Deny access to run certain installed software for users

Question

I have a list of installed software, obtained from WMI class select * from Win32_Product.
I'd like to deny execution rights for some users on certain software like so:

1. find the path to installed software
2. recursively remove execution rights

I find the path to installed software from Win32_Product InstallLocation column. But the PROBLEM is that not all rows in Win32_Product have a value for InstallLocation. What can I do to overcome this? Is there somewhere in registry where I can find this path?

Answer 1

In general, no. The extreme edge case is a Firefox installation on an USB disk. It will leave no trace in the registry or Win32_Product InstallLocation.

The root cause is that Win32_Product InstallLocation has no location when the path is not in the registry. They're essentially 2 views on the same data.

There's also the specialized problem that a certain product might not even need execution rights. For instance, if an application is written in Perl, the installed "executable" might be a .pl file. Yet the Win32 process created will the executable registered for the .pl extension, i.e. the Perl interpreter.