Concatenation of Registry Key Values to Determine Default Web Browser

[mbartosh]

How can I concatenate several registry keys into one property? The following does not work. I am trying to determine the default web browser. The “default web browser” inspector does not return the correct results.

value "ProgId" of keys "Software\Microsoft\Windows\Shell\Associations\UrlAssociations\ftp\UserChoice" of     current user keys (logged on users) of registry & value "ProgId" of keys "Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice" of current user keys (logged on users) of registry & value "ProgId" of keys "Software\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice" of current user keys (logged on users) of registry

[Aram]

I’m not sure if this is exactly what you want, but here’s one way to concatenate the 3 values together:

concatenation "|" of ((values "ProgId" of keys "Software\Microsoft\Windows\Shell\Associations\UrlAssociations\ftp\UserChoice" of current user keys (logged on users) of registry as string);(values "ProgId" of keys "Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice" of current user keys (logged on users) of registry as string);(values "ProgId" of keys "Software\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice" of current user keys (logged on users) of registry as string))

Here’s another that returns the unique values:

unique values of ((values "ProgId" of keys "Software\Microsoft\Windows\Shell\Associations\UrlAssociations\ftp\UserChoice" of current user keys (logged on users) of registry as string);(values "ProgId" of keys "Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice" of current user keys (logged on users) of registry as string);(values "ProgId" of keys "Software\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice" of current user keys (logged on users) of registry as string))

On a side note, I’ll have to look into the Default Web Browser inspector if that is not working properly once more.

[mbartosh]

Thanks Aram. It was the “as string” that I was missing.

[AlexaVonTess]

To verify, I thew the second relevance set into an Analyses. I have many reporting back an “AppX” result. Like you said, better to see why the inspector isn’t working…

[drbdanish]

I’m getting same results as Alexa, could you please help in fixing it?

[brolly33]

Inspector is working.

q: Default Web Browser
A: "MicrosoftEdge.exe" "11.0.18362.476" "Microsoft Edge" "11.00.18362.476 (WinBuild.160101.0800)" "Microsoft Corporation"

I have the same registry key entries on my Windows 10 box and my default browser for HTTP and HTTPS is Microsoft Edge.
Perhaps there is a better place to detect Default Browser on Windows 10, or a way to decode that AppX string?

Looks like the strings are correct as per this MS article:

Set default browser

When I change my default browser to Firefox, I get

q: concatenation "|" of ((values "ProgId" of keys "Software\Microsoft\Windows\Shell\Associations\UrlAssociations\ftp\UserChoice" of current user keys (logged on users) of registry as string);(values "ProgId" of keys "Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice" of current user keys (logged on users) of registry as string);(values "ProgId" of keys "Software\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice" of current user keys (logged on users) of registry as string))
A: FirefoxURL-308046B0AF4A39CB|FirefoxURL-308046B0AF4A39CB

[AlexaVonTess]

The returns Microsoft Edge on my system…only my default browser is Chrome.

[brolly33]

q: Default Web Browser
A: “MicrosoftEdge.exe” “11.0.18362.476” “Microsoft Edge” “11.00.18362.476 (WinBuild.160101.0800)” “Microsoft Corporation”

I changed my Default Browser to Firefox and then to Chrome, and the inspector Default Web Browser did not change. Inspector seems to be having issues.

[JasonWalker]

I’m having trouble understanding what such an inspector should return on a multiuser system, where each user might have a different default browser. I did find the inspector in a search, but I don’t think we are using it as intended.

default web browser : file

Returns a global object corresponding to the WinCE web browser installed on the Client Windows Mobile device. Windows Embedded CE uses IE, which has been optimized for WinCE devices.

Plural: default web browsers

https://developer.bigfix.com/relevance/reference/file.html#default-web-browser-file

[brolly33]

There are 2 inspector entries for Default Web Browser, one for Windows which returns an Application and a second for WinCE and nonWindows, which returns a File.

https://developer.bigfix.com/relevance/reference/application.html#default-web-browser-application
https://developer.bigfix.com/relevance/reference/file.html#default-web-browser-file

The multi user point is one I did not consider and is insightful… I changed the default web browser for my user, not the system… It almost sounds like default web browser would need to be a property of a User object.

[AlexaVonTess]

And I suspect it will only return a response when a user is actually logged in.

[Pete_F]

I use this

((if it starts with “AppX” then “Edge” else if it starts with “Chrome” then “Chrome” else if it starts with “Firefox” then “Firefox” else if it starts with “Brave” then “Brave” else it) of (value “ProgID” of key “Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice” of current user key (logged on user) of registry as string) | “No logged in user”)

Problem is it needs to know the other browsers appx in order to be totally accurate… kludgy and could be tidied up.

For Mac’s
(if not exists (logged on user) then “No logged in user” else (if it contains “safari” then “Safari” else if it contains “firefox” then “Firefox” else if it contains “chrome” then “Chrome” else if it as lowercase contains “Brave” as lowercase then “Brave” else if it contains “opera” then “Opera” else it) of string of values of entries whose (key of it = “LSHandlerRoleAll”) of dictionaries whose (string of values of entries whose (key of it = “LSHandlerURLScheme”) of it = “http”) of values of arrays “LSHandlers” of dictionaries of file “com.apple.launchservices.secure.plist” of folder “Library/Preferences/com.apple.LaunchServices” of folder (name of logged on user) of folder “/Users” | “Not Set”)

[mbartosh]

The inspector Default Web Browsers returns nothing for me. It doesn’t fail, but doesn’t work either.