Dual Monitor Relevance

Can anyone please provide me with a relevance query that gives all monitors attached? I see the below query returns only one monitor though they are multiple ones attached. This is even returning n/a in some case. Don’t know why so.

((if (exists first "000000fc00" of it) then hexadecimal string (first 24 of following texts of first "000000fc00" of it ) else "n/a"), (if (exists first "000000ff00" of it) then hexadecimal string (first 24 of following texts of first "000000ff00" of it ) else "n/a"), (hexadecimal integer (first 2 of following text of position 32 of it )/4) as string & "/" & (1990+(hexadecimal integer (first 2 of following text of position 34 of it ))) as string) of (values "EDID" of keys (("HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\" & it & "\Device Parameters") of (string values of selects "PNPDeviceID from Win32_DesktopMonitor" of wmi) ) of registry as string)

What do you want from all monitors attached? Just the name?

string values of selects "Name from Win32_DesktopMonitor" of wmis

Others?

selects "Caption,Description,MonitorType,Name,PNPDeviceID from Win32_DesktopMonitor" of wmis

Related:

http://bigfix.me/analysis/details/2994751
http://bigfix.me/analysis/details/2994710
http://bigfix.me/analysis/details/2994563

I want to extract Monitor Model and Serial Number from all computers (if a computer has multiple monitor attached, I need that as well)

This will give you all unique EDIDs of all connected monitors:

unique values of (it as string) of values "EDID" of keys "Device Parameters" of keys of keys of keys "Enum\DISPLAY" of (keys "CurrentControlSet" of it;keys whose(name of it starts with "ControlSet") of it) of keys "HKEY_LOCAL_MACHINE\SYSTEM" of (x64 registries;x32 registries)

This seems to give you what you are looking for: ( I just added on the first bit of yours )

(( (hexadecimal string (first 24 of following texts of first "000000fc00" of it )) | "n/a"), ( (hexadecimal string (first 24 of following texts of first "000000ff00" of it ) ) | "n/a"), (hexadecimal integer (first 2 of following text of position 32 of it )/4) as string & "/" & (1990+(hexadecimal integer (first 2 of following text of position 34 of it ))) as string) of unique values of (it as string) of values "EDID" of keys "Device Parameters" of keys of keys of keys "Enum\DISPLAY" of (keys "CurrentControlSet" of it;keys whose(name of it starts with "ControlSet") of it) of keys "HKEY_LOCAL_MACHINE\SYSTEM" of (x64 registries;x32 registries)

Related:

http://www.hofferle.com/retrieve-monitor-serial-numbers-with-powershell/
http://community.spiceworks.com/scripts/show/645-get-serial-number-model-of-monitor
https://msdn.microsoft.com/en-us/library/aa394542(v=vs.85).aspx
https://social.technet.microsoft.com/Forums/scriptcenter/en-US/ecb0aafd-e82e-47e3-b7a3-72ebcca46234/wmimonitorid?forum=ITCG
http://stackoverflow.com/questions/7967699/get-screen-resolution-using-wmi-powershell-in-windows-7

selects "* FROM WMIMonitorID" of wmis "root\wmi"

Needs some modification:

(concatenations ";" of (it as string) of integer values of it) of selects "SerialNumberID FROM WMIMonitorID" of wmis "root\wmi"

Maybe:

(concatenations of (character it) whose(it != "%00") of integer values of it) of selects "SerialNumberID FROM WMIMonitorID" of wmis "root\wmi"

It seems to be correct and wrong :slight_smile: It scrolls through all those Registry entries and gives bunch of list. When I manually verify a few computers, those having 2 monitors get more than 2. It may be because of stale entries in registry the fact that the system used other monitors some time ago. Effectively, one computer was attached to a couple of monitors which are replaced by new two monitors. So, this query gets all 4 of them. Is there a way to filter out non-active ones?

This solution avoids all duplicates and stale entries in registry. it also maps each monitor with its relevant serial number.

concatenation “” of substrings separated by “# (#)” of (concatenation “” of substrings separated by "# (#), " of (concatenation “” of substrings separated by “, # (#)” of (concatenation “, " of unique values of (item 1 of it & " (” & item 0 of it & “)”) of ((if (exists first “000000fc00” of it) then hexadecimal string (first 24 of following texts of first “000000fc00” of it ) else “#”), (if (exists first “000000ff00” of it) then hexadecimal string (first 24 of following texts of first “000000ff00” of it ) else “#”)) of (values “EDID” of keys (("HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum" & it & “\Device Parameters”) of (string values of selects “PNPDeviceID from Win32_PnPEntity” of wmi) ) of registry as string))))

I’m not sure if this works, but try it and let me know:

(concatenations of (character it) whose(it != "%00") of integer values of it) of selects "SerialNumberID FROM WMIMonitorID" of wmis "root\wmi"
1 Like

This works if you have good data. I see it also returns 0, 3 for some of the rows.

1 Like

I think the results 0, 3 are probably what happens when it isn’t set at all or is not set correctly. Those results could be filtered out with a whose clause so that it would instead return “”

I’m working on an analysis based upon this post, which is available here:

http://bigfix.me/analysis/details/2994771 (work in progress, I expect to be adding more properties over time)

1 Like

Nice work. Would you like to add my solution as well to your page? My solution also skips all inactive/not set. It also maps one-to-one in case anyone needs to map each monitor model with its corresponding serial number rather than just listing out both in two separate columns.

 concatenation "" of substrings separated by "# (#)" of (concatenation "" of substrings separated by "# (#), " of (concatenation "" of substrings separated by ", # (#)" of (concatenation ", " of unique values of (item 1 of it & " (" & item 0 of it & ")") of ((if (exists first "000000fc00" of it) then hexadecimal string ((preceding text of first "0a" of it | it) of (first 24 of following texts of first "000000fc00" of it )) else "#"), (if (exists first "000000ff00" of it) then hexadecimal string (first 24 of following texts of first "000000ff00" of it ) else "#")) of (values "EDID" of keys (("HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\" & it & "\Device Parameters") of (string values of selects "PNPDeviceID from Win32_PnPEntity" of wmi) ) of registry as string))))
1 Like

This is how I would re-write that: (should be exactly equivalent)

concatenations ", " of unique values whose(it != "# (#)") of ( ( hexadecimal string (first 24 of following texts of first "000000ff00" of it) | "#") & " (" & ( hexadecimal string ((preceding text of first "0a" of it | it) of (first 24 of following text of first "000000fc00" of it )) | "#" ) & ")" ) of unique values of (it as string) of values "EDID" of keys (("HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\" & it & "\Device Parameters") of (string values of selects "PNPDeviceID from Win32_PnPEntity" of wmi)) of (x32 registries;x64 registries)

In this case (x32 registries;x64 registries) serves no purpose and just causes the results to be duplicated on x64 systems, which then the unique values inspector resolves the duplication. The main reason I am doing it this way is that this will make a difference when referencing the “SOFTWARE” registry key of the local machine, so I have generalized this approach to work in all cases, even if not required in all cases.

Something related that I’ll add to the analysis:

(tuple string items ( (it + 2) of (integer values of selects "VideoOutputTechnology FROM WmiMonitorConnectionParams" of wmis "root\wmi") ) of "UNINITIALIZED, OTHER, HD15, SVIDEO, COMPOSITE_VIDEO, COMPONENT_VIDEO, DVI, HDMI, LVDS, D_JPN, SDI, DISPLAYPORT_EXTERNAL, DISPLAYPORT_EMBEDDED, UDI_EXTERNAL, UDI_EMBEDDED, SDTVDONGLE, MIRACAST, UNKNOWN, https://msdn.microsoft.com/en-us/library/ff546605.aspx")

References:

https://msdn.microsoft.com/en-us/library/ff546605.aspx
https://msdn.microsoft.com/en-us/library/bb980612(v=vs.85).aspx

This is an elegant solution. I was not aware of “whose”. Good learning :smile:

1 Like

Does it read from the page?

No, it does not read from the page at all. I was just including the page link in the relevance in a part of the tuple-string that it should never read from.

Here is another property:

unique values of (tuple string items ( (integer values of selects "VideoInputType FROM WmiMonitorBasicDisplayParams" of wmis "root\wmi") ) of "Analog, Digital, UNKNOWN, https://msdn.microsoft.com/en-us/library/aa394535%28v=vs.85%29.aspx")

http://bigfix.me/analysis/details/2994773

Does this work to eliminate disconnected monitors? Should be faster than the other one.

unique values whose(it != "# (#)") of ( ( hexadecimal string (first 24 of following texts of first "000000ff00" of it) | "#") & " (" & ( hexadecimal string ((preceding text of first "0a" of it | it) of (first 24 of following text of first "000000fc00" of it )) | "#" ) & ")" ) of unique values of (it as string) of values "EDID" of keys (("HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\" & it & "\Device Parameters") of (string values of selects "PNPDeviceID from Win32_DesktopMonitor WHERE Status='OK'" of wmi)) of (x32 registries;x64 registries)

Also, I am adding a bunch of stuff to the analysis: http://bigfix.me/analysis/details/2994775

http://bigfix.me/relevance/details/3002172
http://bigfix.me/relevance/details/3002173
http://bigfix.me/relevance/details/3002174

1 Like

Nice one, i was looking for something like that.
however, it does not seem to “see” the laptop monitor (i am working with laptop monitor and external monitor, but it only returns the external monitor).
any thoughts?

1 Like

Some of these relevances above have filters to remove empty results. You would need to investigate that case by using the raw inspector results to see what is going on to see why the laptop’s internal monitor is not being returned.

I did not test any of the above using a laptop.

I guess you don’t need to do anything for Laptop monitor as it is not separable from Laptop!! If you get Laptop Model Number, you should be able to know what kind of monitor size it is.

1 Like