通过注册表检测已安装的程序 [英] Detecting installed programs via registry

问题描述

我需要开发一个进程来检测用户的计算机是否安装了某些程序，如果安装了，是什么版本.我相信我需要一个包含注册表位置和键的列表来查找并将其提供给程序，这不是问题.有没有更好的方法来实现这一点?

我的第一个想法是在卸载条目中检查注册表，但我希望检测的应用程序之一似乎没有.使用应用程序输入的所有注册表的标准位置是什么?

解决方案

用户特定的设置应该写入 HKCU\Software，机器特定的设置应该写入 HKLM\Software.在这些键下，结构[软件供应商名称]\[应用程序名称](例如HKLM\Software\Microsoft\Internet Explorer)可能是最常见的，但这只是一个惯例，而不是自然法则.

许多(大多数?)应用程序还将其卸载条目添加到 HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\[app name]，但同样，并非所有应用程序都这样做.>

这些是最重要的键；然而，注册表的内容不必完全代表已安装的软件——也许应用程序安装了一次，但随后被手动删除，或者卸载程序没有删除它的所有痕迹.如果您想确定，请检查文件系统以查看该应用程序是否仍然存在于其注册表项所显示的位置.

如果您是管理员组的成员，您可以检查 HKEY_USERS 配置单元 - 每个用户的 HKCU 实际驻留在那里(您需要知道用户 SID，或查看所有他们).

注意:正如@Brian Ensink 所说，已安装"是一个有点模糊的概念——我们是否试图找到用户可以运行的内容?有些软件甚至根本不写入注册表:搜索便携式应用程序"以查看经过专门修改以直接从媒体 (CD/USB) 运行并且不留下任何痕迹的应用程序在计算机上的.我们可能还需要扫描磁盘、网络磁盘、用户下载的任何内容，以及 Internet 上全球可访问的 Windows 共享(是的，这些东西合法存在 - \\live.sysinternals.com\tools代码> 浮现在脑海中).在这个方向上，用户可以运行的内容没有真正的限制，除非被系统策略阻止.

I need to develop a process that will detect if the users computer has certain programs installed and if so, what version. I believe I will need a list with the registry location and keys to look for and feed it to the program which is not a problem. Is there a better way to accomplish this?

My first thought was to check in the registry in the uninstallation entries but it seems one of the apps I wish to detect does not have one. What is the standard location for all registry using applications to make an entry in?

解决方案

User-specific settings should be written to HKCU\Software, machine-specific settings to HKLM\Software. Under these keys, structure [software vendor name]\[application name] (e.g. HKLM\Software\Microsoft\Internet Explorer) may be the most common, but that's just a convention, not a law of nature.

Many (most?) applications also add their uninstall entries to HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\[app name], but again, not all applications do this.

These are the most important keys; however, contents of the registry do not have to represent the installed software exactly - maybe the application was installed once, but then was manually deleted, or maybe the uninstaller didn't remove all traces of it. If you want to be sure, check the filesystem to see if the application still exists where its registry entries say it is.

Edit:

If you're a member of the group Administrators, you can check the HKEY_USERS hive - each user's HKCU actually resides there (you'll need to know the user SID, or go through all of them).

Note: As @Brian Ensink says, "installed" is a bit of a vague concept - are we trying to find what the user could run? Some software doesn't even write to the Registry at all: search for "portable apps" to see apps that have been specifically modified to run directly from media (CD/USB) and not to leave any traces on the computer. We may also have to scan the disks, and network disks, and anything the user downloads, and world-accessible Windows shares in the Internet (yes, such things exist legitimately - \\live.sysinternals.com\tools comes to mind). In this direction, there's no real limit of what the user can run, unless prevented by system policies.

这篇关于通过注册表检测已安装的程序的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！