Analyses - Determine if data of reg value = 0 or 1

Usage and Config Platform
1

(imported topic written by RobertDiRosato)

I need to poll my server endpoints to determine if Network Level Authentication is turned on.

Network Level Authentication

Key: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\WinStations\RDP-Tcp

Value: UserAuthentication

Data: 1

0 = OFF

1 = ON

How would I write this >?

I tried this but it does not seem to work

IF

(exists value “UserAuthentication” of keys “HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\WinStations\RDP-Tcp” of registry)

AND

(it contains “1”) then “Yes” else “No”

2

(imported comment written by cstoneba)

try this:

if (exists value “UserAuthentication” whose (it = “1”) of key “HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\WinStations\RDP-Tcp” of registry) then “Yes” else “No”

3

(imported comment written by NoahSalzman)

Here is another variant:

q: value 
"UserAuthentication"  of key 
"HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\WinStations\RDP-Tcp" of registry as string | 
"NA" A: 0

Note: the | operator only exists in TEM 8.0 and higher

4

(imported comment written by RobertDiRosato)

Cstoneba

I tried this and it just displays everything as NO

if (exists value “UserAuthentication” whose (it = “1”) of key “HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\WinStations\RDP-Tcp” of registry) then “Yes” else “No”

The Key is

Key: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\WinStations\RDP-Tcp

Value: UserAuthentication

Data: 1

(Note Data is 1 but i believe it’s stored as a Hex 32 bit DWORD and looks like this 0x00000001)

5

(imported comment written by RobertDiRosato)

Sorry this is the one that worked…

if (exists value “UserAuthentication” whose (it = 1) of key “HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\WinStations\RDP-Tcp” of registry) then “ON” else “OFF”