Search | bigfix.me

Search Results for: View a List of IIS Manager User Accounts

Results - 1117 Relevance Statements, 2037 Fixlets, 82 Analyses, 2 Dashboards, and 12 Signatures -- (4343.173 ms)

Page 130 of 130 << < Prev Next > >>

Relevance 492

Used in 1 fixlet

* Results in a true/false

exists key whose (exists value "DisplayName" whose (it = "Tivoli Endpoint Manager Server API") of it) of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of x32 registry

0 Votes

Relevance 582

Used in 1 fixlet

* Results in a true/false

NOT
(
    (
        version of regapp "iexplore.exe" >= "7"
    )
    AND
    (
        exists key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60" of registry
    )
    AND
    (
        exists folder "macromed\flash" whose
        (
            exists file whose
            (
                (
                    (
                        it starts with "flash" AND it ends with ".ocx"
                    )
                    OR
                    (
                        it = "swflash.ocx"
                    )
                )
                of
                (
                    name of it as lowercase
                )
                AND version of it >= "9"
            )
            of it
        )
        of system folder
    )
    AND
    (
        exists key
        (
            "HKEY_USERS\" &
            (
                (
                    if it = "LocalSystem" then "S-1-5-18" else if it = "LocalService" then "S-1-5-19" else if it = "NetworkService" then "S-1-5-20" else
                    (
                        string value of select
                        (
                            (
                                "SID from Win32_UserAccount where NAME='" & following text of last "\" of it & "' and DOMAIN='" &
                                (
                                    (
                                        if it = "." then computer name else it
                                    )
                                    of preceding text of last "\" of it
                                )
                                & "'"
                            )
                            of
                            (
                                (
                                    login account of service "BESWebReportsServer"
                                )
                                as string
                            )
                        )
                        of wmi
                    )
                )
                of login account of service "BESWebReportsServer"
            )
            & "\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\" &
            (
                first match
                (
                    regex "^[^:]+"
                )
                of first match
                (
                    regex "[^/]+$"
                )
                of
                (
                    it as string
                )
            )
            of value "Hostname" of key "HKLM\SOFTWARE\BigFix\Enterprise Server\Installer\" of registry
        )
        whose
        (
            exists value "http" whose
            (
                it = 2
            )
            of it AND exists value "https" whose
            (
                it = 2
            )
            of it
        )
        of registry
    )
    AND
    (
        exists key "HKLM\Software\BigFix\Enterprise Server\BESReports" whose
        (
            (
                (
                    exists value "PDFEnable" whose
                    (
                        it = "1"
                    )
                    of it
                )
                OR
                (
                    exists key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports" whose
                    (
                        exists value
                        (
                            (
                                (
                                    (
                                        if x64 of operating system then value "ProgramFilesDir (x86)" of it else value "ProgramFilesDir" of it
                                    )
                                    of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion" of registry
                                )
                                as string
                            )
                            & "\BigFix Enterprise\BES Server\BESReportsData\ArchiveData\__pdf\out.ps"
                        )
                        of it
                    )
                    of native registry
                )
            )
            AND value "PDFPostScriptPath" of it =
            (
                (
                    (
                        (
                            if x64 of operating system then value "ProgramFilesDir (x86)" of it else value "ProgramFilesDir" of it
                        )
                        of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion" of registry
                    )
                    as string
                )
                & "\BigFix Enterprise\BES Server\BESReportsData\ArchiveData\__pdf\out.ps"
            )
            AND value "PDFPrinterName" of it = "BES Web Reports Printer"
        )
        of registry
    )
    AND
    (
        exists key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" whose
        (
            (
                exists key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60" whose
                (
                    exists value "UninstallString" of it
                )
                of registry
            )
            AND
            (
                (
                    it contains parenthesized part 1 of
                    (
                        first match
                        (
                            regex "^(.*)uninstgs.exe"
                        )
                        of
                        (
                            value "UninstallString" of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60" of registry as string
                        )
                    )
                    & "gs8.60\bin" AND it contains parenthesized part 1 of
                    (
                        first match
                        (
                            regex "^(.*)uninstgs.exe"
                        )
                        of
                        (
                            value "UninstallString" of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60" of registry as string
                        )
                    )
                    & "gs8.60\lib"
                )
                of
                (
                    value "Path" of it as string
                )
            )
        )
        of registry
    )
    AND
    (
        exists key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports" whose
        (
            exists value
            (
                (
                    (
                        (
                            if x64 of operating system then value "ProgramFilesDir (x86)" of it else value "ProgramFilesDir" of it
                        )
                        of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion" of registry
                    )
                    as string
                )
                & "\BigFix Enterprise\BES Server\BESReportsData\ArchiveData\__pdf\out.ps"
            )
            of it
        )
        of native registry
    )
    AND
    (
        exists key
        (
            "HKU\" &
            (
                (
                    if it = "LocalSystem" then "S-1-5-18" else if it = "LocalService" then "S-1-5-19" else if it = "NetworkService" then "S-1-5-20" else
                    (
                        string value of select
                        (
                            (
                                "SID from Win32_UserAccount where NAME='" & following text of last "\" of it & "' and DOMAIN='" &
                                (
                                    (
                                        if it = "." then computer name else it
                                    )
                                    of preceding text of last "\" of it
                                )
                                & "'"
                            )
                            of
                            (
                                (
                                    login account of service "BESWebReportsServer"
                                )
                                as string
                            )
                        )
                        of wmi
                    )
                )
                of login account of service "BESWebReportsServer"
            )
            & "\Software\Microsoft\Internet Explorer\PageSetup"
        )
        of registry
    )
)

0 Votes

Relevance 616

Used in 1 fixlet

* Results in a true/false

NOT
(
    (
        (
            exists rule whose
            (
                (
                    NOT exists local ports string of it OR local ports string of it contains
                    (
                        value "ListenPort" of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions" of registry as string
                    )
                    OR local ports string of it = "*"
                )
                AND
                (
                    (
                        (
                            application name of it ends with "\BESRelay.exe"
                        )
                        AND NOT
                        (
                            service name of it = "BESRelay"
                        )
                    )
                    OR
                    (
                        regex "^(\s)*$" = application name of it AND regex "^(\s)*$" = service name of it
                    )
                )
                and enabled of it and protocol of it = udp and inbound of it and profile
                (
                    current profile type of firewall
                )
                of it
            )
            of firewall
        )
        OR
        (
            exists internet connection firewall whose
            (
                enabled of it AND exists port mapping whose
                (
                    enabled of it AND protocol of it = "udp" AND internal port of it as string =
                    (
                        value "ListenPort" of key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions" of registry
                    )
                    as string
                )
                of it
            )
            of adapters of network
        )
        OR
        (
            exist key "HKLM\Software\Policies\Microsoft\WindowsFirewall\FirewallRules" whose
            (
                (
                    exists value whose
                    (
                        it as string as lowercase contains "|action=allow|" and it as string as lowercase contains "|active=true|" AND it as string as lowercase contains "|dir=in|" and
                        (
                            it as string as lowercase contains "|protocol=17|" or NOT
                            (
                                it as string as lowercase contains "|protocol"
                            )
                        )
                        AND
                        (
                            it as string as lowercase contains "|lport=" &
                            (
                                value "ListenPort" of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions" of registry as string
                            )
                            & "|" OR not
                            (
                                it as string as lowercase contains "|lport="
                            )
                        )
                        AND
                        (
                            not
                            (
                                (
                                    it as string as lowercase contains "|app="
                                )
                            )
                            OR
                            (
                                it as string as lowercase contains "|app=" and it as string contains "\BESRelay.exe|"
                            )
                        )
                        AND
                        (
                            (
                                it as string as lowercase contains "|profile=" &
                                (
                                    if
                                    (
                                        current profile type of firewall = domain firewall profile type
                                    )
                                    then "domain|" else if
                                    (
                                        current profile type of firewall = public firewall profile type
                                    )
                                    then "public|" else if
                                    (
                                        current profile type of firewall = private firewall profile type
                                    )
                                    then "private|" else "INVALID"
                                )
                            )
                            OR not
                            (
                                it as string as lowercase contains "|profile"
                            )
                        )
                    )
                    of it
                )
            )
            of native registry
        )
        OR
        (
            (
                (
                    exists key
                    (
                        "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" &
                        (
                            if
                            (
                                current profile type of firewall = domain firewall profile type
                            )
                            then "DomainProfile" else "StandardProfile"
                        )
                        & "\GloballyOpenPorts"
                    )
                    whose
                    (
                        exists value whose
                        (
                            (
                                name of it as lowercase = "enabled"
                            )
                            AND
                            (
                                it = 1
                            )
                        )
                        of it
                    )
                    of it
                )
                AND
                (
                    exists key
                    (
                        "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" &
                        (
                            if
                            (
                                current profile type of firewall = domain firewall profile type
                            )
                            then "DomainProfile" else "StandardProfile"
                        )
                        & "\GloballyOpenPorts\List"
                    )
                    whose
                    (
                        exists value whose
                        (
                            (
                                name of it starts with value "ListenPort" of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions" of x32 registry as string & ":"
                            )
                            AND
                            (
                                regex "^(\d)+:UDP:(.+)?:enabled:(.+)$" = name of it
                            )
                        )
                        of it
                    )
                    of it
                )
            )
            of native registry
        )
        OR
        (
            (
                (
                    exists key
                    (
                        "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" &
                        (
                            if
                            (
                                current profile type of firewall = domain firewall profile type
                            )
                            then "DomainProfile" else "StandardProfile"
                        )
                        & "\AuthorizedApplications"
                    )
                    whose
                    (
                        exists value whose
                        (
                            (
                                name of it as lowercase = "enabled"
                            )
                            AND
                            (
                                it = 1
                            )
                        )
                        of it
                    )
                    of it
                )
                AND
                (
                    exists key
                    (
                        "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" &
                        (
                            if
                            (
                                current profile type of firewall = domain firewall profile type
                            )
                            then "DomainProfile" else "StandardProfile"
                        )
                        & "\AuthorizedApplications\List"
                    )
                    whose
                    (
                        exists value whose
                        (
                            (
                                regex "^(.+)?\\BESRelay.exe:(.+)?:enabled:(.+)$" = name of it
                            )
                        )
                        of it
                    )
                    of it
                )
            )
            of native registry
        )
    )
    AND
    (
        (
            exists rule whose
            (
                (
                    NOT exists local ports string of it OR local ports string of it contains
                    (
                        value "ListenPort" of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions" of registry as string
                    )
                    OR local ports string of it = "*"
                )
                AND
                (
                    (
                        (
                            application name of it ends with "\BESRelay.exe"
                        )
                        AND NOT
                        (
                            service name of it = "BESRelay"
                        )
                    )
                    OR
                    (
                        regex "^(\s)*$" = application name of it AND regex "^(\s)*$" = service name of it
                    )
                )
                and enabled of it and protocol of it = tcp and inbound of it and profile
                (
                    current profile type of firewall
                )
                of it
            )
            of firewall
        )
        OR
        (
            exists internet connection firewall whose
            (
                enabled of it AND exists port mapping whose
                (
                    enabled of it AND protocol of it = "tcp" AND internal port of it as string =
                    (
                        value "ListenPort" of key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions" of registry
                    )
                    as string
                )
                of it
            )
            of adapters of network
        )
        OR
        (
            exist key "HKLM\Software\Policies\Microsoft\WindowsFirewall\FirewallRules" whose
            (
                (
                    exists value whose
                    (
                        it as string as lowercase contains "|action=allow|" and it as string as lowercase contains "|active=true|" AND it as string as lowercase contains "|dir=in|" and
                        (
                            it as string as lowercase contains "|protocol=6|" or NOT
                            (
                                it as string as lowercase contains "|protocol"
                            )
                        )
                        AND
                        (
                            it as string as lowercase contains "|lport=" &
                            (
                                value "ListenPort" of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions" of registry as string
                            )
                            & "|" OR not
                            (
                                it as string as lowercase contains "|lport="
                            )
                        )
                        AND
                        (
                            not
                            (
                                (
                                    it as string as lowercase contains "|app="
                                )
                            )
                            OR
                            (
                                it as string as lowercase contains "|app=" and it as string contains "\BESRelay.exe|"
                            )
                        )
                        AND
                        (
                            (
                                it as string as lowercase contains "|profile=" &
                                (
                                    if
                                    (
                                        current profile type of firewall = domain firewall profile type
                                    )
                                    then "domain|" else if
                                    (
                                        current profile type of firewall = public firewall profile type
                                    )
                                    then "public|" else if
                                    (
                                        current profile type of firewall = private firewall profile type
                                    )
                                    then "private|" else "INVALID"
                                )
                            )
                            OR not
                            (
                                it as string as lowercase contains "|profile"
                            )
                        )
                    )
                    of it
                )
            )
            of native registry
        )
        OR
        (
            (
                (
                    exists key
                    (
                        "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" &
                        (
                            if
                            (
                                current profile type of firewall = domain firewall profile type
                            )
                            then "DomainProfile" else "StandardProfile"
                        )
                        & "\GloballyOpenPorts"
                    )
                    whose
                    (
                        exists value whose
                        (
                            (
                                name of it as lowercase = "enabled"
                            )
                            AND
                            (
                                it = 1
                            )
                        )
                        of it
                    )
                    of it
                )
                AND
                (
                    exists key
                    (
                        "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" &
                        (
                            if
                            (
                                current profile type of firewall = domain firewall profile type
                            )
                            then "DomainProfile" else "StandardProfile"
                        )
                        & "\GloballyOpenPorts\List"
                    )
                    whose
                    (
                        exists value whose
                        (
                            (
                                name of it starts with value "ListenPort" of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions" of x32 registry as string & ":"
                            )
                            AND
                            (
                                regex "^(\d)+:TCP:(.+)?:enabled:(.+)$" = name of it
                            )
                        )
                        of it
                    )
                    of it
                )
            )
            of native registry
        )
        OR
        (
            (
                (
                    exists key
                    (
                        "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" &
                        (
                            if
                            (
                                current profile type of firewall = domain firewall profile type
                            )
                            then "DomainProfile" else "StandardProfile"
                        )
                        & "\AuthorizedApplications"
                    )
                    whose
                    (
                        exists value whose
                        (
                            (
                                name of it as lowercase = "enabled"
                            )
                            AND
                            (
                                it = 1
                            )
                        )
                        of it
                    )
                    of it
                )
                AND
                (
                    exists key
                    (
                        "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" &
                        (
                            if
                            (
                                current profile type of firewall = domain firewall profile type
                            )
                            then "DomainProfile" else "StandardProfile"
                        )
                        & "\AuthorizedApplications\List"
                    )
                    whose
                    (
                        exists value whose
                        (
                            (
                                regex "^(.+)?\\BESRelay.exe:(.+)?:enabled:(.+)$" = name of it
                            )
                        )
                        of it
                    )
                    of it
                )
            )
            of native registry
        )
    )
    AND
    (
        (
            exists key
            (
                "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" &
                (
                    if
                    (
                        current profile type of firewall = domain firewall profile type
                    )
                    then "DomainProfile" else "StandardProfile"
                )
                & "\IcmpSettings"
            )
            whose
            (
                exists value whose
                (
                    name of it = "AllowInboundEchoRequest" and it = 1
                )
                of it
            )
            of native registry
        )
        OR
        (
            (
                (
                    exists rule whose
                    (
                        (
                            enabled of it and
                            (
                                protocol of it = internet protocol 1
                            )
                            and inbound of it and profile
                            (
                                current profile type of firewall
                            )
                            of it and
                            (
                                regex "^(\s)*$" = application name of it OR application name of it ends with "\BESRelay.exe"
                            )
                            AND regex "^(\s)*$" = service name of it
                        )
                    )
                    of firewall
                )
                OR
                (
                    exist key "HKLM\Software\Policies\Microsoft\WindowsFirewall\FirewallRules" whose
                    (
                        exists value whose
                        (
                            it as string as lowercase contains "|action=allow|" and it as string as lowercase contains "|active=true|" AND it as string as lowercase contains "|dir=in|" and
                            (
                                it as string as lowercase contains "|protocol=1|" or NOT
                                (
                                    it as string as lowercase contains "|protocol"
                                )
                            )
                            AND
                            (
                                it as string as lowercase contains "|lport=" &
                                (
                                    value "ListenPort" of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions" of registry as string
                                )
                                & "|" OR not
                                (
                                    it as string as lowercase contains "|lport="
                                )
                            )
                            AND
                            (
                                not
                                (
                                    (
                                        it as string as lowercase contains "|app="
                                    )
                                )
                                OR
                                (
                                    if
                                    (
                                        it as string as lowercase contains "|app="
                                    )
                                    then
                                    (
                                        it as string contains "\BESRelay.exe|"
                                    )
                                    else true
                                )
                                AND
                                (
                                    (
                                        it as string as lowercase contains "|profile=" &
                                        (
                                            if
                                            (
                                                current profile type of firewall = domain firewall profile type
                                            )
                                            then "domain|" else if
                                            (
                                                current profile type of firewall = public firewall profile type
                                            )
                                            then "public|" else if
                                            (
                                                current profile type of firewall = private firewall profile type
                                            )
                                            then "private|" else "INVALID"
                                        )
                                    )
                                    OR not
                                    (
                                        it as string as lowercase contains "|profile"
                                    )
                                )
                            )
                            of it
                        )
                        of it
                    )
                    of native registry
                )
            )
            AND
            (
                (
                    exists rule whose
                    (
                        (
                            enabled of it and
                            (
                                protocol of it = internet protocol 58
                            )
                            and inbound of it and profile
                            (
                                current profile type of firewall
                            )
                            of it and
                            (
                                regex "^(\s)*$" = application name of it OR application name of it ends with "\BESRelay.exe"
                            )
                            AND regex "^(\s)*$" = service name of it
                        )
                    )
                    of firewall
                )
                OR
                (
                    exist key "HKLM\Software\Policies\Microsoft\WindowsFirewall\FirewallRules" whose
                    (
                        exists value whose
                        (
                            it as string as lowercase contains "|action=allow|" and it as string as lowercase contains "|active=true|" AND it as string as lowercase contains "|dir=in|" and
                            (
                                it as string as lowercase contains "|protocol=58|" or NOT
                                (
                                    it as string as lowercase contains "|protocol"
                                )
                            )
                            AND
                            (
                                it as string as lowercase contains "|lport=" &
                                (
                                    value "ListenPort" of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions" of registry as string
                                )
                                & "|" OR not
                                (
                                    it as string as lowercase contains "|lport="
                                )
                            )
                            AND
                            (
                                not
                                (
                                    (
                                        it as string as lowercase contains "|app="
                                    )
                                )
                                OR
                                (
                                    if
                                    (
                                        it as string as lowercase contains "|app="
                                    )
                                    then
                                    (
                                        it as string contains "\BESRelay.exe|"
                                    )
                                    else true
                                )
                                AND
                                (
                                    (
                                        it as string as lowercase contains "|profile=" &
                                        (
                                            if
                                            (
                                                current profile type of firewall = domain firewall profile type
                                            )
                                            then "domain|" else if
                                            (
                                                current profile type of firewall = public firewall profile type
                                            )
                                            then "public|" else if
                                            (
                                                current profile type of firewall = private firewall profile type
                                            )
                                            then "private|" else "INVALID"
                                        )
                                    )
                                    OR not
                                    (
                                        it as string as lowercase contains "|profile"
                                    )
                                )
                            )
                            of it
                        )
                        of it
                    )
                    of native registry
                )
            )
        )
    )
)

0 Votes

Relevance 620

Used in 1 fixlet

* Results in a true/false

exists key whose (value "ProductName" of it = "BigFix Enterprise Client" OR value "ProductName" of it = "Tivoli Endpoint Manager Client" OR value "ProductName" of it = "Trend Micro Endpoint Security Platform") of keys "HKEY_CLASSES_ROOT\Installer\Products" of native registry

0 Votes

Relevance 694

Used in 35 fixlets

* Results in a true/false

not exists site whose (name of it = "eEye Remediation Manager")

0 Votes

Relevance 748

Used in 1 fixlet

* Results in a true/false

(exists file ((pathname of parent folder of regapp "besclient.exe") & "\BESClient.dmp")) OR (if login account of service "BESClient" != "LocalSystem" then exists file (value of variable "userprofile" of environment & "\Local Settings\Application Data\BigFix\BESClient.dmp") else false)

0 Votes

Relevance 750

Used in 1 fixlet

* Results in a true/false

(exists file "besrelay.dmp" of parent folder of regapp "besrelay.exe") OR (if login account of service "BESRelay" != "LocalSystem" then exists file ((((value "Local AppData" of it as string & "\BigFix\besrelay.dmp" ) of keys "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" of keys of key "HKU" of registry)) whose (it as string does not contain "\Default User\")) else false)

0 Votes

Relevance 752

Used in 1 fixlet

* Results in a true/false

exists (((value "Local AppData" of it as string & "\BigFix\" ) of keys "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" of current user keys (logged on users) of registry)) whose (exists file (it as string & "BESConsole.dmp") or exists file (it as string & "BESAdmin.dmp"))

0 Votes

Relevance 767

Used in 1 fixlet

* Results in a true/false

0 Votes

Relevance 822

Used in 1 fixlet

* Results in a true/false

NOT
(
    (
        version of regapp "iexplore.exe" >= "7"
    )
    AND
    (
        exists key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60" of registry
    )
    AND
    (
        exists folder "macromed\flash" whose
        (
            exists file whose
            (
                (
                    (
                        it starts with "flash" AND it ends with ".ocx"
                    )
                    OR
                    (
                        it = "swflash.ocx"
                    )
                )
                of
                (
                    name of it as lowercase
                )
                AND version of it >= "9"
            )
            of it
        )
        of system folder
    )
    AND
    (
        exists key
        (
            "HKEY_USERS\" &
            (
                (
                    if it = "LocalSystem" then "S-1-5-18" else if it = "LocalService" then "S-1-5-19" else if it = "NetworkService" then "S-1-5-20" else
                    (
                        string value of select
                        (
                            (
                                "SID from Win32_UserAccount where NAME='" & following text of last "\" of it & "' and DOMAIN='" &
                                (
                                    (
                                        if it = "." then computer name else it
                                    )
                                    of preceding text of last "\" of it
                                )
                                & "'"
                            )
                            of
                            (
                                (
                                    login account of service "BESWebReportsServer"
                                )
                                as string
                            )
                        )
                        of wmi
                    )
                )
                of login account of service "BESWebReportsServer"
            )
            & "\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\" &
            (
                first match
                (
                    regex "^[^:]+"
                )
                of first match
                (
                    regex "[^/]+$"
                )
                of
                (
                    it as string
                )
            )
            of value "Hostname" of key "HKLM\SOFTWARE\BigFix\Enterprise Server\Installer\" of registry
        )
        whose
        (
            exists value "http" whose
            (
                it = 2
            )
            of it AND exists value "https" whose
            (
                it = 2
            )
            of it
        )
        of registry
    )
    AND
    (
        exists key "HKLM\Software\BigFix\Enterprise Server\BESReports" whose
        (
            (
                (
                    exists value "PDFEnable" whose
                    (
                        it = "1"
                    )
                    of it
                )
                OR
                (
                    exists key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports" whose
                    (
                        exists value
                        (
                            (
                                (
                                    value "EnterpriseServerFolder" of key "HKLM\SOFTWARE\BigFix\Enterprise Server" of x32 registry
                                )
                                as string
                            )
                            & "BESReportsData\ArchiveData\__pdf\out.ps"
                        )
                        of it
                    )
                    of native registry
                )
            )
            AND value "PDFPostScriptPath" of it =
            (
                (
                    (
                        value "EnterpriseServerFolder" of key "HKLM\SOFTWARE\BigFix\Enterprise Server" of x32 registry
                    )
                    as string
                )
                & "BESReportsData\ArchiveData\__pdf\out.ps"
            )
            AND value "PDFPrinterName" of it = "BES Web Reports Printer"
        )
        of registry
    )
    AND
    (
        exists key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" whose
        (
            (
                exists key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60" whose
                (
                    exists value "UninstallString" of it
                )
                of registry
            )
            AND
            (
                (
                    it contains parenthesized part 1 of
                    (
                        first match
                        (
                            regex "^(.*)uninstgs.exe"
                        )
                        of
                        (
                            value "UninstallString" of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60" of registry as string
                        )
                    )
                    & "gs8.60\bin" AND it contains parenthesized part 1 of
                    (
                        first match
                        (
                            regex "^(.*)uninstgs.exe"
                        )
                        of
                        (
                            value "UninstallString" of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60" of registry as string
                        )
                    )
                    & "gs8.60\lib"
                )
                of
                (
                    value "Path" of it as string
                )
            )
        )
        of registry
    )
    AND
    (
        exists key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports" whose
        (
            exists value
            (
                (
                    (
                        value "EnterpriseServerFolder" of key "HKLM\SOFTWARE\BigFix\Enterprise Server" of x32 registry
                    )
                    as string
                )
                & "BESReportsData\ArchiveData\__pdf\out.ps"
            )
            of it
        )
        of native registry
    )
    AND
    (
        exists key
        (
            "HKU\" &
            (
                (
                    if it = "LocalSystem" then "S-1-5-18" else if it = "LocalService" then "S-1-5-19" else if it = "NetworkService" then "S-1-5-20" else
                    (
                        string value of select
                        (
                            (
                                "SID from Win32_UserAccount where NAME='" & following text of last "\" of it & "' and DOMAIN='" &
                                (
                                    (
                                        if it = "." then computer name else it
                                    )
                                    of preceding text of last "\" of it
                                )
                                & "'"
                            )
                            of
                            (
                                (
                                    login account of service "BESWebReportsServer"
                                )
                                as string
                            )
                        )
                        of wmi
                    )
                )
                of login account of service "BESWebReportsServer"
            )
            & "\Software\Microsoft\Internet Explorer\PageSetup"
        )
        of registry
    )
)

0 Votes

Relevance 825

Used in 1 fixlet

* Results in a true/false

(
    (
        version of regapp "iexplore.exe" >= "7"
    )
    AND
    (
        exists key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60" of registry
    )
    AND
    (
        exists folder "macromed\flash" whose
        (
            exists file whose
            (
                (
                    (
                        it starts with "flash" AND it ends with ".ocx"
                    )
                    OR
                    (
                        it = "swflash.ocx"
                    )
                )
                of
                (
                    name of it as lowercase
                )
                AND version of it >= "9"
            )
            of it
        )
        of system folder
    )
    AND
    (
        exists key
        (
            "HKEY_USERS\" &
            (
                (
                    if
                    (
                        it = "LocalSystem"
                    )
                    then
                    (
                        "S-1-5-18"
                    )
                    else if
                    (
                        it = "LocalService"
                    )
                    then
                    (
                        "S-1-5-19"
                    )
                    else if
                    (
                        it = "NetworkService"
                    )
                    then
                    (
                        "S-1-5-20"
                    )
                    else if
                    (
                        it contains "@"
                    )
                    then
                    (
                        component string of sid of security account
                        (
                            it
                        )
                    )
                    else
                    (
                        string value of select
                        (
                            (
                                "SID from Win32_UserAccount where NAME='" & following text of last "\" of it & "' and DOMAIN='" &
                                (
                                    (
                                        if it = "." then computer name else it
                                    )
                                    of preceding text of last "\" of it
                                )
                                & "'"
                            )
                            of
                            (
                                (
                                    login account of service "BESWebReportsServer"
                                )
                                as string
                            )
                        )
                        of wmi
                    )
                )
                of login account of service "BESWebReportsServer"
            )
            & "\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\" &
            (
                first match
                (
                    regex "^[^:]+"
                )
                of first match
                (
                    regex "[^/]+$"
                )
                of
                (
                    it as string
                )
            )
            of value "Hostname" of key "HKLM\SOFTWARE\BigFix\Enterprise Server\Installer\" of registry
        )
        whose
        (
            exists value "http" whose
            (
                it = 2
            )
            of it AND exists value "https" whose
            (
                it = 2
            )
            of it
        )
        of registry
    )
    AND
    (
        exists key "HKLM\Software\BigFix\Enterprise Server\BESReports" whose
        (
            (
                (
                    exists value "PDFEnable" whose
                    (
                        it = "1"
                    )
                    of it
                )
                OR
                (
                    exists key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports" whose
                    (
                        exists value
                        (
                            (
                                (
                                    value "EnterpriseServerFolder" of key "HKLM\SOFTWARE\BigFix\Enterprise Server" of x32 registry
                                )
                                as string
                            )
                            & "BESReportsData\ArchiveData\__pdf\out.ps"
                        )
                        of it
                    )
                    of native registry
                )
            )
            AND value "PDFPostScriptPath" of it =
            (
                (
                    (
                        value "EnterpriseServerFolder" of key "HKLM\SOFTWARE\BigFix\Enterprise Server" of x32 registry
                    )
                    as string
                )
                & "BESReportsData\ArchiveData\__pdf\out.ps"
            )
            AND value "PDFPrinterName" of it = "BES Web Reports Printer"
        )
        of registry
    )
    AND
    (
        exists key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" whose
        (
            (
                exists key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60" whose
                (
                    exists value "UninstallString" of it
                )
                of registry
            )
            AND
            (
                (
                    it contains parenthesized part 1 of
                    (
                        first match
                        (
                            regex "^(.*)uninstgs.exe"
                        )
                        of
                        (
                            value "UninstallString" of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60" of registry as string
                        )
                    )
                    & "gs8.60\bin" AND it contains parenthesized part 1 of
                    (
                        first match
                        (
                            regex "^(.*)uninstgs.exe"
                        )
                        of
                        (
                            value "UninstallString" of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60" of registry as string
                        )
                    )
                    & "gs8.60\lib"
                )
                of
                (
                    value "Path" of it as string
                )
            )
        )
        of registry
    )
    AND
    (
        exists key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports" whose
        (
            exists value
            (
                (
                    (
                        value "EnterpriseServerFolder" of key "HKLM\SOFTWARE\BigFix\Enterprise Server" of x32 registry
                    )
                    as string
                )
                & "BESReportsData\ArchiveData\__pdf\out.ps"
            )
            of it
        )
        of native registry
    )
    AND
    (
        exists key
        (
            "HKU\" &
            (
                (
                    if
                    (
                        it = "LocalSystem"
                    )
                    then
                    (
                        "S-1-5-18"
                    )
                    else if
                    (
                        it = "LocalService"
                    )
                    then
                    (
                        "S-1-5-19"
                    )
                    else if
                    (
                        it = "NetworkService"
                    )
                    then
                    (
                        "S-1-5-20"
                    )
                    else if
                    (
                        it contains "@"
                    )
                    then
                    (
                        component string of sid of security account
                        (
                            it
                        )
                    )
                    else
                    (
                        string value of select
                        (
                            (
                                "SID from Win32_UserAccount where NAME='" & following text of last "\" of it & "' and DOMAIN='" &
                                (
                                    (
                                        if it = "." then computer name else it
                                    )
                                    of preceding text of last "\" of it
                                )
                                & "'"
                            )
                            of
                            (
                                (
                                    login account of service "BESWebReportsServer"
                                )
                                as string
                            )
                        )
                        of wmi
                    )
                )
                of login account of service "BESWebReportsServer"
            )
            & "\Software\Microsoft\Internet Explorer\PageSetup"
        )
        of registry
    )
)

1 Votes

Relevance 839

Used in 1 fixlet

* Results in a true/false

0 Votes

Relevance 893

Used in 1 fixlet

* Results in a true/false

name of operating system starts with "Win" AND (((it = "BES Client" OR it = "Enterprise Client") of name of parent folder of regapp "BESClient.exe") AND exists (values "DisplayName" of keys of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of registry) whose ((it = "BigFix Enterprise Client" OR it = "BigFix for IBM Proventia ESC Client" OR it = "ESP Agent" OR it = "Trend Micro Endpoint Security Platform" OR it = "Tivoli Endpoint Manager Client") of (it as string)))

0 Votes

CA, CA IT Client Manager Agent, 6.0 (Signature 28)

Uploaded on 2/19/2015 by jmatlock
0 comments and 11 downloads

Veritas, Veritas Volume Manager, 6.0 (Signature 35)

Uploaded on 2/19/2015 by jmatlock
0 comments and 10 downloads

Veritas, Veritas Volume Manager, 6.1 (Signature 38)

Uploaded on 2/19/2015 by jmatlock
0 comments and 10 downloads

Veritas, Veritas Volume Manager, 6.2 (Signature 39)

Uploaded on 2/19/2015 by jmatlock
0 comments and 11 downloads

Veritas, Veritas Volume Manager, 6.1 (Signature 54)

Uploaded on 2/19/2015 by jmatlock
0 comments and 11 downloads

Veritas, Veritas Volume Manager, 6.2 (Signature 55)