My client has 2 production orgs for different requirements. They asked me to install and set up one of the managed packages from App Exchange in 2nd org as it was in 1st org. How would I find that the 1st org package is installed for just admin, for all users, or for a specific profile?
Strictly speaking, you can't; this information isn't recorded as such anywhere.
Installing for admins or all users or specific profiles actually just grants the selected profiles access to all managed components. That permissioning can be changed by administrators after the package is installed.
You can attempt to guess what initial setting was used by looking at each profile to see if managed package components are enabled for that profile.
However, this suggestion points to a broader need on your project: you need a source of truth for what permissions are correct other than the current state of the org. What is the business goal?
That is actually stored somewhere, I believe
select ApexCompileType,ProfileMappings, SecurityType, CreatedDate,PackageInstallSource,SubscriberPackageVersionKey, UpgradeType from PackageInstallRequest (Tooling API)
Security Type will be "Full" if installed for All Users. It will be "None" if just for admins.
Dave Pattison's solution seems correct. We had a similar situation and this query helped. Object reference https://developer.salesforce.com/docs/atlas.en-us.api_tooling.meta/api_tooling/tooling_api_objects_packageinstallrequest.htm?q=packageinstallrequest