Hi All,

I'm trying to create a custom inventory rule that checks for the presence of any file with the name csrss located in C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\. Below is the function that I am using for this rule:


Unfortunately, KACE does not return any results. If I create a folder named Test on the root of C:\ and update the function to check that location, results are returned.

Is it possible the KACE agent does not have access to the CrashDumps folder under System32? I noticed when browsing to this folder on a local machine, a prompt displays saying I need to click Continue to permanently get access to this folder. Once I do that, I am able to view the folder contents.

Has anyone else experienced this issue? Let me know if you need more info.

Thank you!
Answer Summary:
0 Comments   [ - ] Hide Comments


Please log in to comment

Answer this question or Comment on this question for clarity


Figured out what the issue was....

I replaced \System32 with \Sysnative in my function and that resolved the issue. My function now looks like this:


Apparently, when a 32-bit app uses the \System32 folder, it automatically redirects to SysWOW64. So for 64-bit systems running a 32-bit app like the KACE agent, \Sysnative should be used to reference the 64-bit System32 folder.

All is good!

Thank you
Answered 01/29/2015 by: kevc
White Belt

Please log in to comment