Matthew Copple
asked on
Old app reinstalling from somewhere
We have a program that is being installed from an unknown source. It was one that we deployed long ago for firewall integration into Active Directory. I have removed the GPO's that were deploying the agent, but it is still being installed. this is happening on PC that are fresh installs as well. not just ones that previously had the program.
the program installs on a per user basis and runs under the user that is logged in and installed the app. I can't tell if there is something left in a GPO. a script that is installing it from somewhere.
How can I find out what and where this is being installed from?
the program installs on a per user basis and runs under the user that is logged in and installed the app. I can't tell if there is something left in a GPO. a script that is installing it from somewhere.
How can I find out what and where this is being installed from?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Here you are (link to Process Explorer)
https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer
https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer
ASKER
thanks John! Also nox can you tell me where the installation records are?
You need to find the App in Process Explorer (left side) and it will give you more information on the right side. From there you can find it or post it back here.
Double click on the entry right side and it will open the properties window
Double click on the entry right side and it will open the properties window
ASKER
i was able to find what user account installed the program using the application installation logs and followed the trail from there. Thank you both for your help. and process explorer has a ton of great information. thank you both!
You are very welcome. Happy to help
Use this process to identify which GPO is causing this
How to find Active Directory Group Policy (GPO) that applies a particular setting
https://www.experts-exchange.com/articles/29415/How-to-find-Active-Directory-Group-Policy-GPO-that-applies-a-particular-setting.html
How to find Active Directory Group Policy (GPO) that applies a particular setting
https://www.experts-exchange.com/articles/29415/How-to-find-Active-Directory-Group-Policy-GPO-that-applies-a-particular-setting.html
In Windows Logs - System
ASKER