Custom Inventory rule - RegistryValueEquals for valueName "(Default)"
Has anyone successfully setup a Custom Inventory rule using the (Default) value of a registry key?
I've seen 1 post that said to just not use a valueName at all.. like so:
RegistryValueEquals(HKEY_LOCAL_MACHINE\Software\Blah\blah,,something)
This didn't work for me though.
Additional info-->
This is not to create a Custom Inventory Field, but rather for creating a software entry using a Custom Inventory Rule (I do a lot of these).
In this example, the registry key is "blah", the valueName is "(Default)" (or in a reg file it would be "@") and the conditional value indicating whether the software is installed or not is "something"
I've already tried:
RegistryValueEquals(HKEY_LOCAL_MACHINE\Software\Blah\blah,,something)
RegistryValueEquals(HKEY_LOCAL_MACHINE\Software\Blah\blah,(Default),something)
Answers (2)
To match the (Default) value, you must include a space in between the commas: RegistryValueEquals(HKEY_LOCAL_MACHINE\Software\Blah\blah, ,something)
Thanks to all for trying, but I managed to figure it out.
To find match the (Default) value, you must include a space in between the commas:
RegistryValueEquals(HKEY_LOCAL_MACHINE\Software\Blah\blah, ,something)
I've used to the RegistryValueReturn to get values. Here's the exact custom inventory. RegistryValueReturn(HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\AVEngine, AVDatDate, REG_SZ)
Comments:
-
never tried it but try like this
RegistryValueEquals(HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\AVEngine, AVDatDate,)
or even RegistryValueEquals(HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\AVEngine, (default),(value not set)) - SMal.tmcc 12 years ago -
will this work for whatever you are doing this way?
RegistryKeyExists((HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\AVEngine\ AVDatDate) - SMal.tmcc 12 years ago -
Pretty sure ms01ak is right on the money. RegistryValueReturn is most likely the way to with this as Exists/Equals are made to match a value, not return one.
Plus, when using a return and it's updated on the machine, it will be updated in the K1000 on the next check in. - jknox 12 years ago -
RegistryValueReturn would create a custom inventory "field" and return a value. I do not want to return a value, I want to match a value and establish whether or not the software is installed.
even if I did want to return a value... I don't know a way to return (Default) - joeostrander 12 years ago-
So, if you have a value to match, registryvalueequals should work fine.
For my example, say you are looking for BIOS revision A20 on a Dell Latitude E6400. The key looks like this and works to return A20:
RegistryValueEquals(HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS, BIOSVersion, A20) - jknox 12 years ago
-
Thanks, but this was for matching (Default) values. These have no real name in the registry, just a placeholder called (Default) or in a reg file it appears like @="something". There is no documentation for finding these types of values, but I found it out through trial and error that using a space will match it. - joeostrander 12 years ago
-
I'm also trying to get a RegValReturn to work on a default value, but so far no luck:
RegistryValueReturn(HKLM\Software\Microsoft\Windows NT\Current Version\Winlogon\Shield\Server, , TEXT)
joeostrander, can you paste an example of what worked for you? I tried a space comma, just a space, and had no luck. It is probably right in my face, and I'm not seeing it! :) - awingren 11 years ago-
Sorry I never saw your question until now. What worked for me, I posted up in the answer summary above. Essentially, you put , , if that's not working for you, then maybe your value is in hklm\software and the agent is reading hklm\software\wow6432node... - joeostrander 11 years ago
-
Hi joeostrander! Thanks for your reply! I got this to work eventually:
RegistryValueReturn(HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shield\Server, ,TEXT)
I mistakenly had a space in CurrentVersion and assumed it was an issue with my commas at the end! Oops! I learned my lesson to export from now on! - awingren 11 years ago