Installed software tracking
Applies to client 2.0.x and later. For tenant admins, approvers, auditors.
AdminExplorer knows who elevated what and why. Installed software tracking adds what was installed, updated or removed, and links changes made during an AdminExplorer elevation to that elevation. Both tiers; on by default (Settings, Installed software tracking).
What is collected
Section titled “What is collected”One entry per Add/Remove Programs entry:
- machine-wide software, 64-bit and 32-bit;
- per-user software of users whose profile is loaded on the device.
For each entry: name, version, publisher, install date, scope (machine or user, with the user’s SID), architecture, the uninstall key name and the MSI product code. Entries without a display name are skipped. System components (entries hidden from Add/Remove Programs) and updates and patches are left out unless you turn them on. Text is cleaned of control and invisible characters and cut to sensible lengths.
A standard user can write anything into their own per-user list, so at most 500 entries per user are tracked and machine software always comes first.
When the device reports
Section titled “When the device reports”- The device watches the uninstall keys and reports each install, update or removal about 30 seconds after the change settles (at the latest 5 minutes after it started).
- A full inventory goes to the portal at start, every 24 hours, after changes, and with Sync now.
- The first inventory of a device is the baseline: it produces no change entries. Changing the system component or update filters also starts a new baseline, so a settings change never shows as installs or removals.
- A device that is offline keeps its changes in a protected local queue and sends them later. Each change is also written to the device’s Application log (event 1022), with or without a portal.
Where to see it
Section titled “Where to see it”- Software: every product with device counts per version, and the Changes feed with filters (change type, device, user, dates, and “installed with an AdminExplorer elevation only”).
- A device’s Software tab: its current inventory with search, and its change history.
- A change the device did not report itself but the portal found by comparing two inventories is marked “from snapshot”.
Elevation links and their strength
Section titled “Elevation links and their strength”A change is linked to an AdminExplorer elevation when it happened while that elevation ran or up to 2 minutes after it ended:
| Label | Meaning | Strength |
|---|---|---|
| Installed with elevation | The elevated program was the installer (an .msi, msiexec, or an .exe named like setup, install or uninst) |
Strong |
| During an elevation (may be unrelated) | A machine-wide change happened while an elevation of another program ran | Weak: Windows Update or another administrator may have made it |
Machine-wide changes can be linked to any elevation, because a standard user can change machine software only through one. Per-user changes are linked only to an installer elevation of the same user. The link names the elevation; it does not prove cause.
Audit readers (tenant admin, auditor) see the elevation’s user, reason and target from the audit record and a View in audit link; values that came only from the device are labelled “Reported by the device”. Approvers see only that a change was elevated.
Privacy and retention
Section titled “Privacy and retention”- Only the fields above are collected; no file contents, no usage data.
- Per-user entries carry the user’s SID.
- The current inventory of a device is deleted when the device is revoked. The change history is kept as evidence for 400 days, then deleted.
- Turning tracking off stops collection at once and deletes every current inventory of the tenant; the change history stays until it expires.
- Deleting the tenant deletes everything.
Related guides
Section titled “Related guides”AdminExplorer documentation, published by Circle of Bytes ApS. Customers sign in at portal.adminexplorer.circleofbytes.com.