[Improvement idea] setuphelpers_windows function installed_users_softwares()

[Welsh]

Hello everyone,

First of all, congratulations on the product, which is truly excellent and life-changing.
I wanted to give you a little feedback and a request for improvement of setuphelpers_windows.
A brief context:
It has happened several times (with or without wapt) that users did not have administrator rights to perform a software update.
And there are sneaky software programs like Firefox (maybe Thunderbird too?), Mattermost and others I can't remember, which don't block and continue to install directly into APPDATA\local.
With older Microsoft operating systems, the installation stopped there, but since Windows 10 (I think) the program appears in the "Add/Remove Programs" panel.
But the installed_softwares function doesn't retrieve it because it looks in the registry, the node

Code: Select all

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Uninstall

However, these malicious programs are "registered" directly in the node

Code: Select all

HKEY_CURRENT_USER\SOFTWARE\.... et donc pour chacun des users HKEY_USERS\monssid\SOFTWARE\...

Therefore, would it be wise to create a variation of the installed_softwares() function as installed_users_softwares() or to integrate the scanning of HKEY_USERS?
This would help us to have/restore an even cleaner park
Thank you in advance for your feedback.

Good day.

Baptiste

[dcardon]

Hi Baptiste,

thanks for the enthusiastic feedback.

Regarding installations in user directories, it's indeed a real pain! The most drastic option is to enable srp/applocker to block executable files, but that can be complicated in a school environment (complicated, but incredibly effective).

As for user hives, the problem is that they're only loaded when a user logs in. We can mount them on the fly as a localsystem account, but it can take some time if there are many user profiles on the machine. We do this for our domain migration/merge services, so it's possible, but I don't know if it's really the best choice for your needs.

Another option is to add a package with a session_setup() and an audit() function that analyzes the current session of the logged-in user and uninstalls the software in question.

The `session_setup()` function runs when the user's session starts, and the `audit()` function (a WAPT Enterprise feature) can be run regularly (with server-side reporting). `session_setup()` performs an initial cleanup, and the audit ensures its continued effectiveness.

A compromise for the `installed_users_softwares()` function could be to restrict its use to the `session_setup` or audit context if a user is already logged in.

Sincerely,

Denis

[Welsh]

Hi Denis,
thanks for your reply.
I do manage that with `session_setup()`, I just thought it was a shame not to have this clean functionality directly during package installation.
It was a suggestion, just in case , but I imagine it could be complicated to implement.
Anyway, thanks for your consideration
. Have a good day.
Baptiste