When writing a Custom Inventory Rule, is there a way to use REG QUERY to look *outside* the Wow6432Node? 

I can tell that it will fail when I test on a 64 bit machine and try running my query in the 64 bit cmd.

To be more specific, in my circumstances I particularly need to look at the ProductId value normally at HKLM\Software\Microsoft\Windows NT\CurrentVersion. The Wow6432Node version does not contain this value at all...

Thank you in advance!
1 Comment   [ - ] Hide Comment


  • Just saw your other post. In that case if reg query with HKLM64 doesn't work, then follow Chuck's suggestion.

    Make a CIR that will work with both 32 and 64 by using OR, then create a smart label that says [your cir name] matches regex .*('ABC|123').*

    RegistryValueReturn(HKLM64\Software\Microsoft\Windows NT\CurrentVersion,ProductId,TEXT) OR RegistryValueReturn(HKLM\Software\Microsoft\Windows NT\CurrentVersion,ProductId,TEXT)
Please log in to comment

Community Chosen Answer


  • if that does not work modify what flip001 said to fit your reg query call and call: reg query hklm64\software\etc...
  • the sysnative approach should work for either 32 or 64, where as using hklm64 will only work on 64bit machines
  • Thank you!
Please log in to comment
Answer this question or Comment on this question for clarity


Try the CIR below. I added 64 after HKLM.

RegistryValueReturn(HKLM64\Software\Microsoft\Windows NT\CurrentVersion,ProductId,TEXT)
Answered 12/11/2014 by: flip1001
Third Degree Brown Belt

  • Thank you! I apologize I hadn't come back to this question -- the question that spawned it became moot.
Please log in to comment