Relevance "exists file" will not find specified file if it is in subfolder path

Hello. I need relevance to show true when a file is found. I’ve tried
Q: exists file “scfndis.sys” of folders “drivers” of folders of folder "C:\Windows\System32"
A: False


Q: exists file "C:\Windows\System32\drivers\scfndis.sys"
A: False

The ‘exists file’ works with one folder level only. such as:
exists file "C:\Windows\scfndis.sys"
A: True

How can I fins a file burried in sub folders?

Thanks for your help.

The Windows\System32 folder requires special handling because of the 32-bit redirection that is applied to the BigFix client. When the client tries to inspect the system32 folder, it’s actually redirected to \Windows\Syswow64.


This would look for a subdirectory of System32 that itself contains a “drivers” folder - i.e. “C:\Windows\System32\A\drivers” or “C:\Windows\System32\B\drivers”.

Try this instead to get around the 32-bit redirection:

Q: exists file "scfndis.sys" of folders "drivers" of native system folder

There are certain properties you can use to avoid the 32-bit redirection, which applies to the System32 and Program Files folders, and to HKLM\Software in the Registry:

q: (properties as string)whose (it contains "x32" or it contains "x64" or it contains "native")
A: x64 variables of <environment>: environment variable
A: x64 variable <string> of <environment>: environment variable
A: expand x32 environment string of <string>: string
A: expand x64 environment string of <string>: string
A: system x32 file <string>: file
A: system x64 file <string>: file
A: x32 file <string>: file
A: x32 folder <string>: folder
A: x32 application <string>: application
A: x64 file <string>: file
A: x64 folder <string>: folder
A: x64 application <string>: application
A: native file <string>: file
A: native folder <string>: folder
A: native application <string>: application
A: x64 of <operating system>: boolean
A: x32 of <operating system>: boolean
A: native registry: registry
A: x32 registry: registry
A: x64 registry: registry
A: system x32 folder: folder
A: system x64 folder: folder
A: native system folder: folder
A: program files x32 folder: folder
A: program files x64 folder: folder
A: native program files folder: folder
T: 10.087 ms
I: plural string

Hey I didn’t notice when “native file” and “native folder” showed up in 9.1.1, that’s helpful for some other problems I had with following shortcut targets to C:\Program Files !

1 Like

Thank you that did the trick!

Next question. I am also looking for a certain version of that file. How can accomplish this?

You want to ensure the file exists AND has the right version? Or that if the file exists, it has the right version?

Q: exists file "scfndis.sys" whose (version of it = version "") of folders "drivers" of native system folder

Q: not exists file "scfndis.sys" whose (version of it < version "") of folders "drivers" of native system folder
1 Like

Thanks Jason the Not statement does what I need.

One last question(I hope).
Now that I found the old driver, I want to replace it with a newer one. I’ve been trying to get a batch file to do it but it will not do anything. Below are the contents of my replace.bat file.

REM stop Sophos Client Firewall service
taskkill /im SCFService.exe /f

REM Rename old scfndis driver to scfndis.bak
copy C:\Windows\System32\drivers\scfndis.sys C:\Windows\System32\drivers\scfndis.bak
delete C:\Windows\System32\drivers\scfndis.sys
copy scfndis.sys C:\Windows\System32\drivers


Any thoughts?

Thank you again, Andres

You have to do something similar - especially when using copy commands - as they will also be doing the redirected path

Use the following at the top of the action (be aware this affects the entire action)

// Disable wow64 redirection on x64 OSes
action uses wow64 redirection {not x64 of operating system}

Does this work in a batch file? I think driver files are protected, and in particular replacing a signed driver would be difficult (there are protections intended to prevent malware from doing this).

You might look at using pnputil.exe for command-line installation of drivers.

Yes Jason that worked. Thank you for your help.