Neither QnA nor client seeing Windows files?

[straffin]

Investigating something else, I came across this oddity:

From PowerShell:

PS C:\Users\me> (gci "C:\WINDOWS\System32\sp*" -File).count
36

From QnA (using Fixlet Debugger, Client, and Query Channel with Client)

Q: number of (files of folder "C:\WINDOWS\System32\") whose (name of it as lowercase starts with "sp")
A: 15
T: 52.000 ms

What gives?

[D.Dean]

My guess is WOW Redirection

https://bigfix-wiki.hcltechsw.com/wikis/home?lang=en-us#!/wiki/BigFix%20Wiki/page/Using%20WOW64%20Redirection

I am not positive but if you evaluate as the local client, it may work.

[JasonWalker]

Wow64 redirection strikes again

Try native folder "C:\Windows\system32"

[JasonWalker]

That brings up an important point. The Relevance statements themselves are subject to wow64 redirection, and to avoid redirection we have to use a separate set of inspectors - “native files” or “x64 files” or “native registry”, etc.

The action uses wow64 redirection false statement on ActionScript only applies to the processes we launch from the action, with the ‘wait’ or ‘run’ commands. The relevance substitutions in the actionscript still need to reference the ‘x64’ or ‘native’ versions of the inspectors

[straffin]

if you evaluate as the local client, it may work.

No dice… tried that.

[trn]

Looks very much like 32-bit redirection to me too…

Powershell:
PS C:\trn> (gci “C:\WINDOWS\System32\sp*” -File).count
42

QnA:
Q: number of (files of folder “C:\WINDOWS\System32”) whose (name of it as lowercase starts with “sp”)
A: 17
I: singular integer

Q: number of (files of native folder "C:\WINDOWS\System32\") whose (name of it as lowercase starts with "sp")
A: 42
I: singular integer

Q: number of files whose (name of it as lowercase starts with "sp") of system folder 
A: 17
I: singular integer

Q: number of files whose (name of it as lowercase starts with "sp") of native system folder 
A: 42
I: singular integer