07/13/2012 3912 views

Trying to create a custom inventory rule to report the values of the "Paths" key.  When the command is ran in a cmd prompt, it runs without issue and lists the values.  When I create the custom inventory rule, it reports "invalid command line" when ran during a 'runkbot 4 0.'

Here's the rule:

ShellCommandTextReturn(REG QUERY "HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths")

Am I missing something?

0 Comments   [ + ] Show comments


Community Chosen Answer


RegistryValueReturn(registryPath, valueName, type)

Returns the value of a registry entry, andsets the datatype to the one you specified

Answered 07/13/2012 by: jagadeish
Red Belt

  • RIght, but I'm trying to list the values of that key, not any value in particular. The "paths" key lists user-defined exclusions to Forefront antivirus. So any number of different values might be there, depending on the user. I'd rather get the list via reg query than have to list out every possible combo.
  • Are you looking for this?

All Answers


Here is an article that I created using custom inventory rules to search and inventory what version of IE is installed.  Maybe you can find it helpful!


Answered 04/16/2013 by: c_brock
Third Degree Brown Belt