Not even 24 hours after creating my post and after receiving some data from the community I’ve quickly realised that the location where Microsft is checking installed apps HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths cannot be relied on since a lot of apps do no register themselves there when installed. So I’ve created a new version for my script.

What is different about version 2.0?

It uses a modified JSON which is based on an actual export from lnk files. It tests if the executable (TargetPath) exists and its corresponding lnk (Fullname), if it does not find the lnk it then creates it.

The detection.ps1changed to acommodate V2 and since the fixshorcuts.ps1 logic changed, so did the intunewin

How to install?

You can download the .intunewinfile from here and just use %windir%\sysnative\windowspowershell\v1.0\powershell.exe -executionPolicy bypass -windowstyle hidden -file .\FixShortcuts.ps1 -url https://raw.githubusercontent.com/schenardie/ASRmageddon/main/V2/AppList.json as Install command. As detection you can use the following file

How to contribute?

If you would like to contribute with my list, please run the below command on your powershell and share the outputs with me via Twitter or E-mail

The script should read all .lnk files from C:\ProgramData\Microsoft\Windows\Start Menu and its subfolders and export shortcut FullName, TargetPath, Description and WorkindDirectory to a JSON object which will then be merged into the main JSON

$Shortcutslist= Get-ChildItem -Path "C:\ProgramData\Microsoft\Windows\Start Menu" -Include *.lnk -Recurse | ForEach-Object {
    $WScript = New-Object -ComObject WScript.Shell
    $TargetProperties = @{TargetPath=$WScript.CreateShortcut($_.FullName).TargetPath;Fullname=$WScript.CreateShortcut($_.FullName).Fullname;Description=$WScript.CreateShortcut($_.FullName).Description;WorkingDirectory=$WScript.CreateShortcut($_.FullName).WorkingDirectory }
    New-Object PSObject –Property $TargetProperties
    }

$Shortcutslist | Where-Object {($_.TargetPath -like "*.exe") -and ($_.TargetPath -notlike "*cmd.exe") -and ($_.TargetPath -notlike "*powershell.exe") -and ($_.TargetPath -notlike "C:\Windows\system32*") } | ConvertTo-Json

Thanks for reading and hope that this helps you with getting all your user shortcuts back.