(imported comment written by tim7ad91)
psisk,
I don’t have McAfee, but I found that using substring between “%22” works for other services
So for Symantec it looks like
q: version of file (substring between “%22” of (image path of running service “Symantec AntiVirus”))
A: 10.0.2.2000
T: 49.239 ms
I: singular version
I would think you could change yours to:
q: version of file (substring between “%22” of (image path of running service “McAfeeFramework”))
Maybe one of the pros on here can explain why the - substring before " /" doesn’t work.
I found a service that uses a switch similar to McAfee. The image path of the Logical Disk Manager service, dmadmin looks like
q: (image path of running service “dmadmin”)
A: %25SystemRoot%25\System32\dmadmin.exe /com
Notice it doesn’t return the image path in quotes, like Symantec and McAfee do. What’s more is that it returns and encoded environment variable, so, I can’t test effectively. However, using this service I tried several different things including encoding with the ascii hex value for “/”. - %2F without success. I ended up with the same errors you did.
Hopefully the expression using %22 above will work for you.
Like you, I’d still want to understand why your original expression didn’t work.
Guess I’ve added to the riddle instead of solving it.
-tim7ad