Windows Registry Keys for Installed Software

Estimated reading: 2 minutes

Windows stores information about installed software in various registry keys, depending on whether the installation was system-wide, per-user, or for modern Microsoft Store (UWP) applications.

⚠️ Important Note on False Positives

If our tool detects software as installed even after it has been uninstalled, this may occur because some registry keys remain in the system.
This behavior is not an issue with our solution, but rather a characteristic of Windows or the application itself, which may leave residual entries after uninstallation.
There is no reliable way for our tool to detect this automatically, since Windows continues to report these entries as valid.

🔑 Main Registry Keys

🖥️ System-wide installations (all users)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

👤 Per-user installations

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

💾 32-bit programs on 64-bit systems

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\

🧩 MSI (Windows Installer) installations

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\<SID>\Products\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\<SID>\Components\

⚙️ Registered executable paths

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

🪟 UWP / Microsoft Store applications

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\

🧍 User-specific installations (by SID)

HKEY_USERS\<SID>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
HKEY_USERS\<SID>\SOFTWARE\Microsoft\Installer\Products\

🔁 Other relevant keys

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing

💻 Quick Queries

CMD

reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
reg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall" /s
reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s

PowerShell (classic software)

Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*
Get-ItemProperty HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*
Get-ItemProperty HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*

PowerShell (UWP applications)

Get-AppxPackage -AllUsers
Get-AppxPackage -AllUsers -Name *Calculator*

Globally installed programs (64-bit)

Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall* |
Select-Object DisplayName, DisplayVersion, Publisher, InstallDate

32-bit programs on a 64-bit system

Get-ItemProperty HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall* |
Select-Object DisplayName, DisplayVersion, Publisher, InstallDate

Programs installed for the current user only

Get-ItemProperty HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall* |
Select-Object DisplayName, DisplayVersion, Publisher, InstallDate