(imported topic written by DotA)
Hi, I’m trying to setup an analysis to return the path of the url of an internet shortcut (xxx.url) located on the all users desktop. Unable to find anything in the Inspector library to get this. Looking to pull the info from the URL field in the “Web Documents” tab. Any suggestions? Thank you
(imported comment written by JasonHonda)
The .url file is just a real simple text file, looks like an ini file. You can do something with looking at ‘lines of file’ and parse out the url.
(imported comment written by NoahSalzman)
q: variables of file “c:/Google.url”
A:
{000214A0-0000-0000-C000-000000000046}
.Prop3=19,2
A:
InternetShortcut
.URL=http://www.google.com/
A:
InternetShortcut
.IDList=
q: following text of first “=” of variable whose (it contains “URL”) of file “c:/Google.url”
(imported comment written by SystemAdmin)
Not to hijack the thread but…
Noah - just wanted to say that little bit of relevance just made me say “wow”. It’s amazing how powerful the BigFix relevance language is when can wield it properly.
(imported comment written by DotA)
Excellent!!! Thank you all for posting a resolution so quickly. Noah, it made me say “Wow” too!!
(imported comment written by NoahSalzman)
Glad to hear it (as string)!
Someday we will let our Relevance Inspector developers out of their locked dungeon, but for now they just keep churning out awesome (sometimes hidden or unknown) Inspectors like “variables of …”. 
Cheers.
(imported comment written by Xiurzeph91)
I have something similar to this, but its a windows shortcut file. A .LNK extension. When I run the query below, QNA just comes back at me with the time it takes to run, but no errors. Is it telling me that there are no variables for LNK files? I’m sure this is something I could look up in the help file, but this network is airgapped to the extreme:
Q: variables OF file “C:\users\default\Desktop\shortcut.lnk”
T: 0.789 ms
Also when I do “lines of file…” I get a paragraph of hex values.
(imported comment written by JasonHonda)
(imported comment written by Xiurzeph91)
Thank you.