WMI - Use a 'where' clause with 'select'

Hi,

I’m trying to write an analysis that will show me WMI information about an AMD driver on Windows 7. The following relevance clause isn’t working.

selects “DeviceName, DriverVersion, DriverDate from Win32_PnPSignedDriver” of wmi whose “DeviceName” contains “AMD”

The result is below…

A boolean expression is required.

How do I throw in a where clause for this type of query?

Thanks

Something like this:

selects "caption from Win32_DiskDrive WHERE MediaType = 'Fixed hard disk media'" of wmi

You’ll want a Where clause in the selects statement

1 Like

As @strawgate suggests, you can put the where clause directly within the WMI select statement (WQL):

selects “DeviceName, DriverVersion, DriverDate from Win32_PnPSignedDriver where DeviceName like ‘%25AMD%25’” of wmi

An alternative approach would be to filter the desired answers via Relevance with a ‘whose clause’ rather than via WQL:

((property “DeviceName” of it, property “DriverDate” of it, property “DriverVersion” of it) of select objects “DeviceName, DriverVersion, DriverDate from Win32_PnPSignedDriver” of wmi) whose (item 0 of it as string contains “AMD”)

3 Likes

Great! This is awesome. So I could use the relevance to find PCs with a certain driver? Thanks

1 Like

These are not exactly what you are looking for, but they are related:

I’d like to have the query return a true or false value, if the driver version matches. So far, it is not working.

Q: selects “DeviceName, DriverVersion, DriverDate from Win32_PnPSignedDriver where DeviceName like ‘%25AMD%25’” of wmi where “DriverVersion” = “15.201.1201.0”
E: The operator “wmi where” is not defined.

Try this out:

exists selects "DeviceName, DriverVersion, DriverDate from Win32_PnPSignedDriver where DeviceName like '%25AMD%25' and DriverVersion='15.201.1201.0'" of wmi
1 Like

where is for inside a WMI select statement. If you are doing it outside like that, you would need to use a whose statement instead.

@Sean 's solution should be correct.

1 Like

@Sean’s solution seems to work. I modified it to target those with a driver version less-than what is indicated, and like I expected, it isn’t working. No devices are showing up as relevant, and there should be hundreds.

  1. Targets all 64-bit Windows 7 systems.
  2. We use a value called “sasorg” to separate our groups, so no one patches someone else’s computers.
  3. Looks for the AMD Radeon HD 7570 graphics adapter.
  4. Looks for any client with a driver version less-than 15.200.1062.1004

The results are nothing is relevant.

The screenshot is useful, but it would be nice to include the relevance 4 as text as well because it is hard to read in the screenshot and then I can’t quote the text of it directly.


This is not the problem, but relevance 3 will only work if there is already a driver installed. If no AMD graphics drivers are installed at all, which may never happen in this case, but could in others, then you have to reference the PnP ID of the device to detect it.


This is a bit harsh. You seem to have a rather negative attitude like this in all of your posts when there are issues, and jump to the conclusion that everything else is to blame. This stuff isn’t easy and there is a learning curve. There are many different ways to go about solving the problem, but once you pick a method, if you don’t get it exactly right, then it doesn’t work. This is completely normal. You have to test each piece individually to see how it works and where the issues are and go from there. Start simple and build up from there. In this case, and in many others, the problem isn’t BigFix or Relevance at all and is entirely a WMI WQL problem, which would have been an issue no matter what system you were using to make the WMI query. I would recommend testing WMI queries in WMI Explorer and testing the relevance in the Fixlet Debugger.

Also, we don’t work for IBM. We are volunteering to help you with your problem and help you learn how to do this going forward.


The real issue here is the relevance 4. This is a WMI limitation, not a BigFix limitation. You can’t use DriverVersion<'15.200.1062.1004' because that is not an integer that can be compared with less than or greater than.

There solution is actually to use Relevance to solve the issue by breaking up the WMI query and the DriverVersion check.

Start here to get the raw data:

string values of selects "DeviceName, DriverVersion from Win32_PnPSignedDriver where DeviceName like '%25AMD%25'" of wmis

Then to do the DriverVersion comparison:

exists string values whose(it as version < "15.200.1062.1004" as version) of selects "DriverVersion from Win32_PnPSignedDriver where DeviceName like '%25AMD%25'" of wmis

This relevance may always return TRUE on machines with AMD devices because there might always be at least one with AMD in the name and a driver version less than this, so this may have the opposite problem, which means you would need a better filter to make sure your checking the DriverVersion of the correct device.

Relevance does understand versions, so it does know how to do less than / greater than comparisons, so this should work. I actually don’t know for certain that it will however, so you need to test it in the fixlet debugger or in a temporary analysis property or both. I can’t do this for you since I don’t have an AMD display adapter to test against.

The general method I recommend for testing relevance is to test to make sure you get the raw data you need first and not do a true/false check until the raw data is returned as you expect. You should also put the relevance into an Analysis property to gather results from many computers to see that it works as expected there as well.

1 Like

Here’s the relevance outside of a screenshot. I didn’t realize the uploaded pics couldn’t be enlarged.


Relevance 1.

((name of it = "Win7" AND x64 of it)) of operating system

Relevance 2.

 value of setting "sasorg" of client = "7593"

Relevance 3.

exists unique values whose ( "AMD Radeon HD 7500 Series" = it ) of  ( friendly name of it | description of it "NoDescOrFN" ) of active devices whose ( class of it = "Display" ) exists unique values whose("AMD Radeon HD 7500 Series" = it) of (friendly name of it | description of it | "NoDescOrFN") of active devices whose (class of it = "Display")

Relevance 4.

exists selects "DeviceName, DriverVersion, DriverDate from Win32_PnPSignedDriver where DeviceName like '%25AMD%25' and DriverVersion<'15.200.1062.1004'" of wmi exists selects "DeviceName, DriverVersion, DriverDate from Win32_PnPSignedDriver where DeviceName like '%25AMD%25' and DriverVersion<'15.200.1062.1004'" of wmi

I really do appreciate the help I receive here. Without it, I wouldn’t be able to use Bigfix with any kind of success. I apologize for ranting. Bigfix is just so difficult for me to use. I’ve used complicated software packages in the past, but they all had some logic and pattern to them. I haven’t found that with Bigfix. I’m not the only one here feeling this way. I’m just more proactive about not giving up, and making this work. Once again, I am grateful for and appreciate any help you can provide.

Thanks

1 Like

I tried every step of relevance in the fixlet debugger, on a PC with the target hardware, expecting True each time, and it did work. All 4 came back as true, yet no one shows up as relevance. I have a basic analysis that shows me the driver info for each PC. There are many examples that should be relevant, but just are not showing up.

They sort of can be, but it is difficult. The forum defaults to making them rather small, which is a bit annoying. It would be nice if there was an easy option to enlarge them temporarily when viewing the post, but there isn’t that I’m aware of.

Thanks, I do appreciate that. It just seemed like your go-to in many of your posts, which doesn’t encourage others to help you.

I actually felt like BigFix had that for me personally, which is why I really liked it and took to it. Relevance is definitely a bit more of a programming skill to learn than some others, but it is also similar enough to other things to be confusing and different enough to be its own thing you have to learn.

That seems odd. I would put all 4 and variations as different properties in an analysis and see which ones come back as true/false. If they all come back true, then perhaps there is an issue with the site that the task is in? or something else?

OK. I’ll try an analysis to see if something else is up. Thanks

The analysis didn’t show much, so I tried a different approach. Instead of using WMI, I looked in the registry to see if there was a reference to the driver. There was. I added some relevance to look for that key and return true/false. The issues is that the return is false on PCs that actually have that key and value. The logic seems inverse.

Q:exists key whose (value "ProductVersion" of it as string equals "15.200.1062.1004") of key "HKEY_LOCAL_MACHINE\SOFTWARE\ATI Technologies\Install\Packages\W-06-0001-000-001-001-001-00-00" of native registry
A: False
T: 9.660 ms

What happens if you do this on the same machine:

values "ProductVersion" of keys of keys "HKEY_LOCAL_MACHINE\SOFTWARE\ATI Technologies\Install\Packages\W-06-0001-000-001-001-001-00-00" of native registry

In general, you should do it like this first to make sure it returns the correct data before turning it into a WHOSE statement to get a TRUE/FALSE value.

Here’s what I got from the same PC.

Q:values "ProductVersion" of keys of keys "HKEY_LOCAL_MACHINE\SOFTWARE\ATI Technologies\Install\Packages\W-06-0001-000-001-001-001-00-00" of native registry
T: 4.525 ms

Taking out the extra “of keys” produced the following results.

Q:values "ProductVersion" of keys "HKEY_LOCAL_MACHINE\SOFTWARE\ATI Technologies\Install\Packages\W-06-0001-000-001-001-001-00-00" of native registry
A: 15.200.1062.1004
T: 0.184 ms
1 Like

Trying for a true/false didn’t work out.

Q:exists values "ProductVersion" of keys "HKEY_LOCAL_MACHINE\SOFTWARE\ATI Technologies\Install\Packages\W-06-0001-000-001-001-001-00-00" of native registry = "15.200.1062.1004"
E: The operator "equal" is not defined.

This was the problem:


It wouldn’t work this way.

This should give a true/false:

exists values "ProductVersion" whose(it as string as trimmed string = "15.200.1062.1004") of keys "HKEY_LOCAL_MACHINE\SOFTWARE\ATI Technologies\Install\Packages\W-06-0001-000-001-001-001-00-00" of native registry

This will only give a true result for those that exactly match that string, which is probably not what you want. This should give you only computers that have a version less than this one, or none at all:

not exists values "ProductVersion" whose(it as string as version >= "15.200.1062.1004") of keys "HKEY_LOCAL_MACHINE\SOFTWARE\ATI Technologies\Install\Packages\W-06-0001-000-001-001-001-00-00" of native registry

If you want machines that already have a driver installed, but it is older, it would be this:

exists values "ProductVersion" whose(it as string as version < "15.200.1062.1004") of keys "HKEY_LOCAL_MACHINE\SOFTWARE\ATI Technologies\Install\Packages\W-06-0001-000-001-001-001-00-00" of native registry

Do these drivers have an entry in the Uninstall key in the registry? If so, that is usually where I would check.