Agent Client Collector reports Google Drive as installed software after the application has been removed (Chrome PWA registration in Windows Uninstall keys) - Support and Troubleshooting

Agent Client Collector reports Google Drive as installed software after the application has been removed (Chrome PWA registration in Windows Uninstall keys) Issue .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Agent Client Collector – Vulnerability (ACC-V) repeatedly reports "Google Drive 1.0" as installed software on a Windows endpoint after the application has been removed from the machine. The software installation record is re-created on every agent run, which generates recurring restricted-software / software-uninstall tickets even though the application does not appear in Programs and Features and the record has been deleted from the instance.

Symptoms .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } }

A cmdb_sam_sw_install record for Google Drive (display name starting with "Google") keeps re-appearing for the same Configuration Item after being deleted. The record's installed_on timestamp refreshes with each agent check-in / discovery run. Google Drive for Desktop is not listed in Programs and Features, and no Google Drive folder exists under C:\Program Files\Google\Chrome\Application . Automated restricted-software workflows repeatedly open uninstall tasks for software the endpoint owner believes is already removed. The ECC queue input payload for the affected CI contains an entry similar to: { "uniqueName": "Google Drive 1.0", "name": "Google Drive", "version": "1.0", "vendor": "Google\\Chrome", "uninstall_string": "\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" --profile-directory=\"Profile 8\" --uninstall-app-id=aghbiahbpaijigncei..." } Manual cleanup attempts (removing the Chrome icon, deleting the cmdb_sam_sw_install record, deleting registry keys) appear to succeed but the entry returns on the next agent run. Facts .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Product/service affected: Agent Client Collector Framework (ACC / ACC-V), Agent Client Collector Policy and Check Management. Endpoint OS: Microsoft Windows (domain-joined workstation/server). Third-party component involved: Google Chrome with an installed Progressive Web App (PWA) for Google Drive. The vendor value in the payload is Google\Chrome , not Google LLC — this is the first indicator that the detected object is a Chrome-registered web app rather than Google Drive for Desktop. The uninstall_string invokes chrome.exe --profile-directory="Profile " --uninstall-app-id= , i.e. a Chrome PWA uninstall command, not an MSI/EXE uninstaller. Registrations were found in the user hive ( HKEY_USERS\ \Software\Microsoft\Windows\CurrentVersion\Uninstall ), across multiple Chrome profiles (three profiles in the reported case), not in HKLM or Wow6432Node . A leftover PWA cache folder also existed at: C:\Users\ \AppData\Local\Google\Chrome\User Data\Profile \Web Applications\_crx_ ACC software inventory reads the standard Windows Uninstall registry keys, including per-user hives that are currently loaded. Deleting the cmdb_sam_sw_install record has no effect: that table is the result of what the agent reports, not the source of truth. The agent republishes its inventory on every run. Release .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } All

Cause .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Expected agent behavior against a live third-party registration — not a false positive in the agent.

Google Chrome writes an entry into the Windows Uninstall registry keys for every Progressive Web App a user installs, under the user's hive ( HKU\ \Software\Microsoft\Windows\CurrentVersion\Uninstall ), one entry per Chrome profile in which the app is installed. ACC software inventory reads those same Uninstall keys, so it correctly reports a live registration even though nothing appears in Programs and Features.

Two additional factors made earlier cleanup attempts fail:

Wrong hive / wrong user. The registrations belonged to a specific Windows account (an admin account in the reported case). Cleanup performed while logged in as a different user only searched that user's HKEY_CURRENT_USER , so the keys were never touched. HKEY_USERS only exposes hives for accounts that are currently signed in. Wrong order of operations. The Uninstall keys are written by Chrome, not by an installer. If the keys are deleted while the web app is still installed in the Chrome profile, Chrome re-creates them the next time it launches , and the entry reappears on the next inventory run. Resolution .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Remove the web app from Chrome first, then clean the registry — in this order.

1. Sign in as the owning Windows account. Identify the SID in the uninstall_string / registry path and log in as (or load the hive of) that user. If the profile owner is not signed in, load the hive manually:

reg load HKU\Temp "C:\Users\ \NTUSER.DAT" (unload with reg unload HKU\Temp when finished).

2. Close Chrome completely. Not just the windows — check Task Manager for lingering chrome.exe processes. Chrome can keep running in the background (Settings → System → "Continue running background apps when Google Chrome is closed").

3. Remove the web app from every affected Chrome profile. Open Chrome, switch to the profile, go to chrome://apps , right-click the app and select Remove . Repeat for each profile listed in the registry findings. This is the step that de-registers the PWA and makes the cleanup permanent.

4. Close Chrome again, back up and delete what remains.

$sid = ' ' reg export "HKU\$sid\Software\Microsoft\Windows\CurrentVersion\Uninstall" C:\Temp\uninstall_backup.reg /y

$keys = ' ',' ',' ' foreach ($k in $keys) { reg delete "HKU\$sid\Software\Microsoft\Windows\CurrentVersion\Uninstall\$k" /f }

Remove-Item -Recurse -Force 'C:\Users\ \AppData\Local\Google\Chrome\User Data\Profile \Web Applications\_crx_ ' Also delete any leftover shortcut under %appdata%\Microsoft\Windows\Start Menu\Programs\Chrome Apps .

5. Check for a force-install policy. If Chrome is managed by GPO or the Google Admin console and the app is in the force-install list, it will silently reinstall:

Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Google\Chrome' -EA SilentlyContinue | Select-Object WebAppInstallForceList, ExtensionInstallForcelist Get-ChildItem 'HKLM:\SOFTWARE\Policies\Google\Chrome\WebAppInstallForceList' -EA SilentlyContinue | ForEach-Object { Get-ItemProperty $_.PSPath } Also confirm whether the Chrome profiles are signed in to Google accounts with Sync enabled — signing in again on a synced account can reinstall the app.

6. Verify, then re-discover. Re-run the sweep script below to confirm it returns nothing, restart the ACC agent service on the endpoint, then open the CI record in the CMDB and click Discover Now on the form. This triggers an on-demand scan so the change can be confirmed immediately instead of waiting for the scheduled run. Confirm the cmdb_sam_sw_install list no longer returns the entry.

Sweep script — locate every registration and leftover folder $appId = ' ' New-PSDrive -PSProvider Registry -Name HKU -Root HKEY_USERS -EA SilentlyContinue | Out-Null

$paths = @( 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall', 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall' ) $paths += (Get-ChildItem HKU:\ | Where-Object { $_.PSChildName -notmatch '_Classes$' } | ForEach-Object { "HKU:$($_.PSChildName)\Software\Microsoft\Windows\CurrentVersion\Uninstall" })

foreach ($p in $paths) { if (Test-Path $p) { Get-ChildItem $p -EA SilentlyContinue | ForEach-Object { $i = Get-ItemProperty $_.PSPath -EA SilentlyContinue if ($i.PSChildName -like "*$appId*" -or $i.DisplayName -like '*Google Drive*' -or $i.UninstallString -like "*$appId*") { [pscustomobject]@{ Hive=$p; Key=$_.PSChildName; DisplayName=$i.DisplayName; UninstallString=$i.UninstallString } } } } }

# Leftover PWA folders across every local profile Get-ChildItem 'C:\Users' -Directory -EA SilentlyContinue | ForEach-Object { Get-ChildItem "$($_.FullName)\AppData\Local\Google\Chrome\User Data" -Directory -EA SilentlyContinue | ForEach-Object { Get-ChildItem "$($_.FullName)\Web Applications" -Directory -EA SilentlyContinue | Where-Object Name -like "*$appId*" | Select-Object -Expand FullName } } If the script returns nothing across every hive and profile, the registration is genuinely gone and the investigation should move to the agent/instance side.

Preventing recurrence Chrome writes every PWA a user installs into these same Uninstall keys, so any web app users add will keep appearing in the installed software list and generating restricted-software tickets. Where this becomes a recurring nuisance, consider a SAM normalization or ignored-software rule that filters entries with vendor Google\Chrome and a chrome.exe --uninstall-app-id uninstall string.