Analysis query to get if application is 64bit

Content Authoring
1

I wanted to check if below query can be updated to get right result ie to know if installed version is 32 or 64 bit, it shows false currently -

(if (x64 of operating system) and (exists find files "WINPROJ.EXE" whose (size of it > 0) of folder "C:\Program Files (x86)\Microsoft Office\Office12") then "32bit" else "64bit") ; (if(x32 of operating system) and (exists find files "WINPROJ.EXE" whose (size of it > 0) of folder "C:\Program Files\Microsoft Office\Office12") then "32bit" else "64bit")
2

Strange, “false” doesn’t seem to be one of your return values. I’d expect it to return either “32-bit” or “64-bit”, but also to probably be wrong.

Directly looking at “c:\program files” or “c:\program files (x86)” can give unexpected results because the BES Client is a 32-bit program, and can be redirected to the 32-bit paths.

In an Action you can avoid the redirection by adding ‘action uses wow64 redirection false’ to your script. In Relevance, instead you switch to the ‘x64’, ‘x32’, or 'native, variations of the inspectors.

I do not advocate using ‘find files’ either as this can be resource-intensive on the client; I’d prefer to check the add/remove programs list in the Registry. But for illustration purpose try

if (exists find files “WINPROJ.EXE” whose (size of it > 0) of folders “Microsoft Office\Office12” of program files x32 folders) then “32bit” else (if (exists find files “WINPROJ.EXE” whose (size of it > 0) of folders “Microsoft Office\Office12” of program files x64 folders ) then “64bit” else "none")

3

I see the attached result with this query it only shows mostly False and none, please let me know if this query can be modified to get the excpected result urgently.

Projectquery
Projectquery754×524 45.6 KB

4

I have to believe that you’re not following one of the instructions, because ‘False’ is not one of the return values that’s possible with this statement.

5

i used the below command you gave in analysis - if (exists find files “WINPROJ.EXE” whose (size of it > 0) of folders “Microsoft Office\Office12” of program files x32 folders) then “32bit” else (if (exists find files “WINPROJ.EXE” whose (size of it > 0) of folders “Microsoft Office\Office12” of program files x64 folders ) then “64bit” else “none”)… can we have remote session to check this

6

Have you verifies that the filename and paths are correct?

Afraid I won’t be doing a support session with you, I don’t work for IBM support, but you may trying opening a pmr request with them.

7

The filename and paths are correct i have checked it

8

I’m afraid I’m done with this thread. I already warned that ‘find files’ was a bad, resource-intensive inspector that should be used with care, but I see from your Analysis that you’ve applied to to 35 thousand systems.

You should deactivate your analysis immediately and enroll in some BigFix training.

1 Like
9

Can you provide the full paths you are looking for? I don’t mean relevance, I mean the full pathnames.

Are these the correct paths?

  • C:\Program Files (x86)\Microsoft Office\Office12\WINPROJ.EXE
  • C:\Program Files\Microsoft Office\Office12\WINPROJ.EXE

Assuming those are the correct paths, then I would do something like this:

if (exists files "C:\Program Files (x86)\Microsoft Office\Office12\WINPROJ.EXE") then "32bit" else ( if exists files "C:\Program Files\Microsoft Office\Office12\WINPROJ.EXE" then (if x64 of operating system then "64bit" else "32bit") else ERROR "not found" )

I would strongly recommend against using Find Files in most cases as this will search the file system which can be extremely slow and problematic unless used very carefully.

Generally to get this answer, I would actually recommend looking into the Windows Registry Uninstall key to get if the program is 32bit or 64bit. This approach is generally faster and more reliable in cases where the programs are installed to non-default paths, or if on non-English windows where “Program Files” is not the localized pathname.

For the registry version of this relevance, start with getting the DisplayName of all products installed:

(it as string) of values "DisplayName" of keys of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of (x64 registries; x32 registries)

In my case, I don’t have any office products installed, but here is a working example for 7zip bitness check:

(if (it contains "x64") then "x64" else "x32") of (it as string) whose(it starts with "7-Zip") of values "DisplayName" of keys of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of (x64 registries; x32 registries)

If 7zip isn’t installed, then this will return <none>, otherwise it returns either x64 or x32.

I don’t have a way to test this at the moment, but this might work for MS Project:

(if (it contains "x64") then "x64" else "x32") of (it as string) whose(it contains "Microsoft Project") of values "DisplayName" of keys of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of (x64 registries; x32 registries)

But without looking at the registry entries for MS Project myself, then I don’t know if it lists it’s bitness or where it lists it, but if you shared a screenshot, then I could adjust the relevance as needed.

10

I wanted to know query to check if below registry exists then its 32 bit office version else doesnt exist

“HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\90120000-0011-0000-0000-0000000FF1CE” OR “HKEY_LOCAL_MACHINE\Software\Wow6432node\Microsoft\Windows\CurrentVersion\Uninstall\90120000-0011-0000-0000-0000000FF1CE”

11

Please let me know on this asap