Explanation of signature using DisplayNameVersion

Content Authoring SUA Signatures
1

Hi

Can anyone explain, how to read below signature.

(
Registry Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall*Registry Value: DisplayNameVersion = Microsoft SQL Server 2014 Enterprise Edition
Rule Modification
04/29/2017 01:00 AM
OR
Registry Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall*Registry Value: DisplayNameVersion = Microsoft SQL Server 2014 Enterprise Edition: Core-based Licensing
Rule Modification
04/29/2017 01:00 AM
)

When I check the servers, I can not find any value named “DisplayNameVersion” neither can I find any “DisplayName” that equals the values mentioned, at least not under “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall”.

Thanks in advance

2

Do you want to read the value “DisplayNameVersion” of mentioned registry?

3

I would like to be able to check the registry, to see why a given server register the software as installed and another one does not. I order to do that, I need to know exactly which registry keys to look for.

4

I have attempted to reverse engineer the discovery of SQL Server by BFI, and it appears that certain Microsoft products have additional, under-the-covers discovery logic not found in the catalog data. These products’ signatures include the asterisk (*) rather than a GUID in the Registry Key exposed by the signature. Obviously, there is no Registry Key called DisplayNameVersion, so it must match on some other logic, which appears to be a product entry key, for example:

HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\110\Tools\Setup

and a REG_SZ key:value pair:

Edition=Standard Edition

Which gets translated to Microsoft SQL Server 2012 Standard Edition in the discovery data.

The catalog signature data shows this explicitly for a SQL Server 2016 Evaluation Edition:

<Signature guid="f35d9bbd97947e2b8a96eb3c26806764" type="OtherSignature">
	<MultipleInstance>
		<Iterator export="false" name="rg">
			<Vector>
				<RegKeyList root="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL*" section="32or64"/>
			</Vector>
		</Iterator>
		<Instance>
			<Variable name="IS_INSTALLED">
				<And>
					<PackageInfoMatch vendor="*" name="Microsoft SQL Server 2016*" version="*"/>
					<RegKeyValueContains entry="EditionType" key="$(rg)" section="32or64" value="Eval"/>
				</And>
			</Variable>
			<Condition withVariable="IS_INSTALLED">
				<Action do="SKIP" onValue="false"/>
			</Condition>
		</Instance>
	</MultipleInstance>
</Signature>