how to determine whether an app was installed by the AppStore or otherwise

[supportjetpulp]

I'm looking for a way to check if an app (in this case MS Office apps) has been installed via the legacy installer, or if it has been distributed by the Mac App Store.

I don't see any difference in the Info.plist

Does anybody know how to achieve that goal ?

[prodic · Accepted solution]

It is mentioned here:
https://docs.microsoft.com/en-gb/deployoffice/mac/deploy-mac-app-store

How can I tell if an Office app was downloaded from the Mac App Store?
Open Finder, and navigate to the Applications folder
Locate the Office app (such as Microsoft Outlook.app), control-click, and choose Show Package Contents
Navigate into the Contents folder
If a folder named _MASReceipt is present, the app was downloaded from the Mac App Store

Does that help you achieve your goal?

[stevewood]

@supportjetpulp If you're looking for a way to determine it via the JPS, I do not believe there is a way to do so with an Advanced Search or a Smart Group. At least I've never found a way to do it with those. The information is captured in the database, and you can see it when looking at the Applications tab of a computer record (far right column is Yes for an App Store app).

If you have access to your database, and want to pull a report of a particular title, say Microsoft Word, the below query will work.

NOTE: while this query is non destructive (it only reads the DB), if you are not comfortable with messing with the DB, do not do so.

SELECT DISTINCT c.computer_name as 'Computer Name',
c.serial_number as 'Serial Number',
FROM_UNIXTIME(c.`last_contact_time_epoch`/1000,"%Y-%m-%d") AS 'Last Check-in',
c.operating_system_version as 'OS',
ad.name as 'Application Name',
ad.version as 'Application Version',
a.`mac_app_store` 'Mac App Store App?'

from computers_denormalized as c
INNER JOIN applications a on a.report_id = c.last_report_id
join application_details ad on a.application_details_id = ad.id
and a.report_id = c.last_report_id
INNER JOIN reports r on c.computer_id = r.computer_id
INNER JOIN site_objects so on r.computer_id = so.object_id

WHERE
ad.name like 'MICROSOFT WORD%' and so.object_type=1;

The above is for 10.9 and above, after Jamf changed the way Application data is stored. The below is for pre-10.9:

SELECT DISTINCT a.computer_name AS 'Computer Name', 
a.`serial_number`,
FROM_UNIXTIME(a.`last_contact_time_epoch`/1000,"%Y-%m-%d") AS 'Last Check-in',  /* Last Check-in */
a.operating_system_version as "OS",
c.application_name AS 'Application Name',
c.`mac_app_store` 'Mac App Store App?',
c.application_version AS 'Version'

From computers_denormalized a 
INNER JOIN reports b ON a.computer_id = b.computer_id
INNER JOIN applications c ON b.report_id = c.report_id
INNER JOIN site_objects d ON b.computer_id = d.`object_id`

WHERE c.application_name LIKE 'MICROSOFT WORD%' AND d.object_type=1;

NOTE: I no longer have access to a pre-10.9 database, so I cannot confirm the above is still working. It was working before we upgraded to 10.9, but I cannot test it anymore.

You can change out the app name on that last line for any app you want. This will pull up the computer name, serial number, last check-in date, OS version, App Name, App Version, and if it is a MAS app (0 means no and 1 means yes).

For example, if you wanted to look at your Keynote deployment you could change the app to '%KEYNOTE%'. The % symbol is the wildcard in a query. So this would look for any app that contains KEYNOTE in the name.

This will not tell you if the apps were deployed via VPP, just if they are MAS apps.

[supportjetpulp]

@prodic It most certainly solved my problem. Thanks a lot !