Issue with relevance substitution

Content Authoring
1

I have some experience with relevance, but it seems I do not write fixlets often enough to have become proficient… I am working on a fixlet to change a registry key value. The relevance looks like this:

regset “[{key whose (value “ProfileImagePath” of it as string contains “user_a”) of keys “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList” of (x64 registries)}]” “ProfileImagePath”=“c:\users\user_b”

The relevance expression itself evaluates correctly when run both in a debugger and as an analysis:

key whose (value “ProfileImagePath” of it as string contains “user_a”) of keys “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList” of (x64 registries)

But when I try to use the expression as substitution I get errors:

Operator “ProfileImagePath” is undefined.

I have done some research, but figure I am either missing something simple or I am completely misunderstanding how relevance substitution works.

2

Are you putting "ProfileImagePath"="c:\users\user_b" on a new line in the action script? It should be on the same line as your regset command (https://developer.bigfix.com/action-script/reference/registry/regset.html)

Is that maybe it?

1 Like
3

No. It is on the same line.

4

Could it be you are returning a registry object and not a string? How about casting to string, ie

"[{key whose (value "ProfileImagePath" of it as string contains "user_a") of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" of (x64 registries) as string}]"

or

"[{pathname of key whose (value "ProfileImagePath" of it as string contains "user_a") of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" of (x64 registries)}]"

5

The relevance should work as the string cast happens automatically. casting it to a string is syntactically more correct though.

Few other things to note:

  • Action script should probably deal with wow64 redirection (if you don’t want to set this value in the “wow6432” branch)
  • It is important that the relevance returns one entry and not a list of entries

However the error leads me to think that this might be something else. @ddoran – can you check whether you are copying “rich text” quotes into the action script? If you are not sure, try copying the statement into notepad first, fixing the quotes and then copying it into the action script.

Hope that helps

6

Oh, yes its looking at x64 registries so should it not be using regset64 instead of regset?

7

I had considered that, but since the x64 registries returns the path to the 64 bit registry location is that still necessary? I will try with reset64.

8

It should work the way you have it. Relevance returns a string and it really doesn’t care how it got to the string.

You can also paste your action XML here and we can take a look at the details of the action. That might help with finding the root cause of your problem.

9

I have replaced all punctuation and tried with regset64. This has cleared the errors and the fixlet is now showing to have completed sucessfully, but the value is not being changed. Going to do some more experimenting and see if I can figure out what’s going on here. Appreciate the help, guys!

10

Not really sure what the issue was with regset, but after quite a bit of experimentation, this is what worked:

action uses wow64 redirection false

delete __createfile
delete wizardedit.reg

createfile until @end_create_reg_file
Windows Registry Editor Version 5.00
[{key whose (value “ProfileImagePath” of it as string contains “user_a”) of keys “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList” of (x64 registries)}]
“ProfileImagePath”=“c:\users\user_b”
@end_create_reg_file

move __createfile wizardedit.reg
waithidden regedit /s “wizardedit.reg”

Seems the webboard removed the escape characters from the code, but the line “ProfileImagePath”="c://users//user_b"
needs to have double backslashes, guessing as escape characters for regedit?

2 Likes