Relevance from Registry Key

rtreviza · January 22, 2016, 12:55pm

Hello all,

Does anyone knows why my relevance keeps showing “False”:

What i’m missing??

jmaple · January 22, 2016, 1:05pm

Try using “native registry”

(exists key "HKLM\SOFTWARE\BigFix\LinkSpeed" whose (exists values whose (name of it = "LinkSpeed" AND it as string as lowercase = "555k" as lowercase) of it) of native registry

You could also attempt to check for it in the x64 or x32 registry.

if exists key "HKLM\SOFTWARE\BigFix\LinkSpeed" of x64 registry then (exists key "HKLM\SOFTWARE\BigFix\LinkSpeed" whose (exists values whose (name of it = "LinkSpeed" AND it as string as lowercase = "555k" as lowercase) of it) of x64 registry else if exists key "HKLM\SOFTWARE\BigFix\LinkSpeed" of x32 registry then (exists key "HKLM\SOFTWARE\BigFix\LinkSpeed" whose (exists values whose (name of it = "LinkSpeed" AND it as string as lowercase = "555k" as lowercase) of it) of x32 registry else false

rtreviza · January 22, 2016, 1:12pm

Both return “False”…

jmaple · January 22, 2016, 1:20pm

Then the value isn’t there.

rtreviza · January 22, 2016, 1:21pm

It is …i checked

jmaple · January 22, 2016, 1:22pm

If you take out the “Wow6432Node” path does that result in true? You’ll notice my relevance does not include it.

rtreviza · January 22, 2016, 1:28pm

jmaple · January 22, 2016, 1:28pm

Remove the “native” as well and just do “registry”

rtreviza · January 22, 2016, 1:29pm

strawgate · January 22, 2016, 1:32pm

What does this return?

Q: exists key "HKEY_LOCAL_MACHINE\Software\BigFix" of registry
Q: exists key "HKEY_LOCAL_MACHINE\Software\BigFix\LinkSpeed" of registry
Q: names of values of key "HKEY_LOCAL_MACHINE\Software\BigFix\LinkSpeed" of registry

rtreviza · January 22, 2016, 1:33pm

strawgate · January 22, 2016, 1:36pm

Ok – link speed is a value not a key so we have to grab it with value relevance

Q: (value "LinkSpeed" of key "HKLM\Software\BigFix" of registry) = "555k"

or rather if Linkspeed is in a key called LinkSpeed…

Q: (value "LinkSpeed" of key "HKLM\Software\BigFix\LinkSpeed" of registry) = "555k"

rtreviza · January 22, 2016, 1:42pm

strawgate · January 22, 2016, 1:44pm

… try

Q: (value "LinkSpeed" of key "HKEY_LOCAL_MACHINE\Software\BigFix" of registry) = "555k"

or rather if Linkspeed is in a key called LinkSpeed…

Q: (value "LinkSpeed" of key "HKEY_LOCAL_MACHINE\Software\BigFix\LinkSpeed" of registry) = "555k"

Can you run this?

("-" & name of it & "-") of values of key "HKEY_LOCAL_MACHINE\Software\BigFix\LinkSpeed" of registry

rtreviza · January 22, 2016, 1:47pm

strawgate · January 22, 2016, 1:47pm

Added it late – Can you run this?

("-" & name of it & "-") of values of key "HKEY_LOCAL_MACHINE\Software\BigFix\LinkSpeed" of registry

rtreviza · January 22, 2016, 1:53pm

if on the last test i erase the “linkSpeed”:

strawgate · January 22, 2016, 1:56pm

The issue is that the value isn’t called, “LinkSpeed” the value is called, "Link Speed " with a space after speed.

You should either fix whatever sets this registry key or just use:

Q: (value "LinkSpeed " of key "HKEY_LOCAL_MACHINE\Software\BigFix\LinkSpeed" of registry) = "555k"

If you do what you just previously mentioned (just value of key) it will throw an error if you ever put another value there and it will catch a value with any name not just linkspeed.

rtreviza · January 22, 2016, 2:06pm

Perfect…thank you…

anon35136095 · January 18, 2019, 8:10pm

Hello
I was trying to use the solution posted in this article to create a relevance to detect following registry value on the machines. but for some reason I am getting flowing error:

Q:name of values of key “HKEY_LOCAL_MACHINE\Software\HRSA” of registry
E: Singular expression refers to nonexistent object.