Software Inventory reports an old version that is no longer installed

Products

IT Management Suite Client Management Suite Inventory Solution

Issue/Introduction

The customer is running standard software inventory on his client machines. The customer is trying to understand how few client machines are showing versions of installed products that are no longer installed. Meaning, we will use Zoom as an example for this article, they receive inventory that they still have version 5.6.5 installed when they already have 5.12.10232 as the current one.

They see that under the manage>computers>select a computer>software section, zoom 5.6.5 is present on the client machine, as well 5.12.10232

When the customer manually looks at that machine under the installed products in add/remove programs, he can see version 5.12.10232 as the installed one.

When he looks at the "Installed Software" report (reports > discovery and inventory > inventory > cross platform > software/applications > software), Zoom version 5.6.5 is not listed.

When the customer runs powershell scripts like this one (he did try to search WMI for everything with the name "Zoom" a few days ago and that showed nothing too):

Get-WmiObject -Class Win32_Product

or

Get-WmiObject -Class Win32_Product | Sort-Object -Property Vendor | Select-Object Vendor, Name

or

Get-WmiObject -Class Win32_Product | where vendor -eq zoom | select Name, Version

but that 5.6.5 version is not reported.

He searched for "5.6.5" on the entire registry on that pc but it yielded no results.

Environment

ITMS 8.6

Cause

Based on what we saw for affected computer using the captured NSE:

We indeed identified that ZOOM 5.6.5 (823) and ZOOM(64BIT) 5.12.10232 are detected as installed on this machine. Both software are found by Software Management Framework (SMF) AddRemove scanner.

It seems that ZOOM(64BIT) 5.12.10232 was installed for all users and ZOOM 5.6.5 (823) was installed for specific user.

Resolution

In order to know if the information about that software version is actually coming from the client machine or just old data in the database from previous inventories, you should capture the NSE is that created during software inventory:

Create a "Gather Inventory" task:
1. In the SMP Console, go to Manage>Jobs and Tasks
2. Select a folder and right-click>New>Task
3. Under "Discovery and Inventory" folder, select "Gather Inventory"
4. Check just the "Software" Inventory option,
5. Go to advanced > Run Options tab and uncheck the "Send inventory changes (delta) only" checkbox.
6. Click OK.
Set the client to capture NSEs:
1. Open Registry Editor
2. Navigate to HKEY_LOCAL_MACHINE\Software\Altiris\Altiris Agent\Transport
3. Modify the String value "Capture Events Folder" so that the Value data points to a directory or path, for example, "C:\Temp".
and then run the "Gather Inventory" task on that client.

In the captured NSE, look for entries regarding the software that you are troubleshooting for (in this example is Zoom).

In this example, the software inventory found the old version of Zoom. Look at the reported file entries, it should have a couple of file entries pertaining to the older and newer version:

As well under what accounts the software was installed:

We would suggest to check the account referenced in the NSE if there is one (in this example, the account with name 'johndoe' on affected computer):

As well check the following path on this machine C:\Users\johndoe\AppData\Roaming\Zoom\uninstall (this is the reason why windows OS did not show it Add/Remove Programs because it was only for specific user)

Most likely we detected ZOOM(64BIT) 5.12.10232 from registry keys under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

and we detected ZOOM 5.6.5 (823) from registry keys under HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall or HKEY_USERS\S-xxx\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall. You may try to find Zoom 5.6.5 under those registry keys.