Software inventory, missing software

[fredemme]

Hello,

I would like to see applications installed in %appdata%, such as Signal or WhatsApp Web, in the software inventory.
Is this possible?

Thank you
, Frédérique

[sfonteneau]

Hello

, you can use this package: https://wapt.tranquil.it/store/fr/tis-a ... -softwares

This will display the software in the audit data.

There's also this package for apps:

https://wapt.tranquil.it/store/fr/detai ... _PROD.wapt

[dcardon]

Hello Frédérique,

and once you've completed your audit and standardized the installations, the ultimate measure from a security and controlled asset management perspective is to configure AppLocker/SRP to block executable files in the %appdata% directory. This is very effective in preventing all kinds of malware.

Best regards,

Denis

[fredemme]

Thank you.

I downloaded the TIS and pushed the package to my computer. Unfortunately, I can't find Signal and WhatsApp Web in the software inventory, even though they appear in Add/Remove Programs

. We'll implement AppLocker (via SentinelOne).

[sfonteneau]

in the software inventory while they appear in Add/Remove Programs

No, in this case it will appear in the audit data tab.
Have you looked in the audit data tab?

[fredemme]

oh yes indeed

{"id":524,"host":"4c4c4544-0046-5010-8036-c8c04f585633","value_id":2,"value_date":"2025-03-19T15:44:19.951259","value_section":"audit-user-install d-softwares","value_key":"audit-user-installed-softwares","value":{"C:\\Users\\14166":[{"key":"7d96caee-06e6-597c-9f2f-c7bb2e0948b4","name":"Signal 7.46.1","version":"7.46.1","publisher":"Signal Messenger, LLC","install_date":"","install_location":"","system_component":0,"uninstall_string":"\"C:\\Users\\14166\\AppData\\Local\\Programs\\signal-desktop\\Uninstall Signal.exe\" /currentuser"},{"key":"ab389edf02bdd1062629fbc418c7983f","name":"WhatsApp Web","version":"1.0","publisher":"Google\\Chrome","install_date":"20240926","install_location":"","system_component":0,"uninstall_string":"\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" --profile-directory=Default --uninstall-app-id=hnpfjngllnobngcgfapefoaidbinmjnm"}]},"expiration_date":null,"created_on":"2025-03-19T15:44:21.294252","created_by":null,"computer_fqdn":"delpl-202400010.ad.sdis91.fr","description":"GSIC FIXE Fred Emme","server_name":"wapt.intra.sdis91.fr","_section":"audit-user-installed-softwares","_key":"audit-user-installed-softwares"}

I now need to extract this data with a report, I think.
Thank you.

[dcardon]

Hello Frédérique,

...while they appear in Add/Remove Programs

The Add/Remove Programs interface in Windows aggregates system-wide software and software installed within the user session. If this content is displayed, the information shown in WAPT would depend on the currently logged-in user, which could be misleading. It's important to differentiate between the two (and Microsoft doesn't help by mixing everything together...).

And well, as I said earlier, the best thing to do is to block the installation in %appdata%

Denis