/build/static/layout/Breadcrumb_cap_w.png

Supporting Windows Question


How to write a CIR that uses REG QUERY *outside* of Wow6432Node on 64 bit Windows 7 machine?

12/11/2014 1982 views
When writing a Custom Inventory Rule, is there a way to use REG QUERY to look *outside* the Wow6432Node? 

I can tell that it will fail when I test on a 64 bit machine and try running my query in the 64 bit cmd.

To be more specific, in my circumstances I particularly need to look at the ProductId value normally at HKLM\Software\Microsoft\Windows NT\CurrentVersion. The Wow6432Node version does not contain this value at all...

Thank you in advance!
1 Comment   [ + ] Show comment

Comments

  • Just saw your other post. In that case if reg query with HKLM64 doesn't work, then follow Chuck's suggestion.

    Make a CIR that will work with both 32 and 64 by using OR, then create a smart label that says [your cir name] matches regex .*('ABC|123').*

    RegistryValueReturn(HKLM64\Software\Microsoft\Windows NT\CurrentVersion,ProductId,TEXT) OR RegistryValueReturn(HKLM\Software\Microsoft\Windows NT\CurrentVersion,ProductId,TEXT)


Community Chosen Answer


  • if that does not work modify what flip001 said to fit your reg query call and call: reg query hklm64\software\etc...
  • the sysnative approach should work for either 32 or 64, where as using hklm64 will only work on 64bit machines
  • Thank you!

All Answers

1
Try the CIR below. I added 64 after HKLM.

RegistryValueReturn(HKLM64\Software\Microsoft\Windows NT\CurrentVersion,ProductId,TEXT)
Answered 12/11/2014 by: flip1001
Black Belt

  • Thank you! I apologize I hadn't come back to this question -- the question that spawned it became moot.

Don't be a Stranger!

Sign up today to participate, stay informed, earn points and establish a reputation for yourself!

Sign up! or login

Share

 
This website uses cookies. By continuing to use this site and/or clicking the "Accept" button you are providing consent Quest Software and its affiliates do NOT sell the Personal Data you provide to us either when you register on our websites or when you do business with us. For more information about our Privacy Policy and our data protection efforts, please visit GDPR-HQ