HOW Add/Remove Programs Works

This is a fairly in depth look at how Add/Remove Programs (or Programs And Features as it is called in Windows 7) actually determines what software is installed on a PC and how it gathers information about each program, such as the publisher, install date, version, and how to uninstall it.

This information is useful for more than just curiosity/interest - it can be used to help clean up entries that should no longer be in there, to determine what software is installed on a remote computer, to troubleshoot uninstallation issues, and more. An example of this is a little program I wrote a while ago for getting a list of installed software on a remote computer, which you can download for free from my website here:http://www.cjwdev.co.uk/Software/FastSoftwareAudit/Info.html

NOTE: This information is not copied and pasted from some MS documentation or anything like that - I had to figure all of this out myself, so I can't guarantee that this is 100% correct, but from my research and testing and experience this is what I have found to be the case. Also like I said this is the logic that I built my Fast Software Audit application around and I have yet to come across a computer where that does not give an identical list of software to what you would see in Add/Remove Programs.

1.

How it doesn't work

First of all, the most common way of enumerating installed programs that many scripts/programs use is incorrect and will result in several programs missing from the list as well as several that would not normally appear in Add/Remove Programs. What these scripts do is just loop through the subkeys under the following registry key:

HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall

and gather information such as the program name and publisher from each key (as each subkey represents an installed program). There are several problems with this method, as we will see in the next part of this article where we will look at how Add/Remove Programs really uses this registry key.

 2.

The "Uninstall" Key

As mentioned in the previous step, Add/Remove Programs looks at each of the subkeys under this registry key:

HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall

However, it does not simply add the information from each subkey to its list of programs. It has strict criteria on which of these subkeys should just be ignored, which should be added to the list, and which should be looked up elsewhere in the registry.

First of all, these are all of the conditions that need to be true for Add/Remove Programs to add one of these subkeys to its list of programs, along with a description of how each value is used: 
1. There must be a value within named DisplayName and it must have text in it. This is the name that will appear in Add/Remove Programs for this program - and yes you can have a bit of fun and change the value of this to anything you like and it will show up as that in Add/Remove Programs, as I have done in the screenshot :) 
2. There must be a value within named UninstallString and it must have text in it. This is the command line that Add/Remove Programs will execute when you attempt to uninstall this program. Knowing this can come in handy in certain situations. 
3. There must NOT be a value named SystemComponent that is set to 1. If the SystemComponent value does not exist or if it does exist but is set to 0 then that is fine, but if it is set to 1 then this program will not be added to the list. This is usually only set on programs that have been installed via a Windows Installer package (MSI). See below. 
4. There must NOT be a value named WindowsInstaller that is set to 1. Again if it is set to 0 or if it does not exist then that is fine. 
5. The subkey must not have a name that starts with KB and is followed by 6 numbers, e.g KB879032. If it has this name format then it will be classed as a Windows Update and will be added to the list of programs that only appear when you click Show Installed Updates. 
6. There must NOT be a value named ParentKeyName, as this indicates that this is an update to an existing program (and the text within the ParentKeyName value will indicate which program it is an update for) 
7. There must NOT be a value named ReleaseType set to any of the following: Security Update, Update Rollup, Hotfix. As again this indicates that it is an update rather than a full program.

If the subkey meets all of the above criteria then it will be added to the Add/Remove Programs list. If not then it will either just be ignored, or it will be added to the list of programs that only appears when you click "Show Installed Updates", or in the case of subkeys where the WindowsInstaller value is set to 1 then it will be looked up elsewhere in the registry, as described in the next point.

For each subkey that did match the criteria, various values will be read from within it. such as the DisplayVersion value, which populates the Version label for this program in Add/Remove Programs, and the InstallDate value which populates the Installation Date column. There is also the DisplayIcon value, which provides the path to the file that contains the icon to be displayed for this program in Add/Remove Programs. Note that all values other than DisplayName and UninstallString are optional though, which is why in Add/Remove Programs you can see the version number and install date etc for some programs but not others, and why some programs have icons and others do not.

There are also other optional values such as NoModify, NoRepair and NoRemove which prevent you from being able to modify or remove the program through Add/Remove Programs if they are set to 1.

Before we move on to how it detects Windows Installer programs, I will briefly mention that on a 64 bit OS the same procedure outlined above is repeated for each subkey in the 32 bit version of the registry as well, so: 
HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall

 3.

Windows Installer (MSI)

As mentioned in the previous section, programs that were installed via an MSI installer file (aka Windows Installer package) will have an entry in the Uninstall key that will have the WindowsInstaller value set to 1. When Add/Remove Programs encounters one of these, it looks at the key name (which will be a long GUID) and switches some parts of it around, then looks for a key named with this re-ordered GUID in the following location:

HKLM\Software\Classes\Installer\Products

If it finds a key with that name in the location mentioned above then it pulls the program information from there rather than from the Uninstall key, using the "ProductName" value and "DisplayVersion" value etc from this location.

 4.

Per User Programs

You may have noticed in some installer wizards you get the option to install the program for "Everyone" or "Just Me" - if you opt for the Everyone option (which is usually the default) then the Add/Remove Programs entry will be created in the HKEY_LOCAL_MACHINE hive in the registry (see previous sections for details) but if you choose Just Me then they will be created in the HKEY_CURRENT_USER hive in the registry. This means that only that user that is installing the software will see the program in Add/Remove Programs. The exact locations in the HKCU registry hive for these entries are:

HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall 
and for Windows Installer products: 
HKCU\Software\Microsoft\Installer\Products

 5.

Fun

So now that you know all this, you can edit the relevant registry keys to really confuse anyone looking in Add/Remove Programs :D see attached image