WMI Query Error: The expression could not be evaluated:Inv.Query

Content Authoring
1

(imported topic written by Matt.Johnson)

I used the Relevance Builder built in to BigFix to generate a simple query. It’s intended to look under root\CIMV2\Security\MicrosoftTpm for the property of IsActivated_InitalValue to confirm it is True

Here is the code it generated:

(concatenation of (string values of selects “IsActivated_InitalValue from \root\CIMV2\Security\MicrosoftTpm” of wmi) as lowercase contains “True” as lowercase )

The Debugger responds with:

Error: The expression could not be evaluated: Windows Error: Invalid query

I was hoping someone could tell me where I am going wrong in my relevance query here. Also, I don’t have “Match Case” checked, so what is it adding " as lowercase" to the query?

I have confirmed that the value is present and True via WMI Explorer running as SYSTEM.

Thanks for any assistance!

2

(imported comment written by Lee Wei)

I spotted 2 errors in the Relevance statement:

  • IsActivated_InitalValue is missing an “i” and should be IsActivated_InitialValue
  • \root\CIMV2\Security\MicrosoftTpm is the WMI namespace and not the class. The name of the class is Win32_TPM

So this will work:

(concatenation of (string values of selects “IsActivated_InitialValue from Win32_TPM” of wmi “root\CIMV2\Security\MicrosoftTpm”) as lowercase contains “True” as lowercase )

Or simply:

string values of selects “IsActivated_InitialValue from win32_tpm” of wmi “root\CIMV2\Security\MicrosoftTpm”

Lee Wei

3

(imported comment written by Matt.Johnson)

Thank you.

My 1st grade spelling teacher would be ashamed of me :slight_smile: