A method and apparatus are disclosed for remotely identifying software and software versions using a maintained software audit file. The disclosed system management tool identifies software installed on each network node by comparing the name and size of installed files to a software audit file. The system management tool performs an inventory scan of the software on each network node and obtains a list of each file and the corresponding file size. The software audit file provides identifying information, such as the file name and corresponding size, for each known file. Known files can be quickly identified using a match criteria based, for example, on the file name and size. The software audit file is maintained by investigating any unknown files with a sample of the user population having the unknown file. In one implementation, a targeted query is automatically transmitted to a sample of the user population having the unknown file requesting header information for the unknown file. In this manner, previously unknown files, once identified, can be added to the software audit file. A technique is disclosed for quickly identifying a network node, in order to retrieve a list of instructions to be executed by the network node.