Where does a Smart Rule (Detection Rule) look to find the MSI Product Code?
Last Updated January 21, 2015
When you use the MSI Product Code smart rule for a software resources detection rule, where does the detection action look on the cient when it runs this rule?
The process parses through the "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" registry key, and also looks in the Win32_Product WMI Class.
Actually, there is no direct work with registry in MSI Product Code rule, we use the MsiGetProductInfo API function. If "Detect per-user installations for the interactive user" is selected, we will impersonate currently logged on user before call, if not - it will be called in System user context.
Software Management Solution 7.x
Imported Document ID: TECH168380
Subscribing will provide email updates when this Article is updated. Login is required to Subscribe