Where does Add/Remove programs pull data for the "Installed On" column?

Question

I'm working on replicating the Windows 7/8 add remove programs applet with VBScript. I've gotten the script to include all the correct entries, but I have not been able to get it to include all the correct additional information Windows displays.

As an example: Windows displays the "Installed On" column with a date. In some cases it gets these from the relevant registry keys like:

HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\InstallDate
HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\InstallDate
HKUS\USER - SID\Software\Microsoft\Windows\CurrentVersion\Uninstall\InstallDate

Very few keys actually have the InstallDate value and Windows always get this column filled. I've managed to grab the majority of the missing dates from WMI:

 ("SELECT * FROM Win32_Product Where Description = " & "'" & strName & "'" & "")
for each objSoftware in colSoftware
Date = objSoftware.InstallDate

This only gives the dates from MSI installed applications.

I was thinking maybe Windows "guessed" the dates based on Program Files/ProgramData file dates, but I've tried manually changing them and it isn't reflected in Add/Remove. I'm trying to figure out how Windows pulls this date. I've noticed CCleaner can reproduce add/remove without error, so this information is available somewhere. I've just exhausted myself looking for it.

Downtime

The process probably is slow, because selecting from Win32_Product not only lists the objects, but also (re-)validates them. A cleaner way is to read the information from the Uninstall keys in the registry. – Guillemot

My problem is that the most dates aren't in the uninstall keys, as I mentioned. Less than 10% of the entries on my system have the InstallDate as a value. Windows is getting this date from somewhere else and the script won't really be effective until I know where that location is. – Downtime

Answer 1

After a lot of messing around I determined that the Windows Add/Remove programs gets the "Installed On" date from at least three potential locations:

• For MSI installed applications it gets the date from WIN32_Product (By far the most common way)

• For non-MSI applications it looks in for the InstallDate value in the corresponding registry Uninstall Key (Example: HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome)

• For non-MSI applications that do not have the InstallDate, Windows looks to see the last date that the Uninstall key was written to and uses that date for "Installed On".

It was this last method that had me stumped for so long. This means that any time a non-MSI program that is missing the InstallDate value is updated, and the version number in the Uninstall Key is modified, you'll notice the "Installed On" date also updates and gives the appearance of that program have just been installed.

An Example: HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player Plugin

If your Flash Player Plugin install wasn't MSI based, then you can go into this key and modify the version from 11.8.800.94 to 11.8.800.93 and your Add/Remove will change the "Install On" date to today.

Downtime

Thanks. This had me stumped too as did Version. I am going to check version also in the WIN32_Product class - I will be there most likely. – Hairpin

perfect! Thanks a lot – Danish