For pending file rename operations analysis

[tarwaniv]

Hi Gang,
I did use the Pending file name operations analysis to develop results of servers which are pending for reboots and used the first analysis property like this:-1:

But I am encountering an error as “Singular expression refers to nonexistent object”. Please assist if I am missing something here.

[JasonWalker]

The only singular I see there is “native registry”.
Are you getting those singular expression errors from Windows servers, or are those perhaps Linux/UNIX/Mac ?

[brolly33]

We can pluralize the native registry, but I don’t think this relevance is where the issue lies.

q: if (exists values "PendingFileRenameOperations" of keys "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager" of native registries) then ((substrings separated by "%00" of (it as string)) of values "PendingFileRenameOperations" of keys "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager" of native registries) else ("N/A")
A: N/A

@tarwaniv
Do you have any relevance on the Relevance tab that might be throwing this error?

[tarwaniv]

Made it plural:-1:

Relevance is shown as below:-1:

[tarwaniv]

Applied relevance to as “windows of operating system”.

[SLB]

What is the result you are after here? A True | False to indicate if a file rename operation is pending, a list of the pending file rename operations or a True | False if a restart is pending?

pending restart will check more than just the existence of PendingFileRenameOperations so you could see True when a pending file rename isn’t the cause but is a good way of getting a simple view of if a system is in need of a restart.

[tarwaniv]

Seems it is “FileName Operations”

[SLB]

What Registry Keys are being checked by PENDING RESTART?

These are the registry keys being checked when machines are stuck on pending restart: HKLM\System\CurrentControlSet\Control\Session Manager value: PendingFileRenameOperations HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired HKLM\Software\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending HKLM\Software\Microsoft\Updates value: UpdateExeVolatile The PendingFileRanemeOperations is the most common culprit for the issue wherein differe…

[tarwaniv]

This key should be required to be checked and should give its data value:-1:

[JasonWalker]

Negative, it’s PendingFileRenameOperations … But it’s a Value, not a sub-Key.

[tarwaniv]

But in QnA it does not show all the subkeys:-1:

[JasonWalker]

But in QnA it does not show all the subkeys:-1:

You’re searching for ‘names of keys’ where you should instead query ‘names of values’

[SLB]

A couple of samples from my machine if that helps

Q: names of values of keys "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager" of registries
A: AutoChkTimeout
A: BootExecute
A: BootShell
A: CriticalSectionTimeout
A: ExcludeFromKnownDlls
A: GlobalFlag
A: GlobalFlag2
A: HeapDeCommitFreeBlockThreshold
A: HeapDeCommitTotalFreeThreshold
A: HeapSegmentCommit
A: HeapSegmentReserve
A: InitConsoleFlags
A: NumberOfInitialSessions
A: ObjectDirectories
A: ProcessorControl
A: ProtectionMode
A: ResourceTimeoutCount
A: RunLevelExecute
A: RunLevelValidate
A: SETUPEXECUTE
A: AutoChkSkipSystemPartition
A: SafeDllSearchMode
A: PendingFileRenameOperations
T: 2.520 ms
I: plural string

Q: ((substrings separated by "%00" of (it as string)) of values "PendingFileRenameOperations" of keys "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager" of registries)
A: \??\C:\WINDOWS\system32\spool\DRIVERS\x64\3\New\PrintConfig.dll
A: \??\C:\WINDOWS\system32\spool\DRIVERS\x64\3\PrintConfig.dll
A: 
A: 
T: 2.689 ms
I: plural substring

NOTE: I don’t believe HKLM\SYSTEM is subject to Wow64 redirection so registries will work as well as native registries

[tarwaniv]

Got it:-1:

Now let me try to get its value for PendingFileRenameOperations

[tarwaniv]

Please correct me on the relevance part here:-1:

however in registry, I see this:-1: -

[JasonWalker]

Can you paste the text of the query so I can copy/paste instead of trying to retype it on phone?

[JasonWalker]

Actually I have something built for this already

substrings separated by "%00" whose (it != "") of (values "PendingFileRenameOperations" of keys "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager" of native registry as string)

[SLB]

names of values of keys "PendingFileRenameOperations" is wrong so it triggering the “N/A” branch. Although your dont need it, you shoudl be checking for the value whose name of it = “PendingFileRenameOperations” but of you just pluralize the query, you can skip that altogether as with my earlier example from @brolly33 reply.

Q: ((substrings separated by "%00" of (it as string)) of values "PendingFileRenameOperations" of keys "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager" of registries)

[tarwaniv]

Worked and Thanks a lot Jason and SLB for helping:-1:

[JasonWalker]

You have a copy/paste error - ‘substring’ should use the plural ‘substrings’