Regset64 DWORD Relevance Substitution Failed

Hi Everyone. Below is exactly what I ran in Fixlet Debugger and works great. But I copy this into a Fixlet Action Script and the logs show “Relevance Substitution Failed”. Any ideas where I made a typo?

regset64 "[{key whose ((value "DisplayName" of it as string as lowercase starts with "productname") AND (value "Publisher" of it as string starts with "Microsoft")) of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of x64 registry}]" "SystemComponent"=dword:0000001

Things I’ve tried:

  1. Added an extra curly bracket (before the resulting GUID); same “Relevance Substitution Failed” error in log. Plus, this does not work in Fixlet Debugger (ends up creating a new Key with the extra curly bracket)
  2. Tried the creatfile method making batch file with “reg add…” ; errors with “Substitution failed while writing file”; won’t even create the batch file

In the future please highlight your script and use the “code format” button so the forum does not mess with your quotes or underscores. I’ve edited this post for you already.

Try the relevance piece in the Fixlet Debugger. I suspect it could be this part

(value "DisplayName" of it as string as lowercase starts with "ProductName")

If you are casting the registry value ‘as lowercase’ and then comparing to a string with mixed-case you’ll get no result.

Thanks for the edit.

ProductName is just something I put in here and not the actual DisplayName. The actual name is in lowercase.

Also, your relevance in the substitution returns a value of type ‘registry key’ which won’t sit well in actionscript.

q: key whose ((value "DisplayName" of it as string as lowercase starts with "Microsoft Visual C++ 2019 X64 Minimum Runtime" as lowercase) AND (value "Publisher" of it as string starts with "Microsoft")) of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of x64 registry
A: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{455DF12C-7D43-4EFF-AE2F-43C8AF2817A3}
T: 5.916 ms
I: singular registry key

q: pathname of key whose ((value "DisplayName" of it as string as lowercase starts with "Microsoft Visual C++ 2019 X64 Minimum Runtime" as lowercase) AND (value "Publisher" of it as string starts with "Microsoft")) of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of x64 registry
A: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{455DF12C-7D43-4EFF-AE2F-43C8AF2817A3}
T: 2.743 ms
I: singular string

Sorry I don’t know what you mean by “won’t sit well in actionscript” and why you’re displaying QNA results.
QNA is pretty much how I came up with everything, ran it in “Action” of the FixletDebugger (which works).

Could it be erroring due to plural results? If I create afake key your approach works ok in the action debugger but if I add a send key with the same publis and starting name, it will throw relevance substitution failure.

Q: key whose ((value "DisplayName" of it as string as lowercase starts with "fake") AND (value "Publisher" of it as string starts with "Someone")) of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of x64 registry
A: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{MyFakeKey2}
E: Singular expression refers to non-unique object.

@trn is suggesting the object being returned as a registry key object as opposed to a string object could have been a factor though it seem to cast to a string ok, but using pathname of key would be a more suitable approach IMHO.

Actionscript will attempt to coerce substitutions to string, but not always successfully and there are differences between the debugger and the agent.

Does this happen on every machine?

The substitution will only work if there is one (and exactly one) key that matches your spec.

Very interesting… here are my results (actually created a fake key for “productname”). Again, it’s really odd how it works within Fixlet Debugger, but not when copied/pasted into Action Script of a Fixlet:

Q: key whose ((value "DisplayName" of it as string as lowercase starts with "productname") AND (value "Publisher" of it as string starts with "Microsoft")) of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of x64 registry
A: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FAKE000KEY000FULL000OF000NOTHING
T: 1.074 ms

Agreed. If same machine and same action script works in debugger doesn’t work in the fixlet, that is odd but maybe at the client level its not casting the registry object to a string in the same way the user based debugger is. I’d definatley try the pathname of just to ensure it is a string that the actionscript is using but do be keep in mind the potential for non-unique results may still exist depending on what your final relevance will be checking for. Maybe even go as far as to capture a plural expression to a parameter in case that throws any extra info that might help find the issue.

parameter "MyKey" = "{pathnames of keys whose ((value "DisplayName" of it as string as lowercase starts with "fake") AND (value "Publisher" of it as string starts with "Someone")) of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of x64 registry}"
regset64 "[{parameter "MyKey"}]" "SystemComponent"=dword:0000001

I did try that parameter thing, too, earlier…
I just tried “pathname of…” and even tried to put “…as string” on another attempt.

And every iteration of it all succeeds in the Fixlet Debugger, but when run in a BigFix Action, all the logs return “Command failed (Relevance substitution failed)”.

Gonna try out a PowerShell solution; see how that goes…

I just tried your actionscript from your opening post on my dev system and both the debugger and the fixlet action updates the key correctly so I’m at as much as a loss as you are.

When you run the Action, are you using the exact same dummy product name as in the debugger, or are you changing it to the real product name?
If there’s more than one match, you’ll get an error.

Both. I actually created a dummy key for the purposes of this thread to show screenshots and all.
I assure you there’s only one copy of this key in the registry. Otherwise, I would imagine the QNA would’ve listed all the keys, and the FixletDebugger would’ve errored out.

If you switch the Fixlet Debugger to run in “Local Client Evaluation Mode”, do you get the same result? I wonder whether some key has custom permissions to Deny access to the LocalSystem account?

Yes. Took a bit longer, but identical results.

1 Like

Have you turned on debug logging on the client in question? Anything interesting there?

for “relevance substitution failed” I usually like a progressive approach with parameters,

parameter "1"="{exists x64 registry}"
parameter "2"="{exists key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of x64 registry}"
parameter "3"="{exists keys of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of x64 registry}"
parameter "4"="{number of keys of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of x64 registry}"
parameter "5"="{number of keys whose (exist value "DisplayName" of it) of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of x64 registry}"

and so on.
That way you can see the exact line where it breaks down.

I should have focused more on the alternative batch file method (createfile) I mentioned in my first post. I cannot pinpoint exactly what made it work at the moment but … honestly, I’m exhausted and don’t care LOL. Here’s the script:

createfile until_end_
{concatenation "%0d%0a" of (("reg add %22" & pathname of it & "%22 /v %22SystemComponent%22 /t REG_DWORD /d 1 /f /reg:64") of keys whose ((value "DisplayName" of it as string as lowercase starts with "productname") AND (value "Publisher" of it as string starts with "Microsoft")) of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of x64 registry)}_end_
delete widget.bat
copy __createfile widget.bat
override wait
hidden=true
completion=job
wait widget.bat
2 Likes

regset64 can only handle single inputs.

Your concatenation and BAT file allows for the possibility that there are more than one match and to add the key for all matches.

Nice work!

1 Like