Current User Run values not reporting

Content Authoring
1

(imported topic written by DotA)

I"ve created an analysis to show all the values in the Current User Run key:

concatenation";" of (values of key “HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run” of registry as string)

Problem is that some PCs are returning or blank in the analysis but when I run this query manually using QNA it returns the values in this key correctly.

2

(imported comment written by jgstew)

You cannot query the “current user” key directly using relevance because relevance runs in the SYSTEM user context, not the CURRENT_USER context.

You can query ALL users combined run keys, like this:

(unique values of (it as string) of values whose(it as string as trimmed string != “”) of keys “Software\Microsoft\Windows\CurrentVersion\Run” of keys whose(exists key “Software\Microsoft\Windows\CurrentVersion\Run” of it) of key “HKEY_USERS” of registry)

Also, see this related Analysis:
http://bigfix.me/analysis/details/2994643

3

(imported comment written by DotA)

Thanks so much, I just added in “concatenation”;" of" in front of your script to get all the to display on one line. Much appreciated!

4

(imported comment written by jgstew)

If you hover your mouse over “” in the console, it will pop open a tooltip that lists the results.