Carbon Black Cloud: How to obtain Product Code from a Windows Installer (MSI) using Powershell

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Provide steps to get the Product Code from a Windows Installer or MSI file using Powershell

Environment

• Carbon Black Cloud Console: All Versions
• Carbon Black Cloud Sensor: All Versions
• Microsoft Windows: All Supported Versions
  • Powershell 3 or Higher

Resolution

1. Download Sensor installer (.msi file)
2. Launch Powershell
3. Use Get-ApplockerFileInformation to retrieve Product Code / BinaryName

   C:\> Get-AppLockerFileInformation -Path <path_to_msi>\<name_of_installer>.msi | select -ExpandProperty Publisher | select BinaryName, BinaryVersion, ProductName
   
   Example with 64-bit 3.7.0.1253 Sensor in C:\Users\Bob Smith\Desktop path
   C:\> Get-AppLockerFileInformation -Path 'C:\Users\Bob Smith\Desktop\installer_vista_win7_win8-64-3.7.0.1253.msi' | select -ExpandProperty Publisher | select BinaryName, BinaryVersion, ProductName
   

4. Product Code is returned in the BinaryName column

   BinaryName = version-specific GUID for Sensor, also known as Product Code
   BinaryVersion = version of installer
   ProductName = name of product associated with MSI

Additional Information

• Product Code can be used to search through the Registry for keys related to a given MSI version
• ProductName can be either
  • 2.0.x.x - 3.4.x.x Sensor will show CB DEFENSE SENSOR
  • 3.5.x.x and higher will show CARBON BLACK CLOUD SENSOR
• ProductName will also be different for 32-bit and 64-bit versions
  • 32-bit MSIs will show only the version-dependent name above
  • 64-bit MSIs will show the version-dependent name above along with "64-BIT" at the end
• Product Code will typically also be shown in the confer-temp.log (3.4.x.x and earlier) or cb-installer-<Version>.log (3.5.x.x and higher) files