Fixlet results Console vs. running on local box

Content Authoring
1

Has anyone ever seen an issue where a computer is applicable to a fixlet (i.e. returns True), yet when you run the same relevance code on the box itself using the FixletDebugger, it reports False.

2

This could happen if there is a property that needs to run as the client. Try running the fixlet debugger again, but this time set the “Evaluate Using” to “Local Client Evaluator”.

3

Tried that… same result

4

Can you post the relevance you are checking and which is failing?

5

Sorry, I cannot post the relevance.

6

which inspectors are you using? Need some clues to be able to help :smile:

1 Like
7

The FixletDebugger is not always a 100 % reliable.
For example to test scripts etc.

For simple relevance I’ve had no problems yet, but i’m not suprised that it can happen :smile:

8

I am using just the registry key value and substring inspectors. Nothing very intense from what I can tell. I have tweaked the actual relevance to be able to post it to the forum…

(number of substrings separated by "%00" whose (length of it > 0 AND (it contains "a" as lowercase OR it contains "b" as lowercase OR it contains "c" as lowercase OR it contains "d" as lowercase OR it contains "e" as lowercase OR it contains "f" as lowercase OR it contains "g" as lowercase OR it contains "h" as lowercase OR it contains "i" as lowercase OR it contains "j" as lowercase OR it contains "k" as lowercase))of it != 11) of (value "Machine" of key "HKLM\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths\" of native registry as string as lowercase)
9

So Fixlet Debugger handles the null terminator %00 character different than the client does (and this key has a couple of them)

If you run the registry relevance with fixlet debugger youll get:

Q: value “Machine” of key "HKLM\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths" of native registry as string as lowercase

A: system\currentcontrolset\control\print\printers%00system\currentcontrolset\services\eventlog%00software\microsoft\olap server%00software\microsoft\windows nt\currentversion\print%00software\microsoft\windows nt\currentversion\windows%00system\currentcontrolset\control\contentindex%00system\currentcontrolset\control\terminal server%00system\currentcontrolset\control\terminal server\userconfig%00system\currentcontrolset\control\terminal server\defaultuserconfiguration%00software\microsoft\windows nt\currentversion\perflib%00system\currentcontrolset\services\sysmonlog%00%00

If you let the client evaluate:

Q: value “Machine” of key "HKLM\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths" of native registry as string as lowercase
A: system\currentcontrolset\control\print\printers

If you do something to handle the %00 (substrings separated by “%00”) then you should have consistent results

1 Like
10

I presume that key is actually a REG_MULTISZ ? If so yes we need to handle those better (and apparently consistently)

1 Like
11

Yes that is a REG_MULTISZ – the client also appends a %00 to the end of REG_EXPAND_SZ registry values as well (common in windows application uninstall strings). The fixlet debugger prints it as %00 but the client terminates the line at the %00