Report All Different Instances per Registry

Content Authoring BigFix.me
1

Hi all,

I was hoping to get some light on what I’m trying to do.

if (exists keys whose (value “SmartClientIDs” of it as string as lowercase starts with “te0000999999”) of key > “HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Ellie Mae\SmartClient” of x64 registry) then (“Test-Sunset”) else (if (exists keys whose (value “SmartClientIDs” of it as string as lowercase starts with “te000000000”) of key “HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Ellie Mae\SmartClient” of x64 registry) then (“Test-NEW”) else (if (exists keys whose (value “SmartClientIDs” of it as string as lowercase starts with “b654321”) of key “HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Ellie Mae\SmartClient” of x64 registry) then (“CD and Wholesale”) else (if (exists keys whose (value “SmartClientIDs” of it as string as lowercase starts with “b123456”) of key “HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Ellie Mae\SmartClient” of x64 registry) then (“Assumptions”) else (“No Encompass Found”))))

However, when I’m looking at it in the properties column I only get one instance. In some cases it there are 2 instances. So I’m planning to steal some of this code. Also, I have some machines that shows as

unique values of ((if (exists value “DisplayVersion” of it AND exists value “DisplayName” of it) then (value “DisplayName” of it as string & " | " & value “DisplayVersion” of it as string) else (if (exists value “DisplayName” of it AND not exists value “DisplayVersion” of it) then (value “DisplayName” of it as string & " | <N/A>") else nothings)) of keys whose (value “DisplayName” of it as string as lowercase starts with “adobe air”) of key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall” of it) of (if x64 of operating system then (x64 registry;x32 registry) else registry)

2

So, based on the if…then…else statement, you’re only going to get the first matching result. Instead you need to get plural results. You can do this with by building a “set” of results on the fly by delimiting the clauses with semicolons. There’s also no need to force ‘x64 registry’ when you’re only looking beneath Wow6432Node. Try this -

  1. Get all of the SmartClientIDs

values "SmartClientIDs" of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Ellie Mae\SmartClient" of registry as string

  1. Transform the results based on your criteria. An If…Then…Else must return a result, but “nothing” is a valid (empty) plural result. If none of them match you’ll get an empty result rather than “No Encompass Found”

((if it starts with "te0000999999" then "Test-Sunset" else nothing); (if it starts with "te000000000" then "Test-NEW" else nothing); (if it starts with "b654321" then "CD and Wholesale" else nothing); (if it starts with "b123456" then "Assumptions" else nothing))of values "SmartClientIDs" of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Ellie Mae\SmartClient" of registry as string as lowercase

1 Like
3

Thank you Jason, For some reason Im getting errors. But I can for sure is this to shortcut code. using it its taking a while to get adjust to use it,
I also not able to find the values unless looking under [quote=“JasonWalker, post:2, topic:23347”]
Wow6432Node
[/quote]

not sure if I’m doing something wrong that BigFix does automatically.