如何找到已安装的MSI设置的产品GUID？

Question

我需要找到产品GUID对于安装MSI文件,以进行维护,如补丁,卸载,也为审计目的.

Answer 1

精简版

以下信息随着时间的推移而大大增加,可能会变得有点过于复杂.如何快速获得产品代码？(四种方法):

1.使用Powershell"one-liner"

向下滚动屏幕截图并逐步显示.免责声明也低于 - 轻微或中等风险取决于您的要求.对我来说工作正常.通常应该可以取消由此选项触发的任何自我修复.触发的包完整性检查确实添加了一些事件日志"噪音".注意!Use the Powershell "one-liner" 是在IdentifyingNumber(WMI特点).

get-wmiobject Win32_Product | Format-Table IdentifyingNumber, Name, LocalPackage -AutoSize

Powershell的快速​​启动:按住Windows key,点击R,输入"powershell"并按下Enter

2.使用VBScript

Described below under "Alternative Tools" (section 3). This option may be safer than Powershell for reasons explained in detail below. In essence it is (much) faster and not capable of triggering MSI self-repair since it does not go through WMI (it accesses the MSI COM API directly - at blistering speed). However, it is more involved than the Powershell option (several lines of code).

3. Registry Lookup

Some swear by looking things up in the registry. Not my recommended approach - I like going through proper APIs (or in other words: OS function calls). There are always weird exceptions accounted for only by the internals of the API-implementation:

• ProductCode
• Use VBScript
• Registry Lookup

4. Original MSI File/WiX Source

You can find the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall in the HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall of any MSI file (and any other property as well). However, the GUID could conceivably (rarely) be overridden by a transform applied at install time and hence not match the GUID the product is registered under (approach 1 and 2 above will report the real product code - that is registered with Windows - in such rare scenarios).

You need a tool to view MSI files. See towards the bottom of the following answer for a list of free tools you can download (or see quick option below): How can I compare the content of two (or more) MSI files?

UPDATE: For convenience and need for speed :-), download SuperOrca without delay and fuss from this direct-download hotlink - the tool is good enough to get the job done - install, open MSI and go straight to the Property table and find the HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall row (please always virus check a direct-download hotlink - obviously - you can use virustotal.com to do so - online scan utilizing dozens of anti-virus and malware suites to scan what you upload).

And below you will find the original answer which "organically grew" into a lot of detail.

Maybe see "Uninstall MSI Packages" section below if this is the task you need to perform.

检索产品代码

更新:如果您还需要升级代码,请检查以下答案: 如何找到已安装的MSI文件的升级代码？(在表输出中检索关联的产品代码,升级代码和产品名称 - 类似于下面的那个).

• 无法使用PowerShell？请参阅下面的"替代工具"部分.
• 想要卸载？请参阅下面的"卸载MSI包"部分.

Fire up Powershell (hold down the Windows key, tap R, release the Windows key, type in "powershell" and press OK) and run the command below to get a list of installed MSI package product codes along with the local cache package path and the product name (maximize the PowerShell window to avoid truncated names).

Before running this command line, please read the disclaimer below (nothing dangerous, just some potential nuisances). Section 3 under "Alternative Tools" shows an alternative non-WMI way to get the same information using VBScript. If you are trying to uninstall a package there is a section below with some sample msiexec.exe command lines:

get-wmiobject Win32_Product | Format-Table IdentifyingNumber, Name, LocalPackage -AutoSize

该输出应该类似于此:

注意!出于某种奇怪的原因,"ProductCode "在WMI中称为"IdentifyingNumber".换句话说 - 在上面的图片中,IdentifyingNumber是 ProductCode.

如果需要针对大量远程计算机远程运行此查询,请参阅下面的" 从远程计算机检索产品代码 "部分.

DISCLAIMER (important, please read before running the command!): Due to strange Microsoft design, any WMI call to Original MSI File / WiX Source (like the PowerShell command below) will trigger a validation of the package estate. Besides being quite slow, this can in rare cases trigger an MSI self-repair. This can be a small package or something huge - like Visual Studio. In most cases this does not happen - but there is a risk. Don't run this command right before an important meeting - it is not ever dangerous (it is read-only), but it might lead to a long repair in very rare cases (I think you can cancel the self-repair as well - unless actively prevented by the package in question, but it will restart if you call Win32_Product again and this will persist until you let the self-repair finish - sometimes it might continue even if you do let it finish: How can I determine what causes repeated Windows Installer self-repair?).

And just for the record: some people report their event logs filling up with MsiInstaller EventID 1035 entries (see code chief's answer) - apparently caused by WMI queries to the Win32_Product class (personally I have never seen this). This is not directly related to the Powershell command suggested above, it is in context of general use of the WIM class Win32_Product.

You can also get the output in list form (instead of table):

get-wmiobject -class Win32_Product

In this case the output is similar to this:

Retrieve Product Codes From A Remote Computer

In theory you should just be able to specify a remote computer name as part of the command itself. Here is the same command as above set up to run on the machine "RemoteMachine" (Product Code section added):

get-wmiobject Win32_Product -ComputerName RemoteMachine | Format-Table IdentifyingNumber, Name, LocalPackage -AutoSize

This might work if you are running with domain admin rights on a proper domain. In a workgroup environment (small office/home network), you probably have to add user credentials directly to the WMI calls to make it work.

Additionally, remote connections in WMI are affected by (at least) the Windows Firewall, DCOM settings, and User Account Control (UAC) (plus any additional non-Microsoft factors - for instance real firewalls, third party software firewalls, security software of various kinds, etc...). Whether it will work or not depends on your exact setup.

• Setting up a Remote WMI Connection
• Connecting to WMI Remotely with PowerShell

UPDATE: An extensive section on remote WMI running can be found in this answer: How can I find the Upgrade Code for an installed MSI file?. It appears a firewall rule and suppression of the UAC prompt via a registry tweak can make things work in a workgroup network environment. Not recommended changes security-wise, but it worked for me.

Alternative Tools

PowerShell requires the .NET framework to be installed (currently in version 3.5.1 it seems? October, 2017). The actual PowerShell application itself can also be missing from the machine even if .NET is installed. Finally I believe PowerShell can be disabled or locked by various system policies and privileges.

If this is the case, you can try a few other ways to retrieve product codes. My preferred alternative is VBScript - it is fast and flexible (but can also be locked on certain machines, and scripting is always a little more involved than using tools).

1. Let's start with a built-in Windows WMI tool: Property table.

   • Launch ProductCode (Hold down the Windows key, tap R, release the Windows key, type in "wbemtest.exe" and press OK).
   • Click connect and then OK (namespace defaults to root\cimv2), and click "connect" again.
   • Click "Query" and type in this WQL command (SQL flavor): Orca-x86_en-us.msi and click "Use" (or equivalent - the tool will be localized).
   • Sample output screenshot (truncated). Not the nicest formatting, but you can get the data you need. IdentifyingNumber is the MSI product code:

2. Next, you can try a custom, more full featured WMI tool such as Program Files (x86)

   • This is not included in Windows. It is a very good tool, however. Recommended.
   • Check it out at: https://github.com/vinaypamnani/wmie2/releases
   • Launch the tool, click Connect, double click ROOT\CIMV2
   • From the "Query tab", type in the following query Win32_Product and press Execute.
   • Screenshot skipped, the application requires too much screen real estate.

3. Finally you can try a VBScript to access information via the MSI automation interface (core feature of Windows - it is unrelated to WMI).

   • Copy the below script and paste into a*.vbs file on your desktop, and try to run it by double clicking. Your desktop must be writable for you, or you can use any other writable location.
   • This is not a great VBScript. Terseness has been preferred over error handling and completeness, but it should do the job with minimum complexity.
   • The output file is created in the folder where you run the script from (folder must be writable). The output file is called -ComputerName RemoteMachine.
   • Double click the file to open in a spreadsheet application, select comma as delimiter on import - OR - just open the file in Notepad or any text viewer.
   • Opening in a spreadsheet will allow advanced sorting features.
   • This script can easily be adapted to show a significant amount of further details about the MSI installation. A demonstration of this can be found here: how to find out which products are installed - newer product are already installed MSI windows.

' Retrieve all ProductCodes (with ProductName and ProductVersion)
Set fso = CreateObject("Scripting.FileSystemObject")
Set output = fso.CreateTextFile("msiinfo.csv", True, True)
Set installer = CreateObject("WindowsInstaller.Installer")

On Error Resume Next ' we ignore all errors

For Each product In installer.ProductsEx("", "", 7)
   productcode = product.ProductCode
   name = product.InstallProperty("ProductName")
   version=product.InstallProperty("VersionString")
   output.writeline (productcode & ", " & name & ", " & version)
Next

output.Close

I can't think of any further general purpose options to retrieve product codes at the moment, please add if you know of any. Just edit inline rather than adding too many comments please.

You can certainly access this information from within your application by calling the MSI automation interface (COM based) OR the C++ MSI installer functions (Win32 API). Or even use WMI queries from within your application like you do in the samples above using wbemtest.exe, wbemtest.exe or SELECT IdentifyingNumber,Name,Version FROM Win32_Product.

Uninstall MSI Packages

If what you want to do is to uninstall the MSI package you found the product code for, you can do this as follows using an elevated command prompt (search for cmd.exe, right click and run as admin):

Option 1: Basic, interactive uninstall without logging (quick and easy):

msiexec.exe /x {00000000-0000-0000-0000-00000000000C}

Quick Parameter Explanation:

/X = run uninstall sequence
{00000000-0000-0000-0000-00000000000C} = product code for product to uninstall

You can also enable (verbose) logging and run in silent mode if you want to, leading us to option 2:

Option 2: Silent uninstall with verbose logging (better for batch files):

msiexec.exe /x {00000000-0000-0000-0000-00000000000C} /QN /L*V "C:\My.log" REBOOT=ReallySuppress

Quick Parameter Explanation:

/X = run uninstall sequence
{00000000-0000-0000-0000-00000000000C} = product code for product to uninstall
/QN = run completely silently
/L*V "C:\My.log"= verbose logging at specified path
REBOOT=ReallySuppress = avoid unexpected, sudden reboot

There is a comprehensive reference for MSI uninstall here (various different ways to uninstall MSI packages): Uninstalling an MSI file from the command line without using msiexec. There is a plethora of different ways to uninstall.

If you are writing a batch file, please have a look at section 3 in the above, linked answer for a few common and standard uninstall command line variants.

And a quick link to msiexec.exe (command line options) (overview of the command line for msiexec.exe from MSDN). And the Technet version as well.

Retrieving other MSI Properties/Information (f.ex Upgrade Code)

UPDATE: please find a new answer on how to find the upgrade code for installed packages instead of manually looking up the code in MSI files. For installed packages this is much more reliable. If the package is not installed, you still need to look in the MSI file (or the source file used to compile the MSI) to find the upgrade code. Leaving in older section below:

If you want to get the UpgradeCode or other MSI properties, you can open the cached installation MSI for the product from the location specified by "LocalPackage" in the image show above (something like: WMIExplorer.exe - it is a hex file name, unique on each system). Then you look in the "Property table" for UpgradeCode (it is possible for the UpgradeCode to be redefined in a transform - to be sure you get the right value you need to retrieve the code programatically from the system - I will provide a script for this shortly. However, the UpgradeCode found in the cached MSI is generally correct).

To open the cached MSI files, use Orca or another packaging tool. Here is a discussion of different tools (any of them will do): What installation product to use? InstallShield, WiX, Wise, Advanced Installer, etc. If you don't have such a tool installed, your fastest bet might be to try Super Orca (it is simple to use, but not extensively tested by me).

UPDATE: here is a new answer with information on various free products you can use to view MSI files: How can I compare the content of two (or more) MSI files?

If you have Visual Studio installed, try searching for SELECT IdentifyingNumber,Name,Version FROM Win32_Product - under msiinfo.csv - and install it (this is Microsoft's own, official MSI viewer and editor). Then find Orca in the start menu. Go time in no time :-). Technically Orca is installed as part of Windows SDK (not Visual Studio), but Windows SDK is bundled with the Visual Studio install. If you don't have Visual Studio installed, perhaps you know someone who does? Just have them search for this MSI and send you (it is a tiny half mb file) - should take them seconds. UPDATE: you need several CAB files as well as the MSI - these are found in the same folder where the MSI is found. If not, you can always download the Windows SDK (it is free, but it is big - and everything you install will slow down your PC). I am not sure which part of the SDK installs the Orca MSI. If you do, please just edit and add details here.

• Here is a more comprehensive article on the issue of MSI uninstall: Uninstalling an MSI file from the command line without using msiexec
• Here is a similar article with a few further options for retrieving MSI information using the registry or the cached msi: Find GUID From MSI File?

Similar topics (for reference and easy access - I should clean this list up):

• How to find the UpgradeCode and ProductCode of an installed application in Windows 7
• `Win32_Product` 真的不应该被查询，因为它不是一个只读操作。显然，它对每个包运行一致性检查，如果发现任何安装，则继续进行修复安装。请参阅 https://sdmsoftware.com/group-policy-blog/wmi/why-win32_product-is-bad-news/ 和 http://support.microsoft.com/kb/974524 (2认同)