Odd error message for analysis

Content Authoring
1

(imported topic written by dmoore21)

Looking for help on an error message that I’ve never seen before…

I’ve got the following relevance set up as an analysis for some WinXP machines:

if exists audit policy then ((if conjunction of audit successes of system policies of subcategories of it then “Success : Enabled” else “Success : Disabled”); (if conjunction of audit failures of system policies of subcategories of it then “Failure : Enabled” else “Failure : Disabled”)) of categories whose (name of it as lowercase = “Account Logon” as lowercase) of audit policies else if exists key “HKLM\SECURITY\Policy\PolAdtEv” of x32 registry then ((if bit 0 of it then “Success : Enabled” else “Success : Disabled”); (if bit 1 of it then “Failure : Enabled” else “Failure : Disabled”)) of (it as bit set) of (hexadecimal integer it) of (following text of position 72 of preceding text of position 74 of it) of (it as string) of default value of key “HKLM\SECURITY\Policy\PolAdtEv” of x32 registry else “error”)

But I receive the following error message (in tool tip form):

This expression could not be evaluated: class NoSuchProcAddress

Anyone encounter this one before?

2

(imported comment written by vpetrell)

I tried your relevance and couldn’t parse it as is, I had to remove the bracket at the end. Once I did that it evaluated fine.

q:if exists audit policy then ((if conjunction of audit successes of system policies of subcategories of it then “Success : Enabled” else “Success : Disabled”); (if conjunction of audit failures of system policies of subcategories of it then “Failure : Enabled” else “Failure : Disabled”)) of categories whose (name of it as lowercase = “Account Logon” as lowercase) of audit policies else if exists key “HKLM\SECURITY\Policy\PolAdtEv” of x32 registry then ((if bit 0 of it then “Success : Enabled” else “Success : Disabled”); (if bit 1 of it then “Failure : Enabled” else “Failure : Disabled”)) of (it as bit set) of (hexadecimal integer it) of (following text of position 72 of preceding text of position 74 of it) of (it as string) of default value of key “HKLM\SECURITY\Policy\PolAdtEv” of x32 registry else “error”

A: Success : Disabled

A: Failure : Disabled

T: 123.808 ms