KMS Server Analysis Incorrect

Content Authoring
1

The following analysis in Windows Licensing Information is not correct. There is not SL key. There are two subkeys under the key SoftwareProtectionPlatform where the value DiscoveredKeyManagementServiceName is. The correct path is: HKEY_USERS\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f\2de67392-b7a7-462a-b1ca-108dd189f588.

Additionally, the analysis evaluates every 5 minutes which seems very excessive.

Incorrect Analysis

 if exists key "HKEY_USERS\S-1-5-20\Software\Microsoft\Windows 
NT\CurrentVersion\SL" of registry and exists value 
"DiscoveredKeyManagementServiceName" of key "HKEY_USERS\S-1-5- 
  20\Software\Microsoft\Windows NT\CurrentVersion\SL" of registry then 
 value 
  "DiscoveredKeyManagementServiceName" of key "HKEY_USERS\S-1-5- 
  20\Software\Microsoft\Windows NT\CurrentVersion\SL" of registry as string 
   else nothing

I am trying to rewrite it with the following relevance which seems to be working but not sure it is the best way.

(value “DiscoveredKeyManagementServiceName” of it) of keys of keys of key “HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform” of native registry

2

On which version & edition of Windows are you seeing this behavior? The “SL” key appears to be valid at least for some.

3

We are using Windows 10 Pro 22H2 and Windows 11 Pro 24H2. This key is definitely not in either version.

This relevance is not correct. It returns two results: the first being correct and the second return is an error, “Error: Singular expression refers to nonexistent object”.

(value “DiscoveredKeyManagementServiceName” of it) of keys of keys of key 
“HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\SoftwareProtectionPlatform” of native registry
4

I am not exactly sure how this relevance works, but it seems to work.

((value "DiscoveredKeyManagementServiceName" of it as string | "")) of (it;keys of it; keys of keys of it; keys of keys of keys of it; keys of keys of keys of keys of it) whose (exists value "DiscoveredKeyManagementServiceName" of it) of keys "HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" of registry
5

I can confirm this for Win 11 Pro 23H2 and 24H2.

HKEY_USERS\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f\2de67392-b7a7-462a-b1ca-108dd189f588