StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>User-specific settings should be written to HKCU\Software, machine-specific settings to HKLM\Software. Under these keys, structure <code>[software vendor name]\[application name]</code> (e.g. <code>HKLM\Software\Microsoft\Internet Explorer</code>) may be the most common, but that's just a convention, not a law of nature.</p> <p>Many (most?) applications also add their uninstall entries to <code>HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\[app name]</code>, but again, not all applications do this.</p> <p>These are the most important keys; however, contents of the registry do not have to represent the installed software exactly - maybe the application was installed once, but then was manually deleted, or maybe the uninstaller didn't remove all traces of it. If you want to be sure, check the filesystem to see if the application still exists where its registry entries say it is.</p> <p>Edit:</p> <p>If you're a member of the group Administrators, you can check the <code>HKEY_USERS</code> hive - each user's HKCU actually resides there (you'll need to know the user SID, or go through all of them).</p> <p>Note: As @Brian Ensink says, "installed" is a bit of a vague concept - are we trying to find what the user could run? Some software doesn't even write to the Registry at all: search for "portable apps" to see apps that have been specifically modified to run directly from media (CD/USB) and <em>not</em> to leave any traces on the computer. We may also have to scan the disks, and network disks, and anything the user downloads, and world-accessible Windows shares in the Internet (yes, such things exist legitimately - <code>\\live.sysinternals.com\tools</code> comes to mind). In this direction, there's no real limit of what the user can run, unless prevented by system policies.</p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload