The customer is running standard software inventory on his client machines. The customer is trying to understand how few client machines are showing versions of installed products that are no longer installed. Meaning, we will use Zoom as an example for this article, they receive inventory that they still have version 5.6.5 installed when they already have 5.12.10232 as the current one.
They see that under the manage>computers>select a computer>software section, zoom 5.6.5 is present on the client machine, as well 5.12.10232
When the customer manually looks at that machine under the installed products in add/remove programs, he can see version 5.12.10232 as the installed one.
When he looks at the "Installed Software" report (reports > discovery and inventory > inventory > cross platform > software/applications > software), Zoom version 5.6.5 is not listed.
When the customer runs powershell scripts like this one (he did try to search WMI for everything with the name "Zoom" a few days ago and that showed nothing too):
Get-WmiObject -Class Win32_Product
or
Get-WmiObject -Class Win32_Product | Sort-Object -Property Vendor | Select-Object Vendor, Name
or
Get-WmiObject -Class Win32_Product | where vendor -eq zoom | select Name, Version
but that 5.6.5 version is not reported.
He searched for "5.6.5" on the entire registry on that pc but it yielded no results.
ITMS 8.6
Based on what we saw for affected computer using the captured NSE:
We indeed identified that ZOOM 5.6.5 (823) and ZOOM(64BIT) 5.12.10232 are detected as installed on this machine. Both software are found by Software Management Framework (SMF) AddRemove scanner.
It seems that ZOOM(64BIT) 5.12.10232 was installed for all users and ZOOM 5.6.5 (823) was installed for specific user.
In order to know if the information about that software version is actually coming from the client machine or just old data in the database from previous inventories, you should capture the NSE is that created during software inventory:
In the captured NSE, look for entries regarding the software that you are troubleshooting for (in this example is Zoom).
In this example, the software inventory found the old version of Zoom. Look at the reported file entries, it should have a couple of file entries pertaining to the older and newer version:
<resource typeGuid="{07849305-D41A-45C2-95F0-333FA79FB862}" name="Zoom 5.6.5 (823)" ref="3924" rename="false">
<key name="vendor|name|ver" value="ZOOM VIDEO COMMUNICATIONS, INC.|ZOOM|5.6.5 (823)" operationType="Add"/>
</resource>
<resource typeGuid="{D2CFA253-5266-4E77-ADF4-026D997EF7A2}" name="Zoom Video Communications, Inc." ref="3925" rename="false">
<key name="vendor" value="Zoom Video Communications, Inc." operationType="Add"/>
</resource>
<resource typeGuid="{07849305-D41A-45C2-95F0-333FA79FB862}" name="Zoom(64bit) English x64" ref="3927" rename="false">
<key name="vendor|name|ver|lang|arch" value="ZOOM|ZOOM(64BIT)|5.12.10232|EN-US|X64" operationType="Add"/>
</resource>
<resource typeGuid="{D2CFA253-5266-4E77-ADF4-026D997EF7A2}" name="Zoom" ref="3928" rename="false">
<key name="vendor" value="Zoom" operationType="Add"/>
</resource>
As well under what accounts the software was installed:
<row c1="Zoom" c2="[RESOURCEREF(3924)]" c3="0" c5="10000" c7="2021-05-24T00:00:00" c8="" c9="5.6.5 (823)" c10="Zoom Video Communications, Inc." c11="1" c12=""C:\Users\johndoe\AppData\Roaming\Zoom\uninstall\Installer.exe" /uninstall"/>
We would suggest to check the account referenced in the NSE if there is one (in this example, the account with name 'johndoe' on affected computer):
<row c1="Zoom" c2="[RESOURCEREF(3924)]" c3="0" c5="10000" c7="2021-05-24T00:00:00" c8="" c9="5.6.5 (823)" c10="Zoom Video Communications, Inc." c11="1" c12=""C:\Users\johndoe\AppData\Roaming\Zoom\uninstall\Installer.exe" /uninstall"/>
As well check the following path on this machine C:\Users\johndoe\AppData\Roaming\Zoom\uninstall (this is the reason why windows OS did not show it Add/Remove Programs because it was only for specific user)
Most likely we detected ZOOM(64BIT) 5.12.10232 from registry keys under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
and we detected ZOOM 5.6.5 (823) from registry keys under HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall or HKEY_USERS\S-xxx\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall. You may try to find Zoom 5.6.5 under those registry keys.