Relevance question GUID

Content Authoring
1

We’re having project to convert Active Directory GPO into BigFix Actions/Fixlets. In our environment we do have multiple languages configured.

Need some help with below relevance and see if this is possible

Command I run is following

auditpol.exe /set /subcategory:“Computer Account Management” /success:enable /failure:disable

Same command but using “GUID”

auditpol.exe /set /subcategory:“{0CCE9236-69AE-11D9-BED3-505054503030}” /success:enable /failure:disable

For relevance the following is used
I’ve only copied most important part of this

concatenation “|” of (if it then “ENABLED” else “DISABLED”) of (audit failure of it; audit success of it) of system policies of subcategories whose(name of it as lowercase = “Computer Account Management” as lowercase) of categories of audit policies

How would I be able to use GUID in the relevance to replace “Computer Account Management” with GUID

Thx for help

2

Nevermind found the answer

Updated relevance using GUID

((version of client >= “9.2.5.0”)and name of operating system as lowercase starts with “win10”) AND (not exists 1 whose(conjunction of((item 0 of item 0 of it = “IGNORED” or item 0 of item 0 of it = item 0 of item 1 of it)and(item 1 of item 0 of it = “IGNORED” or item 1 of item 0 of it = item 1 of item 1 of it))of((preceding text of it, following text of it)of first “|” of(“ENABLED|ENABLED”),(preceding text of it, following text of it)of first “|” of concatenation “|” of(if it then “ENABLED” else “DISABLED”)of(audit success of it; audit failure of it)of system policies of subcategories whose(guid of it = “{0CCE9236-69AE-11D9-BED3-505054503030}”)of categories of audit policies)))

1 Like
3

Are you just trying to make sure that it’s relevant when the success auditing is enabled and the failure auditing is disabled?

Something like this would be a lot more concise I think:

(not it) of (audit success of it and not audit failure of it) of system policies of subcategories whose (guid of it = "{0CCE9236-69AE-11D9-BED3-505054503030}") of categories of audit policies
1 Like
4

Hi William,
Thx for the update this relevance is indeed a lot more easier to read, and quicker to process. I’ve taken the other relevance from the legacy fixlets they also do the trick but as you mentioned harder to read a bit more complex.

Thx and will update accordingly.

1 Like