Where does Add/Remove programs pull data for the “Installed On” column?

Question

I'm working on replicating the Windows 7/8 add remove programs applet with VBScript. I've gotten the script to include all the correct entries, but I have not been able to get it to include all the correct additional information Windows displays.

As an example: Windows displays the "Installed On" column with a date. In some cases it gets these from the relevant registry keys like:

HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\InstallDate
HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\InstallDate
HKUS\USER - SID\Software\Microsoft\Windows\CurrentVersion\Uninstall\InstallDate

Very few keys actually have the InstallDate value and Windows always get this column filled. I've managed to grab the majority of the missing dates from WMI:

 ("SELECT * FROM Win32_Product Where Description = " & "'" & strName & "'" & "")
for each objSoftware in colSoftware
Date = objSoftware.InstallDate

This only gives the dates from MSI installed applications.

I was thinking maybe Windows "guessed" the dates based on Program Files/ProgramData file dates, but I've tried manually changing them and it isn't reflected in Add/Remove. I'm trying to figure out how Windows pulls this date. I've noticed CCleaner can reproduce add/remove without error, so this information is available somewhere. I've just exhausted myself looking for it.

Answer 1

After a lot of messing around I determined that the Windows Add/Remove programs gets the "Installed On" date from at least three potential locations:

• For MSI installed applications it gets the date from WIN32_Product (By far the most common way)

• For non-MSI applications it looks in for the InstallDate value in the corresponding registry Uninstall Key (Example: HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome)

• For non-MSI applications that do not have the InstallDate, Windows looks to see the last date that the Uninstall key was written to and uses that date for "Installed On".

It was this last method that had me stumped for so long. This means that any time a non-MSI program that is missing the InstallDate value is updated, and the version number in the Uninstall Key is modified, you'll notice the "Installed On" date also updates and gives the appearance of that program have just been installed.

An Example: HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player Plugin

If your Flash Player Plugin install wasn't MSI based, then you can go into this key and modify the version from 11.8.800.94 to 11.8.800.93 and your Add/Remove will change the "Install On" date to today.