Has anyone successfully setup a Custom Inventory rule using the (Default) value of a registry key?

I've seen 1 post that said to just not use a valueName at all.. like so:

RegistryValueEquals(HKEY_LOCAL_MACHINE\Software\Blah\blah,,something)

This didn't work for me though.

 

 Additional info-->

This is not to create a Custom Inventory Field, but rather for creating a software entry using a Custom Inventory Rule (I do a lot of these).  

In this example, the registry key is "blah", the valueName is "(Default)" (or in a reg file it would be "@") and the conditional value indicating whether the software is installed or not is "something"

I've already tried:

RegistryValueEquals(HKEY_LOCAL_MACHINE\Software\Blah\blah,,something)

RegistryValueEquals(HKEY_LOCAL_MACHINE\Software\Blah\blah,(Default),something)

 

Answer Summary:
To match the (Default) value, you must include a space in between the commas: RegistryValueEquals(HKEY_LOCAL_MACHINE\Software\Blah\blah, ,something)
Cancel
0 Comments   [ + ] Show Comments

Comments

Please log in to comment

Community Chosen Answer

4

Thanks to all for trying, but I managed to figure it out.

To find match the (Default) value, you must include a space in between the commas:

RegistryValueEquals(HKEY_LOCAL_MACHINE\Software\Blah\blah, ,something)

Answered 10/23/2012 by: joeostrander
Third Degree Blue Belt

Please log in to comment

Answers

1

I've used to the RegistryValueReturn to get values. Here's the exact custom inventory. RegistryValueReturn(HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\AVEngine, AVDatDate, REG_SZ)

Answered 10/23/2012 by: ms01ak
Tenth Degree Black Belt

  • never tried it but try like this
    RegistryValueEquals(HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\AVEngine, AVDatDate,)
    or even RegistryValueEquals(HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\AVEngine, (default),(value not set))
  • will this work for whatever you are doing this way?
    RegistryKeyExists((HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\AVEngine\ AVDatDate)
  • Pretty sure ms01ak is right on the money. RegistryValueReturn is most likely the way to with this as Exists/Equals are made to match a value, not return one.

    Plus, when using a return and it's updated on the machine, it will be updated in the K1000 on the next check in.
  • RegistryValueReturn would create a custom inventory "field" and return a value. I do not want to return a value, I want to match a value and establish whether or not the software is installed.

    even if I did want to return a value... I don't know a way to return (Default)
    • This content is currently hidden from public view.
      Reason: Removed by user request
      For more information, visit our FAQ's.
    • So, if you have a value to match, registryvalueequals should work fine.

      For my example, say you are looking for BIOS revision A20 on a Dell Latitude E6400. The key looks like this and works to return A20:

      RegistryValueEquals(HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS, BIOSVersion, A20)
  • Thanks, but this was for matching (Default) values. These have no real name in the registry, just a placeholder called (Default) or in a reg file it appears like @="something". There is no documentation for finding these types of values, but I found it out through trial and error that using a space will match it.
  • I'm also trying to get a RegValReturn to work on a default value, but so far no luck:
    RegistryValueReturn(HKLM\Software\Microsoft\Windows NT\Current Version\Winlogon\Shield\Server, , TEXT)

    joeostrander, can you paste an example of what worked for you? I tried a space comma, just a space, and had no luck. It is probably right in my face, and I'm not seeing it! :)
    • Sorry I never saw your question until now. What worked for me, I posted up in the answer summary above. Essentially, you put , , if that's not working for you, then maybe your value is in hklm\software and the agent is reading hklm\software\wow6432node...
      • Hi joeostrander! Thanks for your reply! I got this to work eventually:

        RegistryValueReturn(HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shield\Server, ,TEXT)

        I mistakenly had a space in CurrentVersion and assumed it was an issue with my commas at the end! Oops! I learned my lesson to export from now on!
Please log in to comment
Answer this question or Comment on this question for clarity

Share