Older versions of Teams are still appearing in the registry for other user profiles and are being fl

# Script that i used for Detection

# Function to check registry for Teams
function Check-TeamsRegistry {
    param (
        [string]$hiveName
    )

    $registryPaths = @(
        "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Teams"
    )

    foreach ($path in $registryPaths) {
        $fullPath = "Registry::HKEY_USERS\$hiveName\$path"
        if (Test-Path -Path $fullPath) {
            return $true
        }
    }

    return $false
}

# Get all user profiles except system profiles and Public/Default profiles
$userProfiles = Get-ChildItem 'C:\Users' | Where-Object { $_.PSIsContainer -and $_.Name -notlike "ITAdmin" -and $_.Name -notlike "zzzadmin" -and $_.Name -notlike "yyyadmin" -and $_.Name -notlike "xxxadmin" -and $_.Name -notlike "Public" -and $_.Name -notlike "Default*" }

$registryCheck = $false

foreach ($userProfile in $userProfiles) {
    $userName = $userProfile.Name
    $userProfilePath = $userProfile.FullName
    $ntUserDatPath = "$userProfilePath\NTUSER.DAT"

    if (Test-Path -Path $ntUserDatPath) {
        $hiveName = "TEMP_HIVE_$userName"
        
        try {
            # Load the user hive
            reg load "HKEY_USERS\$hiveName" "$ntUserDatPath" 2>&1 | Out-Null
            Write-Host "Loaded hive for $userName" -ForegroundColor Green
            
            if (Check-TeamsRegistry -hiveName $hiveName) {
                Write-Host "Teams installation found for user: $userName" -ForegroundColor Green
                $registryCheck = $true
            } else {
                Write-Host "No Teams installation found for user: $userName" -ForegroundColor Yellow
            }
        } catch {
            $errorMessage = $_.Exception.Message
            Write-Host "Failed to load hive for '$userName': $errorMessage" -ForegroundColor Red
        } finally {
            # Unload the user hive
            reg unload "HKEY_USERS\$hiveName" 2>&1 | Out-Null
            Write-Host "Unloaded hive for $userName`n" -ForegroundColor Green
        }
    } else {
        Write-Host "NTUSER.DAT not found for user: $userName`n" -ForegroundColor Red
    }
}

# Get Teams installation paths
$TeamsClassic = Get-ChildItem -Path "C:\Users\*\AppData\Local\Microsoft\Teams\current" -Filter "Teams.exe" -ErrorAction SilentlyContinue
$TeamsPersonal = Get-AppxPackage -Name MicrosoftTeams -AllUsers
$TeamsNew = Get-ChildItem "C:\Program Files\WindowsApps" -Filter "MSTeams_*"

# Check if Classic Teams is installed from registry
$ClassicTeamsRegistry = Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Teams" -ErrorAction SilentlyContinue

# Check if Classic Teams is installed from registry Current Users
$ClassicTeamsRegistry_CurrentUser = Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\Teams" -ErrorAction SilentlyContinue

# Check if Teams registry path exists for current user
$ClassicTeamsRegistry_CurrentUserExists = Test-Path -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\Teams"

# Output values of the registry checks
Write-Host "ClassicTeamsRegistry: $ClassicTeamsRegistry" -ForegroundColor Yellow
Write-Host "ClassicTeamsRegistry_CurrentUser: $ClassicTeamsRegistry_CurrentUser" -ForegroundColor Yellow
Write-Host "ClassicTeamsRegistry_CurrentUserExists: $ClassicTeamsRegistry_CurrentUserExists" -ForegroundColor Yellow

# Output values of the Teams installation paths
Write-Host "`nTeamsClassic: $TeamsClassic" -ForegroundColor Yellow
Write-Host "TeamsPersonal: $TeamsPersonal" -ForegroundColor Yellow
Write-Host "TeamsNew: $TeamsNew" -ForegroundColor Yellow

# Determine result based on detection checks
if (-not $TeamsClassic -and -not $TeamsPersonal -and $TeamsNew -and -not $registryCheck -and -not $ClassicTeamsRegistry -and -not $ClassicTeamsRegistry_CurrentUser -and -not $ClassicTeamsRegistry_CurrentUserExists) {
    Write-Host "`nClassic and Personal Teams Not Found, ClassicTeamsRegistry not found, or Teams registry path not found for current user.`nNew Teams Only!" -ForegroundColor Yellow
} else {
    Write-Host "`nClassic and Personal Teams Found!`nClassicTeamsRegistry found." -ForegroundColor Yellow
}

# Output success message
Write-Host "`nDetection script completed."

durairaj1991 

I'm having the same problem. I can't find Classic Teams installed on any of our endpoints, but Sentinel One keeps reporting CVEs from it on them all. Was there ever a fix?