Find all servers with registry key and if exists get value

Content Authoring
1

I’m trying to find all windows servers 2008, 2008r2, 2012, and 2012r2 that have a registry key. Then get that list of servers.

Then if possible after I get the list of servers I want to get the value of the registry key.

The key I need to search for is HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService\Parameters\LicenseServers

Then if it exists I want to get the value.

Can anyone help with this as I’m new to bigfix?
Thank you!!

2

If I recall correctly, “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService\Parameters” is the Registry Key, and “LicenseServers” is a REG_SZ value right?

If so, you’d want to create an Analysis. Inside the Analysis create a Property with a name like “Terminal Services License Server”. The Relevance for the Property would be

values "LicenseServers" of keys "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService\Parameters" of registry as string

Set the Evaluation Period for this property to something low, like “Every 12 hours” or “Daily” or something like that. It’s not really necessary for a simple registry entry (this is not an expensive query), but it’s a good practice to not evaluate Analysis properties very frequently unless you need to, and this key is not likely to change very frequently.

The Analysis Relevance will filter out which computers try to evaluate the properties at all. You want to use this so that other computers, say Linux hosts, Windows Clients, etc. don’t spend time evaluating the properties. To filter this, I’d use three relevance clauses -

windows of operating system

  • The fastest (I think) way to only target Windows machines

if exists property "in proxy agent context" then not in proxy agent context else true

  • BigFix supplies Proxy Agents for things like managing Virtual Machine definitions through VMWare / Hyper-V, hardware definitions for Bare Metal Imaging, etc. Excluding Proxy Agents ensures those don’t try to report and give unexpected results.

name of operating system as lowercase starts with "win2008" or name of operating system as lowercase starts with "win2012"

  • This ensures you get results only from Windows 2008, 2008r2, 2012, or 2012r2. As an alternative to this third form, you might instead use

product type of operating system = nt domain controller product type or product type of operating system = nt server product type

With those three clauses, you’ll get a list of all servers, including the ones that do not have LicenseServers present. The ones without license servers would display "<none>" for the result. If you want those to not appear in the list at all, you could have a fourth relevance filter
exists values "LicenseServers" whose (it as string !="") of keys "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService\Parameters" of registry

1 Like