Carbon Black Cloud: How to Retrieve Product Code from Windows MSI Using Powershell

[#1]

Environment

• Carbon Black Cloud Sensor: All Versions
• Microsoft Windows: All Supported Versions

Objective

Explain how to get the version-specific Product Code/GUID of a Microsoft Installer (MSI) file using Powershell

Resolution

By Path and Filename (single MSI)

1. Launch Powershell.exe
2. Locate desired MSI on device
3. Use Get-AppLockerFileInformation to retrieve desired information

   Get-AppLockerFileInformation -Path '<Path_To_MSI>\<installerName>.msi' | select -ExpandProperty Publisher | select ProductName,BinaryVersion,BinaryName

4. Product Code/GUID shows as BinaryName

 

By Directory (multiple MSIs)

1. Launch Powershell.exe
2. Locate desired MSI on device
3. Use Get-AppLockerFileInformation to retrieve desired information

   Get-AppLockerFileInformation -Directory '<Path_To_Folder_With_MSIs>' -FileType WindowsInstaller -Recurse | select -ExpandProperty Publisher | select ProductName,BinaryVersion,BinaryName

4. Product Code/GUID shows as BinaryName

Additional Notes

• Product Code/GUID is specific to build version and type of installer (32-bit v 64-bit)
• Examples
  • Single 3.7.0.1253 MSI located in C:\Users\TestUser\Desktop

    PS C:\Windows\system32> Get-AppLockerFileInformation -Path 'C:\Users\TestUser\Desktop\installer-3.7.0.1253-cbd-64.msi' | select -ExpandProperty Publisher | select ProductName,BinaryVersion,BinaryName

  • Multiple MSI files located in C:\Users\TestUser\Desktop

    PS C:\Windows\system32> Get-AppLockerFileInformation -Directory "C:\Users\TestUser\Desktop" -FileType WindowsInstaller -Recurse | select -ExpandProperty Publisher | select ProductName,BinaryVersion,BinaryName

Related Content

Get-AppLockerFileInformation (AppLocker)
Carbon Black Cloud: How to Retrieve a Sensor's GUID Using Powershell