Relevance from Registry Key

[rtreviza]

Hello all,

Does anyone knows why my relevance keeps showing “False”:

What i’m missing??

[jmaple]

Try using “native registry”

(exists key "HKLM\SOFTWARE\BigFix\LinkSpeed" whose (exists values whose (name of it = "LinkSpeed" AND it as string as lowercase = "555k" as lowercase) of it) of native registry

You could also attempt to check for it in the x64 or x32 registry.

if exists key "HKLM\SOFTWARE\BigFix\LinkSpeed" of x64 registry then (exists key "HKLM\SOFTWARE\BigFix\LinkSpeed" whose (exists values whose (name of it = "LinkSpeed" AND it as string as lowercase = "555k" as lowercase) of it) of x64 registry else if exists key "HKLM\SOFTWARE\BigFix\LinkSpeed" of x32 registry then (exists key "HKLM\SOFTWARE\BigFix\LinkSpeed" whose (exists values whose (name of it = "LinkSpeed" AND it as string as lowercase = "555k" as lowercase) of it) of x32 registry else false

[rtreviza]

Both return “False”…

[jmaple]

Then the value isn’t there.

[rtreviza]

It is …i checked

[jmaple]

If you take out the “Wow6432Node” path does that result in true? You’ll notice my relevance does not include it.

[rtreviza]

[jmaple]

Remove the “native” as well and just do “registry”

[rtreviza]

[strawgate]

What does this return?

Q: exists key "HKEY_LOCAL_MACHINE\Software\BigFix" of registry
Q: exists key "HKEY_LOCAL_MACHINE\Software\BigFix\LinkSpeed" of registry
Q: names of values of key "HKEY_LOCAL_MACHINE\Software\BigFix\LinkSpeed" of registry

[rtreviza]

[strawgate]

Ok – link speed is a value not a key so we have to grab it with value relevance

Q: (value "LinkSpeed" of key "HKLM\Software\BigFix" of registry) = "555k"

or rather if Linkspeed is in a key called LinkSpeed…

Q: (value "LinkSpeed" of key "HKLM\Software\BigFix\LinkSpeed" of registry) = "555k"

[rtreviza]

[strawgate]

… try

Q: (value "LinkSpeed" of key "HKEY_LOCAL_MACHINE\Software\BigFix" of registry) = "555k"

or rather if Linkspeed is in a key called LinkSpeed…

Q: (value "LinkSpeed" of key "HKEY_LOCAL_MACHINE\Software\BigFix\LinkSpeed" of registry) = "555k"

Can you run this?

("-" & name of it & "-") of values of key "HKEY_LOCAL_MACHINE\Software\BigFix\LinkSpeed" of registry

[rtreviza]

[strawgate]

Added it late – Can you run this?

("-" & name of it & "-") of values of key "HKEY_LOCAL_MACHINE\Software\BigFix\LinkSpeed" of registry

[rtreviza]

if on the last test i erase the “linkSpeed”:

[strawgate]

The issue is that the value isn’t called, “LinkSpeed” the value is called, "Link Speed " with a space after speed.

You should either fix whatever sets this registry key or just use:

Q: (value "LinkSpeed " of key "HKEY_LOCAL_MACHINE\Software\BigFix\LinkSpeed" of registry) = "555k"

If you do what you just previously mentioned (just value of key) it will throw an error if you ever put another value there and it will catch a value with any name not just linkspeed.

[rtreviza]

Perfect…thank you…

[sidans]

Hello
I was trying to use the solution posted in this article to create a relevance to detect following registry value on the machines. but for some reason I am getting flowing error:

Q:name of values of key “HKEY_LOCAL_MACHINE\Software\HRSA” of registry
E: Singular expression refers to nonexistent object.