Have you tried any of those 'snapshot' tools or Process Explorer to see what it could be changing on a file/registry side?
You could also do that one as a Package and then do the whole thing as a Task Sequence but I totally get wanting to stick with the App Model. *-----------------------------------------------* *Adam Juelich* Pulaski Community School District <http://www.pulaskischools.org> Client Management Specialist 920-822-6075 On Mon, Mar 30, 2015 at 2:34 PM, Beardsley, James < [email protected]> wrote: > I’m creating a deployment type for an application I’m working on and its > not the main app install, it’s a small script compiled to an .exe (written > by the vendor) that needs to be run beforehand. The script just deletes > some file associations (which ones, I’m not clear on) and I’m trying to > figure out what I can use for the detection method. As far as I can tell, > it doesn’t create any files, it doesn’t create anything in Add/Remove, and > without knowing which files associations it’s modifying, I have nothing to > detect. I’ve reached out to the vendor so waiting on a response from them. > Assuming they can’t help, any ideas? I thought about using a Powershell > script to read from the event logs (Applocker execution events) to see if > its been run. I also thought about wrapping it in a script that writes > something to the registry which can be used for detection. Before I went > down that road, figured I’d see if there were any other ideas. > > > > Thanks! > > > > *James Beardsley |* Firm Technology Group > > Dixon Hughes Goodman LLP > > > > [image: cid:8644FC49-D5C9-45AE-B387-04FAFC0CC7A5] <http://www.dhgllp.com/> > > > ------------------------------ > > *Confidentiality Notice:* This e-mail is intended only for the addressee > named above. It contains information that is privileged, confidential or > otherwise protected from use and disclosure. If you are not the intended > recipient, you are hereby notified that any review, disclosure, copying, or > dissemination of this transmission, or taking of any action in reliance on > its contents, or other use is strictly prohibited. If you have received > this transmission in error, please reply to the sender listed above > immediately and permanently delete this message from your inbox. Thank you > for your cooperation. > >
