The problem I’m having is that some of our users have a different or multiple PROFILRNAME entrée. I was hoping to find a wildcard that I could use that would be something like this.
exists key “HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles*.*\0a0d020000000000c000000000000046” of registry
and modify the value name “0003041b to FF:FF:FF:FF
Lookup the value in the “Outlook” profile for the current user:
q: values “0003041b” of keys “HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046” of registry
Same as above, but adapted for any profile:
q: values “0003041b” of keys “0a0d020000000000c000000000000046” of keys of keys “HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles” of registry
Same as above, but adapted to run looking for the logged in user (because if the agent ran this, then it would return results for the “SYSTEM” account branch):
q: values “0003041b” of keys “0a0d020000000000c000000000000046” of keys of keys “Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles” of current user keys (logged on users) of registry
Same as above, but adapted to report if any profile doesn’t have the value “FFFFFF”:
q: exist values “0003041b” whose (it as string != “FFFFFFFF”)of keys “0a0d020000000000c000000000000046” of keys of keys “Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles” of current user keys (logged on users) of registry