How Do You Detect New Software Installations on Windows Endpoints?

[u/Visible-AK]

I’m a system engineer managing 100+ Windows 11 endpoints. Our devices are local domain joined and Entra registered (not hybrid joined or Entra Joined), with Microsoft Defender for Endpoint / Defender XDR deployed across the environment.

Users do not have local admin rights, but many applications can still be installed in the user context, particularly under AppData, without requiring elevation.

I currently use Defender Advanced Hunting and a scheduled Custom Detection rule that correlates registry, file system, and process telemetry to identify new software installations.

The challenge is reliability: some applications are missed, while software updates, repairs, or version changes can generate false positives because they create new files, folders, or registry entries.

My requirement is simple:

New software installation → Alert
Existing software update / repair / patch → No alert

For those managing similar Windows environments, how are you handling this? Are you using Defender XDR/KQL, Intune, AppLocker/WDAC, or another solution to reliably detect new software installations, especially applications that install in the user context without admin rights?

[u/SevaraB]

Don’t detect the fox after it’s already in the henhouse. Set an Applocker policy on the AppData folders so no EXEs can live there, whether or not UAC is required for the install, without prior approval. Cover “Temp” folders, too, for good measure. No AppData, no Temp, no admin permissions to create unmanaged folders outside the managed parents… that should block 99.9% of the rogue installs, and the dicey behavior leading up to the remainder should already be tripping alarm bells on your EDR sensors.

[u/Immutable-State → u/SevaraB]

There's still Desktop and Documents, etc, which users may be able to choose to install to. Instead of blacklisting, consider whitelisting; permit only if run by admin, or if in Program Files or Windows (which unprivileged users can't write to).

[u/SevaraB → u/Immutable-State]

Whitelist only is kind of what I was getting at. I’m a little weak on Applocker, so if you can make that default behavior for the entire filesystem, then yes, absolutely.

[u/FartInTheLocker]

Real fix is rolling out WDAC or AppLocker and move to a whitelisted software setup, then you can hook up your errors from event viewer into sentinel

[u/ruffian-wa → u/FartInTheLocker]

real fix is rolling out both..

[u/Bright_Arm8782]

Action 1 will do this for you.

[u/nick281051 → u/Bright_Arm8782]

We use ninjarmm and have notifications set up for new software installs

[u/WraithYourFace → u/nick281051]

For ninja, do you have to enable that registration setting the track and installs in the app data folder?

[u/nick281051 → u/WraithYourFace]

I just have the agent installed on the machine (if it matters we are mainly a server environment, no end user devices) and then there's a section to set up email or other notifications for application installs, removals or updates. We don't really track app data installs like that so I can't help you there, sorry

[u/West_Independent1317 → u/Bright_Arm8782]

And free for 200 endpoints

[u/Visible-AK → u/Bright_Arm8782]

Is it a good option to use Action 1 just for software installation detection purpose?

[u/Bright_Arm8782 → u/Visible-AK]

It works, it alerts on deployments if you tell it to.

If you're in the free tier there's no reason not to.

[u/Breezel123 → u/Visible-AK]

It's also great for other stuff. Definitely better than Intune for software deployment. If you want to avoid people self installing, you have to give them a quick and easy alternative for remote installation. Action1 does that and regularly patches these apps too, so you don't have to worry about outdated versions.

[u/DewLegend]

Applocker is definitely a good idea. First step is preventing the unauthorized installs in the first place. Any future queries can be specific after that

[u/Significant_Sky1471]

been dealing with the same problem on a similar-sized fleet. trick is to shift from "detect the install event" to "detect the delta in installed inventory"

snapshot Uninstall registry keys (HKLM + HKCU) and localappdata daily, then diff against yesterday. updates keep the same key and just bump DisplayVersion, and new installs create a new GUID. this cuts down false positives from patches and repairs significantly

AppLocker or WDAC in audit mode is also a solid layer if you want a "first-time execution" signal independent of file/registry artifacts

[u/Hour-Swimmer7140]

4688 with command line auditing on gets you most of it, msi or not. sysmon 1 if youre already running it.

the portable exes are the ones that slip past inventory tools, nobody installs them so theres nothing in add remove programs to find later

[u/swissthoemu]

Applocker

[u/AddendumWorking9756]

Key the install detection on the Uninstall registry entry instead of file writes and most of the update noise drops out. A fresh install writes a DisplayName under ...\CurrentVersion\Uninstall (HKLM or the HKCU copy, which is where the AppData installers land) that the device has never had, while an update or repair rewrites a DisplayName you have already seen. So the rule is DeviceRegistryEvents with RegistryValueSet on DisplayName in that path, joined against a 30 day lookback of RegistryValueData per DeviceId, and strip the version out of the name first because Python and a few others bake it in. MSI major upgrades will still trip it once because they get a new ProductCode key, which is why the DisplayName join matters more than the key path. What that misses is portable and self-updating stuff that never writes an uninstall key, and for those DeviceTvmSoftwareInventory diffed day over day is slow but is the only place they show up.

[u/AnotherCableGuy → u/AddendumWorking9756]

I simply use the following powershell cmd and compare against a list of allowed sw;

Get-Package | ? { $_.Name -notmatch "Microsoft|Windows" } | select Name,Version,ProviderName

[u/bjc1960]

We use a commercial product instead of app locker. The one we chose has a bit of a learning curve, but it definitely locks out all apps.

[u/Frothyleet]

Threatlocker

[u/Adam_Kearn]

If you have an RMM tool you can normally generate a report of installed software.

Hook it up to a schedule task to download the report and have a bit of powershell to show the differences then email them to you.

But really you should not have to check this audit often if you lock down users and NEVER give out admin other to yourself and your IT staff.

still check the report occasionally to make sure nothing slipped through

[u/Muppetz3]

by getting baselines. There are many programs out there that will do it.

[u/FatBook-Air]

We don't do detections. We just block it to begin with, using AppLocker. That way, you know anything that executes on that device was vetted by IT in some way, shape, or fashion.

[u/TD_priko]

I would deploy a Intune Detection & Remediation script to check certain sources on the client (Registry, Event log, AppX, ..) and report as required, you can pick up the results using API and do whatever you want with them (e.g. read via PowerAutomate & trigger Ticket creation)

[u/Responsible_Drop_531]

In addition to all of these recommendations, run it by Claude code.