KACE Custom Inventory - Permissions Issue?
Hi All,
I'm trying to create a custom inventory rule that checks for the presence of any file with the name csrss located in C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\. Below is the function that I am using for this rule:
FilenamesMatchingRegexExist(C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\,csrss)
Unfortunately, KACE does not return any results. If I create a folder named Test on the root of C:\ and update the function to check that location, results are returned.
Is it possible the KACE agent does not have access to the CrashDumps folder under System32? I noticed when browsing to this folder on a local machine, a prompt displays saying I need to click Continue to permanently get access to this folder. Once I do that, I am able to view the folder contents.
Has anyone else experienced this issue? Let me know if you need more info.
Thank you!
0 Comments
[ + ] Show comments
Answers (1)
Answer Summary:
Please log in to answer
Posted by:
kevc
9 years ago
Figured out what the issue was....
I replaced \System32 with \Sysnative in my function and that resolved the issue. My function now looks like this:
FilenamesMatchingRegexExist(C:\Windows\Sysnative\config\systemprofile\AppData\Local\CrashDumps\,csrss)
Apparently, when a 32-bit app uses the \System32 folder, it automatically redirects to SysWOW64. So for 64-bit systems running a 32-bit app like the KACE agent, \Sysnative should be used to reference the 64-bit System32 folder.
All is good!
Thank you