following command in the Windows command-line console.
wmic product
If you like to get software audit information including only software product name and version, you need to change the command to the following.
wmic product get name,version
These commands sends the information to a console Windows. If you need to have it in a file you can use an additional option to specify an output format and destination file.
wmic product get name,version /format:csv > software-inventory.csv
Collecting Software Audit Information from Remote PCs
The commands above extracted installed applications list from the PC where they were executed. Is it possible to perform installed applications audit remotely? WMIC accepts parameter that defines a PC that should be contacted, so you can execute a command remotely using the following syntax.
wmic /node:<PC-NAME> product get name,version
If this remote command fails, you need to check if WMI is enabled on the remote PC and in your network infrastructure. On modern environments you have to enable WMI manually, because it's disabled by default.
Introducing Clarity into Installed Software Audit Results
If you compare installed programs audit results produced by WMI with the information displayed by the Add/Remove Programs list, you can see that it isn't complete, i.e. there are some entries that are missing in the WMI results. It happens because WMI reports only data that are available in the Windows Installer database, i.e. it reports only applications that were installed using Windows Installer. Depending on a particular system you can find several entries that were not installed by Windows Installer. Information about these installations is stored in Windows registry. In order to get information about all installed applications you need to merge results reported by WMI with results reported by the following registry query.
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
Most of software audit tools use both WMI and registry data to merge them and report an accurate list of installed programs. If you prefer to use one of software audit tools instead of using the command line, read the How to Audit Software Using Software Inventory Tools article.