KACE Product Support

Again, I have a great need to get this script step working. Can anyone point me to documentation on how "Verify a registry pattern match" works?

HKLM\\SOFTWARE!=nonesuch

I'm guessing the punctuation is wrong between the form fields. The backslash (\) is added automatically. In other words look at the result displayed above vs. what was desired "HKLM\SOFTWARE".

Also, "!=" means "does not equal" on other forms.

In my first message in this thread, I was trying to pattern match against a registry key, which gets weird because in the pattern you have to escape those backslashes.

Now I'm doing something simpler, trying to pattern match against the value of a known registry entry within a known registry key. So try this:

Verify a registry pattern matches...
Key: HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Name: ComputerName
Value: CMC019[3-5][0-9]{4}.*
Match: value

In other words, I want to check if the ComputerName entry matches the regular expression CMC019[3-5][0-9]{4}. (Check if it starts with CMC019, followed by a 5 digit number in the 30000-59999 range, optionally followed by any character.)

So here's how I'm interpreting this task step: put your regular expression to match in one of the three parts, Key, Name, or Value; change Match to indicate which part you put the pattern into; fill in the other two fields with fixed text (not patterns). Am I close?

(I hate having to learn KBOX stuff by trial and error...)

OK, this is working:

Verify a registry pattern matches...
Key: HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Name: ComputerName
Value: ^CMC019[3-5][0-9]{4}.*$
Match: value

I'm hoping any valid regular expression will work; I plan to try the "Alternation construct" | later, as in: ^(CMC019|CMC110)[3-5][0-9]{4}.*$

Now, it's going to get trickier if the pattern I want to match on is part of the registry key, not the name or value, because I have to escape those backslashes in the registry key. Next time, I plan to try this:

Verify a registry pattern matches...
Key: HKLM\x5CSOFTWARE\x5CProtector Suite.*
Name:
Value:
Match: key

Any guidance along these lines would still be appreciated. Sande

With the new 5.3 agents, any reference to a registry entry under HKCU seems to never match to any pattern, even when the script is "Run As User logged in to console".

I though this was working with 5.1 versions of the KBOX agents for Windows.

This doesn't answer your question directly, but I'm wondering if there in an uninstall string in the registry that you can reference - if so, you can then use "msiexec /x {....string....}" to uninstall. I've used this in my environment via a batch command in the remediation section to uninstall programs, with a "verify file exists" statement simply pointing to a file in said program's directory (if it doesn't exist, the program isn't installed), and it's worked well enough run as the logged in user.

John

The uninstall was just an example. I'm now trying to use the "Verify a registry pattern match" in places that have nothing to do with uninstalling. I'm disappointed that what appeared to be working with the 5.1 agents now does not work with the 5.3 agent.