PENDING Report applications installed manually by local admins

[antuanbl]

Hello ,

I need to create a report with the applications installed manually by users who are local admins. So, the question is that I need to know the applications installed via SCCM/Software center and the applications installed manually by a user.

I tried by installation source but this method is not valid because some applications unzip data to other folder and makes the installation from it, and the applications installed from a net share the install source is empty.

I tried with wmi query in local computer
The second wmi query list all applications and the fist one list applications installed from sccm, but the problem is that I could not obtain the diference between 2 queries because there is not a value to compare. For example the value name is not exactly the same for the applications.

Get-WmiObject -ComputerName localhost -ClassName CCM_Application -Namespace "root\ccm\clientSDK"

Get-WmiObject -ComputerName localhost -Namespace "root\cimv2\sms" -Class SMS_InstalledSoftware


In SCCM DB i have the same problem
select * From fn_ListApplicationCIs(1033) --> Applications of sccm
select * from v_GS_INSTALLED_SOFTWARE --> All installed applications

i don´t find the way to obtain the difference (-)


Any ideas?

Thanks for all

 

[Sam Banford]

I had a similar issue to conquer, junior level admins who were running installs directly rather than utilizing the application deployments. You pinpointed the problem though, you're at the mercy of the various installers which all don't conform to a single audit method.

My eventual solution was to lock-down all installation sources of managed software so that it could only come from SCCM and train the admins to utilize the enterprise properly.

If you're really set on trying to control deployment after-the-fact you could deploy the applications to a test system through the SC, make note of registry or ini values that indicate it came from ..\ccmcache and which account started the process. Roll it up into a PowerShell script ran as a Compliance Check. Not knowing how big/complex your baseline is though this could get pretty involved.

 

[Garth]

Without 3rd party tools, there is no reliable way to do this. With the 3rd party tools, all they can tell you is what was installed via SCCM. For example this is what is installed on my computer via SCCM.

Also keep in mind that I work for one of these 3rd party companies too.

 

[antuanbl]

Hello, Thank you very much for your answers, I have done it by executing the query and removing one by one the applications with sccm origin.