NCPA-Windows-PowerShell different registry paths same output

Support forum for Nagios Core, Nagios Plugins, NCPA, NRPE, NSCA, NDOUtils and more. Engage with the community of users including those using the open source solutions.
Locked
oydhsa
Posts: 1
Joined: Wed Oct 20, 2021 3:12 am

NCPA-Windows-PowerShell different registry paths same output

Post by oydhsa »

Hi,

I will describe my problem in the following. First, we use NCPA as an Inventory tool. We have PowerShell scripts which collects informations about our servers and send it to a collector, where everything will be pushed to a database. This Information can be visited afterwards on a Website.

Now to my problem. I wrote a PS-script which collects all installed software on a Windows server.
Therefore, the script reads two registry keys for 32- and 64-Bit Software.

PowerShell script:

Code: Select all

Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*", "HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" | Select-Object ("DisplayName") | Where-Object DisplayName -ne $null
Output PowerShell:

Code: Select all

PS C:\Program Files (x86)\Nagios\NCPA\plugins> C:\Program Files (x86)\Nagios\NCPA\plugins\inv_software.ps1
DisplayName                                                                                                                                                                                                                                                                 
-----------                                                                                                                                                                                                                                                                 
7-Zip 19.00 (x64)                                                                                                                                                                                                                                                           
Mozilla Firefox 60.5.2 ESR (x64 en-US)                                                                                                                                                                                                                                       
VMware Tools                                                                                                                                                                                                                                                                 
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219                                                                                                                                                                                                                 
McAfee Agent                                                                                                                                                                                                                                                                 
TortoiseSVN 1.14.0.28885 (64 bit)                                                                                                                                                                                                                                           
McAfee Data Exchange Layer for MA                                                                                                                                                                                                                                           
Microsoft Visual C++ 2019 X64 Minimum Runtime - 14.27.29016                                                                                                                                                                                                                 
Microsoft Visual C++ 2019 X64 Additional Runtime - 14.27.29016                                                                                                                                                                                                               
McAfee Agent                                                                                                                                                                                                                                                                 
NCPA                                                                                                                                                                                                                                                                         
WinPcap 4.1.3                                                                                                                                                                                                                                                               
WinSCP 5.15.4                                                                                                                                                                                                                                                               
Wireshark 1.10.2 (64-bit)                                                                                                                                                                                                                                                   
Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.27.29016                                                                                                                                                                                                           
Microsoft Visual C++ 2015-2019 Redistributable (x64) - 14.27.29016                                                                                                                                                                                                           
Microsoft Visual C++ 2019 X86 Additional Runtime - 14.27.29016                                                                                                                                                                                                               
SolarWinds Event Log Forwarder for Windows                                                                                                                                                                                                                                   
McAfee VirusScan Enterprise                                                                                                                                                                                                                                                 
McAfee Data Exchange Layer for MA                                                                                                                                                                                                                                           
Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.27.29016
Now my Problem, if I execute the script with the NCPA I get the following output:
Output NCPA

Code: Select all

DisplayName                                                                                                           
-----------                                                                                                           
McAfee Agent                                                                                                           
NCPA                                                                                                                   
WinPcap 4.1.3                                                                                                         
WinSCP 5.15.4                                                                                                         
Wireshark 1.10.2 (64-bit)                                                                                             
Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.27.29016                                                     
Microsoft Visual C++ 2015-2019 Redistributable (x64) - 14.27.29016                                                     
Microsoft Visual C++ 2019 X86 Additional Runtime - 14.27.29016                                                         
SolarWinds Event Log Forwarder for Windows                                                                             
McAfee VirusScan Enterprise                                                                                           
McAfee Data Exchange Layer for MA                                                                                     
Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.27.29016                                                           
McAfee Agent                                                                                                           
NCPA                                                                                                                   
WinPcap 4.1.3                                                                                                         
WinSCP 5.15.4                                                                                                         
Wireshark 1.10.2 (64-bit)                                                                                             
Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.27.29016                                                     
Microsoft Visual C++ 2015-2019 Redistributable (x64) - 14.27.29016                                                     
Microsoft Visual C++ 2019 X86 Additional Runtime - 14.27.29016                                                         
SolarWinds Event Log Forwarder for Windows                                                                             
McAfee VirusScan Enterprise                                                                                           
McAfee Data Exchange Layer for MA                                                                                     
Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.27.29016
The NCPA output prints two times the same output from different registry paths also if I separate the query in two scripts and execute it after another I got the same output. The service account for NCPA client have the right permissions and can read the registry key.

Could someone please help me or do someone have the same experience?

Thanks in advance for your help.
z003w4ep
Posts: 14
Joined: Mon Dec 21, 2020 5:20 am

Re: NCPA-Windows-PowerShell different registry paths same ou

Post by z003w4ep »

Hi,
even though I did not find an answer for this behavior, I experience exactly the same. interesting thig is, that if I query only 32bit registry location in a script:

Code: Select all

Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"
NCPA always returns result from 64bit location "HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"
Why ???
Then I checked configuration in "C:\Program Files (x86)\Nagios\NCPA\etc\ncpa.cfg" and there it seems that NCPA calls 32 bit PowerShell.
Lastly, script functions exactly as expected when I run it with

Code: Select all

powershell -ExecutionPolicy Bypass -File <path_to_script>
(taken from ncpa.cfg). It'd be interesting to figure out this behavior.
Locked