I can’t seem to get the right mix of syntax on this; been fighting w/ it about an hour. if anyone sees anything obvious, I’d appreciate the assistance. I’m trying to create an automatic group for endpoint targetting. I want to see systems that: 1) have less than version 5.5.1.388 of mcafee agent, and 2) install date was before March 1st. Here’s what I’ve got.
exists value “DisplayVersion” whose (((it < “5.5.1.388”) of (it as string as version)) of keys whose (value “DisplayName” of it as string as lowercase contains “McAfee Agent”) AND (value “InstallDate” of it as string < “20190207”) of key “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall”) of native registry
Try something like this. If the keys are there, then this should work.
remember it has to be lower case, you are saying it in the code.
(values "DisplayName" of it, values "DisplayVersion" of it) of keys whose (value "DisplayName" of it as string as lowercase contains "mcafee agent") of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of (registry;native registry)
exists keys whose (((exists value “DisplayName” whose (it as string as lowercase contains “mcafee agent” ) of it) AND ((exists value “DisplayVersion” whose (it as string != “5.5.1.388” ) of it) AND (exists value “InstallDate” whose (it < “20190309” ) of it)))) of key “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall” of native registry