Forum Discussion
Custom Query for finding VMs without software installed
MicrosoftHi awood86 ,
There are different ways to go about it, one way is to create a set of all installed software items (within a given time range) and check if a value is in that set.
Note that if it's not in the set, it only means it wasn't installed in that time range, but it's still possible it's been installed earlier... so think well what's the time range you want to use.
ConfigurationData
| where TimeGenerated > ago(3d)
| where ConfigDataType == "Software"
| summarize all_sotftware_installed = make_set(SoftwareName) by Computer
| where set_has_element(all_sotftware_installed, "Microsoft 365 - en-us") == 0 // 0 means it's not in the set, 1 means it is
HTH,
Noa
Noa Kuperberg thank you so much! This gives me exactly what I needed.
Just out of interest what other way would you suggest about getting this data?
- Noa Kuperberg
awood86 really depends on your needs and your setup. The suggested query is probably the most straightforward. If you're using the Update Management solution, you can also check out the Update table for installed or needed updates.