( windows of operating system ) and ( version of operating system >= "6.1" ) and ( ifexists property "in proxy agent context"then ( not in proxy agent context ) elsetrue ) and ( free space of drive of client > 7187816 * 2 ) and ( notexists keys whose ( value "DisplayName"ofitas string is "Classic Shell" ) of keys "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall"of ( x32 registries; x64 registries ) )
(windows of operating system) and (version of operating system >= "6.1") and (ifexists property "in proxy agent context"then ( not in proxy agent context ) elsetrue) and (free space of drive of client > 7187816 * 2) and (notexists keys whose (value "DisplayName"ofitas string is "Classic Shell") of keys "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall"of (x32 registries; x64 registries))
if ( if current date < ( first sunday of current month_and_year ) then"0"elseif current date >= ( first sunday of current month_and_year ) and current date < ( ( first sunday of current month_and_year ) + ( 7*day ) ) then"1"elseif current date >= ( ( first sunday of current month_and_year ) + ( 7*day ) ) and current date < ( ( first sunday of current month_and_year ) + ( 14*day ) ) then"2"elseif current date >= ( ( first sunday of current month_and_year ) + ( 14*day ) ) and current date < ( ( first sunday of current month_and_year ) + ( 21*day ) ) then"3"elseif current date >= ( ( first sunday of current month_and_year ) + ( 21*day ) ) and current date < ( ( first sunday of current month_and_year ) + ( 28*day ) ) then"4"elseif current date >= ( ( first sunday of current month_and_year ) + ( 28*day ) ) then"5"else"Undefined" ) = ( if exist values of settings "Patch Week"of client then value of setting "Patch Week"of client else error "not set" ) and day_of_week of current date as string = ( if exist values of settings "Patch Day"of client then value of setting "Patch Day"of client else error "not set" ) and ( ( two digit hour ofitas string & two digit minute ofitas string ) of time ( local time zone ) ofit ) of now >= ( if exist values of settings "Patch Start Time"of client then value of setting "Patch Start Time"of client else error "not set" ) and ( ( two digit hour ofitas string & two digit minute ofitas string ) of time ( local time zone ) ofit ) of now <= ( if exist values of settings "Patch End Time"of client then value of setting "Patch End Time"of client else error "not set" ) thenTrueelseFalse
if (if current date < (first sunday of current month_and_year) then"0"elseif current date >= (first sunday of current month_and_year) and current date < ((first sunday of current month_and_year) + (7*day)) then"1"elseif current date >= ((first sunday of current month_and_year) + (7*day)) and current date < ((first sunday of current month_and_year) + (14*day)) then"2"elseif current date >= ((first sunday of current month_and_year) + (14*day)) and current date < ((first sunday of current month_and_year) + (21*day)) then"3"elseif current date >= ((first sunday of current month_and_year) + (21*day)) and current date < ((first sunday of current month_and_year) + (28*day)) then"4"elseif current date >= ((first sunday of current month_and_year) + (28*day)) then"5"else"Undefined") = (if exist values of settings "Patch Week"of client then value of setting "Patch Week"of client else error "not set") and day_of_week of current date as string = (if exist values of settings "Patch Day"of client then value of setting "Patch Day"of client else error "not set") and ((two digit hour ofitas string & two digit minute ofitas string) of time (local time zone) ofit) of now >= (if exist values of settings "Patch Start Time"of client then value of setting "Patch Start Time"of client else error "not set") and ((two digit hour ofitas string & two digit minute ofitas string) of time (local time zone) ofit) of now <= (if exist values of settings "Patch End Time"of client then value of setting "Patch End Time"of client else error "not set") thenTrueelseFalse
( item 0ofit= item 1ofit ) of ( ( ( it mod 15 ) of ( ( ( if ( length ofit=1 ) then ( it ) else ( last 2ofit ) ) of ( computer id as string ) ) as integer ) ) , ( ( it mod 15 ) of ( day_of_month of current date as integer ) ) )
(item 0ofit= item 1ofit) of (((it mod 15) of (((if (length ofit=1) then (it) else (last 2ofit)) of (computer id as string)) as integer)), ((it mod 15) of (day_of_month of current date as integer)))
( it, multiplicity ofit ) of unique values of following texts of firsts "(action:"of preceding texts of firsts ") Non-Distributed - DownloadsAvailable"of locked lines containing ") Non-Distributed - DownloadsAvailable"of files whose ( 12= length of name ofit ) of folders "Logs"of folders "__Global"of data folders of client
(it, multiplicity ofit) of unique values of following texts of firsts "(action:"of preceding texts of firsts ") Non-Distributed - DownloadsAvailable"of locked lines containing ") Non-Distributed - DownloadsAvailable"of files whose(12= length of name ofit) of folders "Logs"of folders "__Global"of data folders of client
number of bes fixlets whose ( not custom flag ofitAND download size ofit!=0AND now - modification time ofit < 90 * day ANDexists applicable computers ofitANDexists scripts whose ( itas lowercase contains"prefetch" ) of actions ofit )
number of bes fixlets whose(not custom flag ofitAND download size ofit!=0AND now - modification time ofit < 90 * day ANDexists applicable computers ofitANDexists scripts whose(itas lowercase contains"prefetch") of actions ofit)
( item 0ofit & item 1ofit ) of ( "Y::site=" & name of site ofit & "::fixletid=" & id ofitas string & "::url=",
(
item 0 of it & "::size=" & item 1ofit & "::hash=" & item 2ofit & "::hashtype=sha256" ) whose ( length ofit > 64ANDitas uppercase does not contain "_CACHING_REQUIRED" ) of ( parenthesized parts 3of it, parenthesized parts 2of it, parenthesized parts 4ofit ) of matches ( regex "(prefetch \S+ sha1:\S{40} size:(\d+) (https*:\/\/\S+) sha256:(\S{64})|\s*add prefetch item name=\S+ sha1=\S{40} size=(\d+) url=(https*:\/\/\S+) sha256=(\S{64}))" ) of scripts of actions ofit ) of bes fixlets whose ( not custom flag ofitAND download size ofit!=0AND now - modification time ofit < 90 * day ANDexists applicable computers ofitANDexists scripts whose ( itas lowercase contains"prefetch" ) of actions ofit )
(item 0ofit & item 1ofit) of ("Y::site=" & name of site ofit & "::fixletid=" & id ofitas string & "::url=", (item 0 of it & "::size=" & item 1ofit & "::hash=" & item 2ofit & "::hashtype=sha256") whose(length ofit > 64ANDitas uppercase does not contain "_CACHING_REQUIRED") of (parenthesized parts 3of it, parenthesized parts 2of it, parenthesized parts 4ofit) of matches (regex "(prefetch \S+ sha1:\S{40} size:(\d+) (https*:\/\/\S+) sha256:(\S{64})|\s*add prefetch item name=\S+ sha1=\S{40} size=(\d+) url=(https*:\/\/\S+) sha256=(\S{64}))") of scripts of actions ofit) of bes fixlets whose(not custom flag ofitAND download size ofit!=0AND now - modification time ofit < 90 * day ANDexists applicable computers ofitANDexists scripts whose(itas lowercase contains"prefetch") of actions ofit)
( multiplicity of it, it ) of unique values of ( content id of ( default action ofit | action 0whose ( script type ofitas lowercase !="text/x-uri" ) ofit ) | tuple string item 0of concatenations ", "of content ids of actions whose ( script type ofitas lowercase !="text/x-uri" ) ofit | "NoAction?" ) of fixlets of all bes sites
(multiplicity of it, it) of unique values of ( content id of (default action ofit | action 0whose(script type ofitas lowercase !="text/x-uri") ofit) | tuple string item 0of concatenations ", "of content ids of actions whose(script type ofitas lowercase !="text/x-uri") ofit | "NoAction?" ) of fixlets of all bes sites
NOT ( inbound connections allowed of current profile of local policy of firewall OR ( exist key "HKLM\Software\Policies\Microsoft\WindowsFirewall\FirewallRules"whose ( ( exists value whose ( itas string as lowercase contains"|action=allow|"anditas string as lowercase contains"|active=true|"ANDitas string as lowercase contains"|dir=in|"andNOT ( itas string as lowercase contains"|protocol=" ) AND ( ( itas string as lowercase contains"|profile=" & ( if ( current profile type of firewall = domain firewall profile type ) then"domain|"elseif ( current profile type of firewall = public firewall profile type ) then"public|"elseif ( current profile type of firewall = private firewall profile type ) then"private|"else"INVALID" ) ) ORnot ( itas string as lowercase contains"|profile" ) ) ) ofit ) ) of native registry ) )
NOT (inbound connections allowed of current profile of local policy of firewall OR (exist key "HKLM\Software\Policies\Microsoft\WindowsFirewall\FirewallRules"whose ((exists value whose (itas string as lowercase contains"|action=allow|"anditas string as lowercase contains"|active=true|"ANDitas string as lowercase contains"|dir=in|"andNOT (itas string as lowercase contains"|protocol=") AND ((itas string as lowercase contains"|profile=" & (if (current profile type of firewall = domain firewall profile type) then"domain|"elseif (current profile type of firewall = public firewall profile type) then"public|"elseif (current profile type of firewall = private firewall profile type) then"private|"else"INVALID")) ORnot (itas string as lowercase contains"|profile")) ) ofit)) of native registry))
NOT ( ( ( exists rule whose ( ( NOTexists local ports string ofitOR local ports string ofitcontains ( value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string ) OR local ports string ofit="*" ) AND ( ( ( application name ofit ends with"\BESRelay.exe" ) ANDNOT ( service name ofit="BESRelay" ) ) OR ( regex "^(\s)*$"= application name ofitAND regex "^(\s)*$"= service name ofit ) ) and enabled ofitand protocol ofit= udp and inbound ofitand profile ( current profile type of firewall ) ofit ) of firewall ) OR ( exists internet connection firewall whose ( enabled ofitANDexists port mapping whose ( enabled ofitAND protocol ofit="udp"AND internal port ofitas string = ( value "ListenPort"of key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry ) as string ) ofit ) of adapters of network ) OR ( exist key "HKLM\Software\Policies\Microsoft\WindowsFirewall\FirewallRules"whose ( ( exists value whose ( itas string as lowercase contains"|action=allow|"anditas string as lowercase contains"|active=true|"ANDitas string as lowercase contains"|dir=in|"and ( itas string as lowercase contains"|protocol=17|"orNOT ( itas string as lowercase contains"|protocol" ) ) AND ( itas string as lowercase contains"|lport=" & ( value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string ) & "|"ORnot ( itas string as lowercase contains"|lport=" ) ) AND ( not ( ( itas string as lowercase contains"|app=" ) ) OR ( itas string as lowercase contains"|app="anditas string contains"\BESRelay.exe|" ) ) AND ( ( itas string as lowercase contains"|profile=" & ( if ( current profile type of firewall = domain firewall profile type ) then"domain|"elseif ( current profile type of firewall = public firewall profile type ) then"public|"elseif ( current profile type of firewall = private firewall profile type ) then"private|"else"INVALID" ) ) ORnot ( itas string as lowercase contains"|profile" ) ) ) ofit ) ) of native registry ) OR ( ( ( exists key ( "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & ( if ( current profile type of firewall = domain firewall profile type ) then"DomainProfile"else"StandardProfile" ) & "\GloballyOpenPorts" ) whose ( exists value whose ( ( name ofitas lowercase ="enabled" ) AND ( it=1 ) ) ofit ) ofit ) AND ( exists key ( "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & ( if ( current profile type of firewall = domain firewall profile type ) then"DomainProfile"else"StandardProfile" ) & "\GloballyOpenPorts\List" ) whose ( exists value whose ( ( name ofitstartswith value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of x32 registry as string & ":" ) AND ( regex "^(\d)+:UDP:(.+)?:enabled:(.+)$"= name ofit ) ) ofit ) ofit ) ) of native registry ) OR ( ( ( exists key ( "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & ( if ( current profile type of firewall = domain firewall profile type ) then"DomainProfile"else"StandardProfile" ) & "\AuthorizedApplications" ) whose ( exists value whose ( ( name ofitas lowercase ="enabled" ) AND ( it=1 ) ) ofit ) ofit ) AND ( exists key ( "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & ( if ( current profile type of firewall = domain firewall profile type ) then"DomainProfile"else"StandardProfile" ) & "\AuthorizedApplications\List" ) whose ( exists value whose ( ( regex "^(.+)?\\BESRelay.exe:(.+)?:enabled:(.+)$"= name ofit ) ) ofit ) ofit ) ) of native registry ) ) AND ( ( exists rule whose ( ( NOTexists local ports string ofitOR local ports string ofitcontains ( value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string ) OR local ports string ofit="*" ) AND ( ( ( application name ofit ends with"\BESRelay.exe" ) ANDNOT ( service name ofit="BESRelay" ) ) OR ( regex "^(\s)*$"= application name ofitAND regex "^(\s)*$"= service name ofit ) ) and enabled ofitand protocol ofit= tcp and inbound ofitand profile ( current profile type of firewall ) ofit ) of firewall ) OR ( exists internet connection firewall whose ( enabled ofitANDexists port mapping whose ( enabled ofitAND protocol ofit="tcp"AND internal port ofitas string = ( value "ListenPort"of key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry ) as string ) ofit ) of adapters of network ) OR ( exist key "HKLM\Software\Policies\Microsoft\WindowsFirewall\FirewallRules"whose ( ( exists value whose ( itas string as lowercase contains"|action=allow|"anditas string as lowercase contains"|active=true|"ANDitas string as lowercase contains"|dir=in|"and ( itas string as lowercase contains"|protocol=6|"orNOT ( itas string as lowercase contains"|protocol" ) ) AND ( itas string as lowercase contains"|lport=" & ( value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string ) & "|"ORnot ( itas string as lowercase contains"|lport=" ) ) AND ( not ( ( itas string as lowercase contains"|app=" ) ) OR ( itas string as lowercase contains"|app="anditas string contains"\BESRelay.exe|" ) ) AND ( ( itas string as lowercase contains"|profile=" & ( if ( current profile type of firewall = domain firewall profile type ) then"domain|"elseif ( current profile type of firewall = public firewall profile type ) then"public|"elseif ( current profile type of firewall = private firewall profile type ) then"private|"else"INVALID" ) ) ORnot ( itas string as lowercase contains"|profile" ) ) ) ofit ) ) of native registry ) OR ( ( ( exists key ( "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & ( if ( current profile type of firewall = domain firewall profile type ) then"DomainProfile"else"StandardProfile" ) & "\GloballyOpenPorts" ) whose ( exists value whose ( ( name ofitas lowercase ="enabled" ) AND ( it=1 ) ) ofit ) ofit ) AND ( exists key ( "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & ( if ( current profile type of firewall = domain firewall profile type ) then"DomainProfile"else"StandardProfile" ) & "\GloballyOpenPorts\List" ) whose ( exists value whose ( ( name ofitstartswith value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of x32 registry as string & ":" ) AND ( regex "^(\d)+:TCP:(.+)?:enabled:(.+)$"= name ofit ) ) ofit ) ofit ) ) of native registry ) OR ( ( ( exists key ( "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & ( if ( current profile type of firewall = domain firewall profile type ) then"DomainProfile"else"StandardProfile" ) & "\AuthorizedApplications" ) whose ( exists value whose ( ( name ofitas lowercase ="enabled" ) AND ( it=1 ) ) ofit ) ofit ) AND ( exists key ( "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & ( if ( current profile type of firewall = domain firewall profile type ) then"DomainProfile"else"StandardProfile" ) & "\AuthorizedApplications\List" ) whose ( exists value whose ( ( regex "^(.+)?\\BESRelay.exe:(.+)?:enabled:(.+)$"= name ofit ) ) ofit ) ofit ) ) of native registry ) ) AND ( ( exists key ( "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & ( if ( current profile type of firewall = domain firewall profile type ) then"DomainProfile"else"StandardProfile" ) & "\IcmpSettings" ) whose ( exists value whose ( name ofit="AllowInboundEchoRequest"andit=1 ) ofit ) of native registry ) OR ( ( ( exists rule whose ( ( enabled ofitand ( protocol ofit= internet protocol 1 ) and inbound ofitand profile ( current profile type of firewall ) ofitand ( regex "^(\s)*$"= application name ofitOR application name ofit ends with"\BESRelay.exe" ) AND regex "^(\s)*$"= service name ofit ) ) of firewall ) OR ( exist key "HKLM\Software\Policies\Microsoft\WindowsFirewall\FirewallRules"whose ( exists value whose ( itas string as lowercase contains"|action=allow|"anditas string as lowercase contains"|active=true|"ANDitas string as lowercase contains"|dir=in|"and ( itas string as lowercase contains"|protocol=1|"orNOT ( itas string as lowercase contains"|protocol" ) ) AND ( itas string as lowercase contains"|lport=" & ( value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string ) & "|"ORnot ( itas string as lowercase contains"|lport=" ) ) AND ( not ( ( itas string as lowercase contains"|app=" ) ) OR ( if ( itas string as lowercase contains"|app=" ) then ( itas string contains"\BESRelay.exe|" ) elsetrue ) AND ( ( itas string as lowercase contains"|profile=" & ( if ( current profile type of firewall = domain firewall profile type ) then"domain|"elseif ( current profile type of firewall = public firewall profile type ) then"public|"elseif ( current profile type of firewall = private firewall profile type ) then"private|"else"INVALID" ) ) ORnot ( itas string as lowercase contains"|profile" ) ) ) ofit ) ofit ) of native registry ) ) AND ( ( exists rule whose ( ( enabled ofitand ( protocol ofit= internet protocol 58 ) and inbound ofitand profile ( current profile type of firewall ) ofitand ( regex "^(\s)*$"= application name ofitOR application name ofit ends with"\BESRelay.exe" ) AND regex "^(\s)*$"= service name ofit ) ) of firewall ) OR ( exist key "HKLM\Software\Policies\Microsoft\WindowsFirewall\FirewallRules"whose ( exists value whose ( itas string as lowercase contains"|action=allow|"anditas string as lowercase contains"|active=true|"ANDitas string as lowercase contains"|dir=in|"and ( itas string as lowercase contains"|protocol=58|"orNOT ( itas string as lowercase contains"|protocol" ) ) AND ( itas string as lowercase contains"|lport=" & ( value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string ) & "|"ORnot ( itas string as lowercase contains"|lport=" ) ) AND ( not ( ( itas string as lowercase contains"|app=" ) ) OR ( if ( itas string as lowercase contains"|app=" ) then ( itas string contains"\BESRelay.exe|" ) elsetrue ) AND ( ( itas string as lowercase contains"|profile=" & ( if ( current profile type of firewall = domain firewall profile type ) then"domain|"elseif ( current profile type of firewall = public firewall profile type ) then"public|"elseif ( current profile type of firewall = private firewall profile type ) then"private|"else"INVALID" ) ) ORnot ( itas string as lowercase contains"|profile" ) ) ) ofit ) ofit ) of native registry ) ) ) ) )
NOT (((exists rule whose ((NOTexists local ports string ofitOR local ports string ofitcontains (value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string) OR local ports string ofit="*") AND (((application name ofit ends with"\BESRelay.exe") ANDNOT (service name ofit="BESRelay")) OR (regex "^(\s)*$"= application name ofitAND regex "^(\s)*$"= service name ofit)) and enabled ofitand protocol ofit= udp and inbound ofitand profile (current profile type of firewall) ofit) of firewall) OR (exists internet connection firewall whose (enabled ofitANDexists port mapping whose (enabled ofitAND protocol ofit="udp"AND internal port ofitas string = (value "ListenPort"of key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry) as string) ofit) of adapters of network) OR (exist key "HKLM\Software\Policies\Microsoft\WindowsFirewall\FirewallRules"whose ((exists value whose (itas string as lowercase contains"|action=allow|"anditas string as lowercase contains"|active=true|"ANDitas string as lowercase contains"|dir=in|"and (itas string as lowercase contains"|protocol=17|"orNOT (itas string as lowercase contains"|protocol")) AND (itas string as lowercase contains"|lport=" & (value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string) & "|"ORnot (itas string as lowercase contains"|lport=")) AND (not ((itas string as lowercase contains"|app=")) OR (itas string as lowercase contains"|app="anditas string contains"\BESRelay.exe|")) AND ((itas string as lowercase contains"|profile=" & (if (current profile type of firewall = domain firewall profile type) then"domain|"elseif (current profile type of firewall = public firewall profile type) then"public|"elseif (current profile type of firewall = private firewall profile type) then"private|"else"INVALID")) ORnot (itas string as lowercase contains"|profile"))) ofit)) of native registry) OR (((exists key ("HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & (if (current profile type of firewall = domain firewall profile type) then"DomainProfile"else"StandardProfile") & "\GloballyOpenPorts") whose (exists value whose ((name ofitas lowercase ="enabled") AND (it=1)) ofit) ofit) AND (exists key ("HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & (if (current profile type of firewall = domain firewall profile type) then"DomainProfile"else"StandardProfile") & "\GloballyOpenPorts\List") whose (exists value whose ((name ofitstartswith value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of x32 registry as string & ":") AND (regex "^(\d)+:UDP:(.+)?:enabled:(.+)$"= name ofit)) ofit) ofit)) of native registry) OR (((exists key ("HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & (if (current profile type of firewall = domain firewall profile type) then"DomainProfile"else"StandardProfile") & "\AuthorizedApplications") whose (exists value whose ((name ofitas lowercase ="enabled") AND (it=1)) ofit) ofit) AND (exists key ("HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & (if (current profile type of firewall = domain firewall profile type) then"DomainProfile"else"StandardProfile") & "\AuthorizedApplications\List") whose (exists value whose ((regex "^(.+)?\\BESRelay.exe:(.+)?:enabled:(.+)$"= name ofit)) ofit) ofit)) of native registry)) AND ((exists rule whose ((NOTexists local ports string ofitOR local ports string ofitcontains (value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string) OR local ports string ofit="*") AND (((application name ofit ends with"\BESRelay.exe") ANDNOT (service name ofit="BESRelay")) OR (regex "^(\s)*$"= application name ofitAND regex "^(\s)*$"= service name ofit)) and enabled ofitand protocol ofit= tcp and inbound ofitand profile (current profile type of firewall) ofit) of firewall) OR (exists internet connection firewall whose (enabled ofitANDexists port mapping whose (enabled ofitAND protocol ofit="tcp"AND internal port ofitas string = (value "ListenPort"of key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry) as string) ofit) of adapters of network) OR (exist key "HKLM\Software\Policies\Microsoft\WindowsFirewall\FirewallRules"whose ((exists value whose (itas string as lowercase contains"|action=allow|"anditas string as lowercase contains"|active=true|"ANDitas string as lowercase contains"|dir=in|"and (itas string as lowercase contains"|protocol=6|"orNOT (itas string as lowercase contains"|protocol")) AND (itas string as lowercase contains"|lport=" & (value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string) & "|"ORnot (itas string as lowercase contains"|lport=")) AND (not ((itas string as lowercase contains"|app=")) OR (itas string as lowercase contains"|app="anditas string contains"\BESRelay.exe|")) AND ((itas string as lowercase contains"|profile=" & (if (current profile type of firewall = domain firewall profile type) then"domain|"elseif (current profile type of firewall = public firewall profile type) then"public|"elseif (current profile type of firewall = private firewall profile type) then"private|"else"INVALID")) ORnot (itas string as lowercase contains"|profile"))) ofit)) of native registry) OR (((exists key ("HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & (if (current profile type of firewall = domain firewall profile type) then"DomainProfile"else"StandardProfile") & "\GloballyOpenPorts") whose (exists value whose ((name ofitas lowercase ="enabled") AND (it=1)) ofit) ofit) AND (exists key ("HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & (if (current profile type of firewall = domain firewall profile type) then"DomainProfile"else"StandardProfile") & "\GloballyOpenPorts\List") whose (exists value whose ((name ofitstartswith value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of x32 registry as string & ":") AND (regex "^(\d)+:TCP:(.+)?:enabled:(.+)$"= name ofit)) ofit) ofit)) of native registry) OR (((exists key ("HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & (if (current profile type of firewall = domain firewall profile type) then"DomainProfile"else"StandardProfile") & "\AuthorizedApplications") whose (exists value whose ((name ofitas lowercase ="enabled") AND (it=1)) ofit) ofit) AND (exists key ("HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & (if (current profile type of firewall = domain firewall profile type) then"DomainProfile"else"StandardProfile") & "\AuthorizedApplications\List") whose (exists value whose ((regex "^(.+)?\\BESRelay.exe:(.+)?:enabled:(.+)$"= name ofit)) ofit) ofit)) of native registry)) AND ((exists key ("HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & (if (current profile type of firewall = domain firewall profile type) then"DomainProfile"else"StandardProfile") & "\IcmpSettings") whose (exists value whose (name ofit="AllowInboundEchoRequest"andit=1) ofit) of native registry) OR (((exists rule whose ((enabled ofitand (protocol ofit= internet protocol 1) and inbound ofitand profile (current profile type of firewall) ofitand (regex "^(\s)*$"= application name ofitOR application name ofit ends with"\BESRelay.exe") AND regex "^(\s)*$"= service name ofit)) of firewall) OR (exist key "HKLM\Software\Policies\Microsoft\WindowsFirewall\FirewallRules"whose (exists value whose (itas string as lowercase contains"|action=allow|"anditas string as lowercase contains"|active=true|"ANDitas string as lowercase contains"|dir=in|"and (itas string as lowercase contains"|protocol=1|"orNOT (itas string as lowercase contains"|protocol")) AND (itas string as lowercase contains"|lport=" & (value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string) & "|"ORnot (itas string as lowercase contains"|lport=")) AND (not ((itas string as lowercase contains"|app=")) OR (if (itas string as lowercase contains"|app=") then (itas string contains"\BESRelay.exe|") elsetrue) AND ((itas string as lowercase contains"|profile=" & (if (current profile type of firewall = domain firewall profile type) then"domain|"elseif (current profile type of firewall = public firewall profile type) then"public|"elseif (current profile type of firewall = private firewall profile type) then"private|"else"INVALID")) ORnot (itas string as lowercase contains"|profile"))) ofit) ofit) of native registry)) AND ((exists rule whose ((enabled ofitand (protocol ofit= internet protocol 58) and inbound ofitand profile (current profile type of firewall) ofitand (regex "^(\s)*$"= application name ofitOR application name ofit ends with"\BESRelay.exe") AND regex "^(\s)*$"= service name ofit)) of firewall) OR (exist key "HKLM\Software\Policies\Microsoft\WindowsFirewall\FirewallRules"whose (exists value whose (itas string as lowercase contains"|action=allow|"anditas string as lowercase contains"|active=true|"ANDitas string as lowercase contains"|dir=in|"and (itas string as lowercase contains"|protocol=58|"orNOT (itas string as lowercase contains"|protocol")) AND (itas string as lowercase contains"|lport=" & (value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string) & "|"ORnot (itas string as lowercase contains"|lport=")) AND (not ((itas string as lowercase contains"|app=")) OR (if (itas string as lowercase contains"|app=") then (itas string contains"\BESRelay.exe|") elsetrue) AND ((itas string as lowercase contains"|profile=" & (if (current profile type of firewall = domain firewall profile type) then"domain|"elseif (current profile type of firewall = public firewall profile type) then"public|"elseif (current profile type of firewall = private firewall profile type) then"private|"else"INVALID")) ORnot (itas string as lowercase contains"|profile"))) ofit) ofit) of native registry)))))
NOT ( ( ( exists rule whose ( ( NOTexists local ports string ofitOR local ports string ofitcontains ( value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string ) OR local ports string ofit="*" ) AND ( ( ( application name ofit ends with"\BESClient.exe" ) ANDNOT ( service name ofit="BESClient" ) ) OR ( regex "^(\s)*$"= application name ofitAND regex "^(\s)*$"= service name ofit ) ) and enabled ofitand protocol ofit= udp and inbound ofitand profile ( current profile type of firewall ) ofit ) of firewall ) OR ( exists internet connection firewall whose ( enabled ofitANDexists port mapping whose ( enabled ofitAND protocol ofit="udp"AND internal port ofitas string = ( value "ListenPort"of key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry ) as string ) ofit ) of adapters of network ) OR ( exist key "HKLM\Software\Policies\Microsoft\WindowsFirewall\FirewallRules"whose ( ( exists value whose ( itas string as lowercase contains"|action=allow|"anditas string as lowercase contains"|active=true|"ANDitas string as lowercase contains"|dir=in|"and ( itas string as lowercase contains"|protocol=17|"orNOT ( itas string as lowercase contains"|protocol" ) ) AND ( itas string as lowercase contains"|lport=" & ( value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string ) & "|"ORnot ( itas string as lowercase contains"|lport=" ) ) AND ( not ( ( itas string as lowercase contains"|app=" ) ) OR ( itas string as lowercase contains"|app="anditas string contains"\BESClient.exe|" ) ) AND ( ( itas string as lowercase contains"|profile=" & ( if ( current profile type of firewall = domain firewall profile type ) then"domain|"elseif ( current profile type of firewall = public firewall profile type ) then"public|"elseif ( current profile type of firewall = private firewall profile type ) then"private|"else"INVALID" ) ) ORnot ( itas string as lowercase contains"|profile" ) ) ) ofit ) ) of native registry ) OR ( ( ( exists key ( "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & ( if ( current profile type of firewall = domain firewall profile type ) then"DomainProfile"else"StandardProfile" ) & "\GloballyOpenPorts" ) whose ( exists value whose ( ( name ofitas lowercase ="enabled" ) AND ( it=1 ) ) ofit ) ofit ) AND ( exists key ( "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & ( if ( current profile type of firewall = domain firewall profile type ) then"DomainProfile"else"StandardProfile" ) & "\GloballyOpenPorts\List" ) whose ( exists value whose ( ( name ofitstartswith value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of x32 registry as string & ":" ) AND ( regex "^(\d)+:UDP:(.+)?:enabled:(.+)$"= name ofit ) ) ofit ) ofit ) ) of native registry ) OR ( ( ( exists key ( "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & ( if ( current profile type of firewall = domain firewall profile type ) then"DomainProfile"else"StandardProfile" ) & "\AuthorizedApplications" ) whose ( exists value whose ( ( name ofitas lowercase ="enabled" ) AND ( it=1 ) ) ofit ) ofit ) AND ( exists key ( "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & ( if ( current profile type of firewall = domain firewall profile type ) then"DomainProfile"else"StandardProfile" ) & "\AuthorizedApplications\List" ) whose ( exists value whose ( ( regex "^(.+)?\\BESClient.exe:(.+)?:enabled:(.+)$"= name ofit ) ) ofit ) ofit ) ) of native registry ) ) AND ( ( exists key ( "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & ( if ( current profile type of firewall = domain firewall profile type ) then"DomainProfile"else"StandardProfile" ) & "\IcmpSettings" ) whose ( exists value whose ( name ofit="AllowInboundEchoRequest"andit=1 ) ofit ) of native registry ) OR ( ( ( exists rule whose ( ( enabled ofitand ( protocol ofit= internet protocol 1 ) and inbound ofitand profile ( current profile type of firewall ) ofitand ( regex "^(\s)*$"= application name ofitOR application name ofit ends with"\BESClient.exe" ) AND regex "^(\s)*$"= service name ofit ) ) of firewall ) OR ( exist key "HKLM\Software\Policies\Microsoft\WindowsFirewall\FirewallRules"whose ( exists value whose ( itas string as lowercase contains"|action=allow|"anditas string as lowercase contains"|active=true|"ANDitas string as lowercase contains"|dir=in|"and ( itas string as lowercase contains"|protocol=1|"orNOT ( itas string as lowercase contains"|protocol" ) ) AND ( itas string as lowercase contains"|lport=" & ( value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string ) & "|"ORnot ( itas string as lowercase contains"|lport=" ) ) AND ( not ( ( itas string as lowercase contains"|app=" ) ) OR ( if ( itas string as lowercase contains"|app=" ) then ( itas string contains"\BESClient.exe|" ) elsetrue ) AND ( ( itas string as lowercase contains"|profile=" & ( if ( current profile type of firewall = domain firewall profile type ) then"domain|"elseif ( current profile type of firewall = public firewall profile type ) then"public|"elseif ( current profile type of firewall = private firewall profile type ) then"private|"else"INVALID" ) ) ORnot ( itas string as lowercase contains"|profile" ) ) ) ofit ) ofit ) of native registry ) ) AND ( ( exists rule whose ( ( enabled ofitand ( protocol ofit= internet protocol 58 ) and inbound ofitand profile ( current profile type of firewall ) ofitand ( regex "^(\s)*$"= application name ofitOR application name ofit ends with"\BESClient.exe" ) AND regex "^(\s)*$"= service name ofit ) ) of firewall ) OR ( exist key "HKLM\Software\Policies\Microsoft\WindowsFirewall\FirewallRules"whose ( exists value whose ( itas string as lowercase contains"|action=allow|"anditas string as lowercase contains"|active=true|"ANDitas string as lowercase contains"|dir=in|"and ( itas string as lowercase contains"|protocol=58|"orNOT ( itas string as lowercase contains"|protocol" ) ) AND ( itas string as lowercase contains"|lport=" & ( value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string ) & "|"ORnot ( itas string as lowercase contains"|lport=" ) ) AND ( not ( ( itas string as lowercase contains"|app=" ) ) OR ( if ( itas string as lowercase contains"|app=" ) then ( itas string contains"\BESClient.exe|" ) elsetrue ) AND ( ( itas string as lowercase contains"|profile=" & ( if ( current profile type of firewall = domain firewall profile type ) then"domain|"elseif ( current profile type of firewall = public firewall profile type ) then"public|"elseif ( current profile type of firewall = private firewall profile type ) then"private|"else"INVALID" ) ) ORnot ( itas string as lowercase contains"|profile" ) ) ) ofit ) ofit ) of native registry ) ) ) ) )
NOT (((exists rule whose ((NOTexists local ports string ofitOR local ports string ofitcontains (value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string) OR local ports string ofit="*") AND (((application name ofit ends with"\BESClient.exe") ANDNOT (service name ofit="BESClient")) OR (regex "^(\s)*$"= application name ofitAND regex "^(\s)*$"= service name ofit)) and enabled ofitand protocol ofit= udp and inbound ofitand profile (current profile type of firewall) ofit) of firewall) OR (exists internet connection firewall whose (enabled ofitANDexists port mapping whose (enabled ofitAND protocol ofit="udp"AND internal port ofitas string = (value "ListenPort"of key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry) as string) ofit) of adapters of network) OR (exist key "HKLM\Software\Policies\Microsoft\WindowsFirewall\FirewallRules"whose ((exists value whose (itas string as lowercase contains"|action=allow|"anditas string as lowercase contains"|active=true|"ANDitas string as lowercase contains"|dir=in|"and (itas string as lowercase contains"|protocol=17|"orNOT (itas string as lowercase contains"|protocol")) AND (itas string as lowercase contains"|lport=" & (value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string) & "|"ORnot (itas string as lowercase contains"|lport=")) AND (not ((itas string as lowercase contains"|app=")) OR (itas string as lowercase contains"|app="anditas string contains"\BESClient.exe|")) AND ((itas string as lowercase contains"|profile=" & (if (current profile type of firewall = domain firewall profile type) then"domain|"elseif (current profile type of firewall = public firewall profile type) then"public|"elseif (current profile type of firewall = private firewall profile type) then"private|"else"INVALID")) ORnot (itas string as lowercase contains"|profile"))) ofit)) of native registry) OR (((exists key ("HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & (if (current profile type of firewall = domain firewall profile type) then"DomainProfile"else"StandardProfile") & "\GloballyOpenPorts") whose (exists value whose ((name ofitas lowercase ="enabled") AND (it=1)) ofit) ofit) AND (exists key ("HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & (if (current profile type of firewall = domain firewall profile type) then"DomainProfile"else"StandardProfile") & "\GloballyOpenPorts\List") whose (exists value whose ((name ofitstartswith value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of x32 registry as string & ":") AND (regex "^(\d)+:UDP:(.+)?:enabled:(.+)$"= name ofit)) ofit) ofit)) of native registry) OR (((exists key ("HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & (if (current profile type of firewall = domain firewall profile type) then"DomainProfile"else"StandardProfile") & "\AuthorizedApplications") whose (exists value whose ((name ofitas lowercase ="enabled") AND (it=1)) ofit) ofit) AND (exists key ("HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & (if (current profile type of firewall = domain firewall profile type) then"DomainProfile"else"StandardProfile") & "\AuthorizedApplications\List") whose (exists value whose ((regex "^(.+)?\\BESClient.exe:(.+)?:enabled:(.+)$"= name ofit)) ofit) ofit)) of native registry)) AND ((exists key ("HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & (if (current profile type of firewall = domain firewall profile type) then"DomainProfile"else"StandardProfile") & "\IcmpSettings") whose (exists value whose (name ofit="AllowInboundEchoRequest"andit=1) ofit) of native registry) OR (((exists rule whose ((enabled ofitand (protocol ofit= internet protocol 1) and inbound ofitand profile (current profile type of firewall) ofitand (regex "^(\s)*$"= application name ofitOR application name ofit ends with"\BESClient.exe") AND regex "^(\s)*$"= service name ofit)) of firewall) OR (exist key "HKLM\Software\Policies\Microsoft\WindowsFirewall\FirewallRules"whose (exists value whose (itas string as lowercase contains"|action=allow|"anditas string as lowercase contains"|active=true|"ANDitas string as lowercase contains"|dir=in|"and (itas string as lowercase contains"|protocol=1|"orNOT (itas string as lowercase contains"|protocol")) AND (itas string as lowercase contains"|lport=" & (value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string) & "|"ORnot (itas string as lowercase contains"|lport=")) AND (not ((itas string as lowercase contains"|app=")) OR (if (itas string as lowercase contains"|app=") then (itas string contains"\BESClient.exe|") elsetrue) AND ((itas string as lowercase contains"|profile=" & (if (current profile type of firewall = domain firewall profile type) then"domain|"elseif (current profile type of firewall = public firewall profile type) then"public|"elseif (current profile type of firewall = private firewall profile type) then"private|"else"INVALID")) ORnot (itas string as lowercase contains"|profile"))) ofit) ofit) of native registry)) AND ((exists rule whose ((enabled ofitand (protocol ofit= internet protocol 58) and inbound ofitand profile (current profile type of firewall) ofitand (regex "^(\s)*$"= application name ofitOR application name ofit ends with"\BESClient.exe") AND regex "^(\s)*$"= service name ofit)) of firewall) OR (exist key "HKLM\Software\Policies\Microsoft\WindowsFirewall\FirewallRules"whose (exists value whose (itas string as lowercase contains"|action=allow|"anditas string as lowercase contains"|active=true|"ANDitas string as lowercase contains"|dir=in|"and (itas string as lowercase contains"|protocol=58|"orNOT (itas string as lowercase contains"|protocol")) AND (itas string as lowercase contains"|lport=" & (value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string) & "|"ORnot (itas string as lowercase contains"|lport=")) AND (not ((itas string as lowercase contains"|app=")) OR (if (itas string as lowercase contains"|app=") then (itas string contains"\BESClient.exe|") elsetrue) AND ((itas string as lowercase contains"|profile=" & (if (current profile type of firewall = domain firewall profile type) then"domain|"elseif (current profile type of firewall = public firewall profile type) then"public|"elseif (current profile type of firewall = private firewall profile type) then"private|"else"INVALID")) ORnot (itas string as lowercase contains"|profile"))) ofit) ofit) of native registry)))))