Relevance "exists file" will not find specified file if it is in subfolder path

Content Authoring
1

Hello. I need relevance to show true when a file is found. I’ve tried
Q: exists file “scfndis.sys” of folders “drivers” of folders of folder "C:\Windows\System32"
A: False

or

Q: exists file "C:\Windows\System32\drivers\scfndis.sys"
A: False

The ‘exists file’ works with one folder level only. such as:
exists file "C:\Windows\scfndis.sys"
A: True

How can I fins a file burried in sub folders?

Thanks for your help.

2

The Windows\System32 folder requires special handling because of the 32-bit redirection that is applied to the BigFix client. When the client tries to inspect the system32 folder, it’s actually redirected to \Windows\Syswow64.

Additionally,

This would look for a subdirectory of System32 that itself contains a “drivers” folder - i.e. “C:\Windows\System32\A\drivers” or “C:\Windows\System32\B\drivers”.

Try this instead to get around the 32-bit redirection:

Q: exists file "scfndis.sys" of folders "drivers" of native system folder

There are certain properties you can use to avoid the 32-bit redirection, which applies to the System32 and Program Files folders, and to HKLM\Software in the Registry:

q: (properties as string)whose (it contains "x32" or it contains "x64" or it contains "native")
A: x64 variables of <environment>: environment variable
A: x64 variable <string> of <environment>: environment variable
A: expand x32 environment string of <string>: string
A: expand x64 environment string of <string>: string
A: system x32 file <string>: file
A: system x64 file <string>: file
A: x32 file <string>: file
A: x32 folder <string>: folder
A: x32 application <string>: application
A: x64 file <string>: file
A: x64 folder <string>: folder
A: x64 application <string>: application
A: native file <string>: file
A: native folder <string>: folder
A: native application <string>: application
A: x64 of <operating system>: boolean
A: x32 of <operating system>: boolean
A: native registry: registry
A: x32 registry: registry
A: x64 registry: registry
A: system x32 folder: folder
A: system x64 folder: folder
A: native system folder: folder
A: program files x32 folder: folder
A: program files x64 folder: folder
A: native program files folder: folder
T: 10.087 ms
I: plural string

Hey I didn’t notice when “native file” and “native folder” showed up in 9.1.1, that’s helpful for some other problems I had with following shortcut targets to C:\Program Files !

1 Like
3

Thank you that did the trick!

Next question. I am also looking for a certain version of that file. How can accomplish this?
version 9.2.0.2929

4

You want to ensure the file exists AND has the right version? Or that if the file exists, it has the right version?

Q: exists file "scfndis.sys" whose (version of it = version "9.2.0.2929") of folders "drivers" of native system folder

Q: not exists file "scfndis.sys" whose (version of it < version "9.2.0.2929") of folders "drivers" of native system folder
1 Like
5

Thanks Jason the Not statement does what I need.

One last question(I hope).
Now that I found the old driver, I want to replace it with a newer one. I’ve been trying to get a batch file to do it but it will not do anything. Below are the contents of my replace.bat file.

REM stop Sophos Client Firewall service
taskkill /im SCFService.exe /f

REM Rename old scfndis driver to scfndis.bak
copy C:\Windows\System32\drivers\scfndis.sys C:\Windows\System32\drivers\scfndis.bak
delete C:\Windows\System32\drivers\scfndis.sys
copy scfndis.sys C:\Windows\System32\drivers

exit

Any thoughts?

Thank you again, Andres

6

You have to do something similar - especially when using copy commands - as they will also be doing the redirected path

Use the following at the top of the action (be aware this affects the entire action)

// Disable wow64 redirection on x64 OSes
action uses wow64 redirection {not x64 of operating system}
7

Does this work in a batch file? I think driver files are protected, and in particular replacing a signed driver would be difficult (there are protections intended to prevent malware from doing this).

You might look at using pnputil.exe for command-line installation of drivers.

8

Yes Jason that worked. Thank you for your help.