Getting error codes from registry, decimal output consistent, conversion to hex only works sometimes

Content Authoring
1

So I’m trying to monitor Intune sync error codes. Conveniently they’re stored in a registry value so I don’t have to mess with event logs, and the relevance I wrote to get the raw decimal error seems to work fine. However, the relevance I wrote to get the same value and convert it to hex only works some of the time and I don’t know why. (When it doesn’t work it produces <undefined>.)

if ((preceding text of first “T” of (value “ServerLastSuccessTime” of key “Protected\ConnInfo” of keys of keys “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts” of native registry as string)) as integer) < ((preceding text of first “T” of (value “ServerLastFailureTime” of key “Protected\ConnInfo” of keys of keys “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts” of native registry as string)) as integer) then value “LastSessionResult” of key “Protected\ConnInfo” of keys of keys “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts” of native registry as hexadecimal as string else if (((preceding text of first “Z” of following text of first “T” of (value “ServerLastSuccessTime” of key “Protected\ConnInfo” of keys of keys “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts” of native registry as string)) as integer) < ((preceding text of first “Z” of following text of first “T” of (value “ServerLastFailureTime” of key “Protected\ConnInfo” of keys of keys “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts” of native registry as string)) as integer) AND (value “LastSessionResult” of key “Protected\ConnInfo” of keys of keys “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts” of native registry as integer) > 0) then value “LastSessionResult” of key “Protected\ConnInfo” of keys of keys “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts” of native registry as integer as hexadecimal as string else “Intune Synced”

The only difference between this relevance and the other is the addition of “as hexidecimal” so I really don’t see why it only works a minority of the time. Any advice is appreciated because I need to get this cleaned up and functional to feed a report.

2

I can think of several things that can cause an issue (a missing value for one or the other, for instance).

To narrow it down, can you retrieve these two values from at least one of the machines that is failing with ‘undefined’ ?

value "ServerLastSuccessTime" of key "Protected\ConnInfo" of keys of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts" of native registry as string


value "ServerLastFailureTime" of key "Protected\ConnInfo" of keys of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts" of native registry as string

Either of these might themselves give an error (related to a missing value or duplicate keys), but if they do have values I can look for things like overflowing the size of ‘integer’ (which also has workarounds)

3

They’re both populated with time values in the same format as those that work. (E.g. 20240711T103808Z )
I wouldn’t expect this is a cause because this relevance produces the decimal value reliably. If there was an issue with dependent data the output should fault regardless of whether it’s requested in its native format or in a converted format.

I have to think there’s something I need to do in addition to simply recasting, I just don’t know what that is. (Maybe an order of operations thing?)

4

In your first case (ServerLastSuccessTime’s Date is less than ServerLastFailureTime’s date), this result fails because we cannot go directly from the ‘registry key value’ type to ‘hexadecimal’, it has to go first to integer then hexadecimal. So that part needs to change to

value "LastSessionResult" of key "Protected\ConnInfo" of keys of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts" of native registry as integer as hexadecimal as string

Illustrating with some test values -


q: (name of it, it) of values of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Test" of native registry
A: test_sz, 123
A: test_dword, 123
I: plural ( string, registry key value )

q: (name of it, it as integer as hexadecimal) of values of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Test" of native registry
A: test_sz, 7b
A: test_dword, 7b
I: plural ( string, string )

q: (name of it, it as hexadecimal) of values of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Test" of native registry
E: The operator "hexadecimal" is not defined.

I think there may be a larger logic problem though. Your first case checks whether the date of LastSuccess is less than the date of LastFailure, and returns the LastSessionResult. The second case checks only the Time part of LastSuccess less than the time part of LastFailure AND LastSessionResult > 0, and returnsLastSessionResult – the issue here is that the Date portion is ignored.

I’m not sure you’d get the result you expect if the Date of LastSuccess is greater than the Date of LastFailure, but the time is lesser.

Is it not valid to just check LastSessionResult for a non-zero value? If that doesn’t work, I think you need to compare the date and time together. You could do that by retrieving the registry values as string and converting to integers as in

q: (it as integer) of concatenation of substrings separated by "T" of substrings separated by "Z" of "20240711T103808Z"
A: 20240711103808

Then you could compare them once, instead of separate comparisons for the date and time portions.

3 Likes
5

Ah, I see, I didn’t notice I had as integer on one output and not the other.

Concatenating first would be more efficient to check time, thank you.

1 Like