Installed Programs (Uninstall)
Programs installed for all users, 32-bit programs and per-user installs, with versions.
Use it to list the programs on a machine, when each was installed or updated, and where its installer ran from.
- SOFTWARE
- System Information
What It Is
The Uninstall key is where Windows lists the programs installed on the machine, so Add or Remove Programs can show them, with the name, version and often the install date and installer source of each. Its entries say what was installed and when, and InstallSource can show the installer ran from an odd place such as Downloads. Portable tools that are never installed do not appear. It lives in SOFTWARE, with a WOW6432Node copy for 32-bit programs.
What It Proves
A program with that name and version was installed, and the subkey last write time dates its install or latest update. InstallSource, when set, shows where the installer ran from, such as Downloads.
What It Does Not Prove
Portable tools that are never installed do not appear, and uninstalling removes the subkey. InstallDate is a date with no time, and some installers leave it out.
Where It Lives
Installed Programs (Uninstall) lives in the SOFTWARE hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SOFTWARE\C:\What It Looks Like
These are four values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| This MSI product was installed or updated at 15 Oct 2026 16:21 UTC, seven minutes before the stick connected. Read its DisplayName and InstallSource. |
| The product is 7-Zip, an archiver that can also encrypt. ArcHistory under Software\ |
| The installer ran from alice's Downloads, not from a software deployment share. Her browser history should show where she got it. |
| InstallDate gives only the day, 15 Oct 2026, with no time. Take the time from the subkey last write instead. |
How to Read It
Check this key, the same path under SOFTWARE\WOW6432Node for 32-bit programs, and Uninstall in each user's NTUSER.DAT. Read DisplayName, DisplayVersion, Publisher, InstallDate (written YYYYMMDD), InstallLocation and InstallSource. Sort the subkeys by last write time for the newest installs, then look for remote access, transfer, encryption and wiping tools.
- When Windows Writes It
- When a program is installed, updated, repaired or removed.
- Which Windows Versions
- Windows XP to 11 keep it, with a WOW6432Node copy on 64-bit Windows.
- Tools That Parse It
- Registry Explorer, RECmd, RegRipper (uninstall)
Hunt It
The list of installed programs sits in this key, so parse SOFTWARE, or read it live with Velociraptor. The Application log records each Windows Installer install and removal in events 11707 and 11724.
Shows installer runs inside retention. It does not read the Uninstall keys, which keep programs installed long before.
// Installers started on the device: where new programs usually come fromDeviceProcessEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Installed Programs (Uninstall) shows.
- AmcacheCatches portable tools that were never installed, with their SHA-1s.
- Windows Installer Events 11707 and 11724 in the Application LogNot in the RegistryRecords each Windows Installer install and removal with a time, even after the subkey is gone.
- Program Folder Creation Times in Program FilesNot in the RegistryDates the install to the second, where InstallDate gives only a day.
Sources
The facts on this page come from these public pages, which say more on each point.