if ( ( it="WinXP"ORit="WinXP-2003"ORit="WinVista"ORit="Win7"ORit="Win2008"ORit="Win2008R2" ) of name of operating system ) then ( ( exists values whose ( name ofit="PnPCapabilities"ANDitas integer =48 ) of keys whose ( value "Characteristics"ofitas integer =132 ) of key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}"of registry ) ) else ( if ( name of operating system ="Mac OS X" ) then ( ifexists file "/Library/Preferences/SystemConfiguration/com.apple.PowerManagement.plist"then ( ( ifit=1thentrueelsefalse ) of integer "Wake On LAN"of dictionary "AC Power"of dictionary "Custom Profile"of dictionary of file "/Library/Preferences/SystemConfiguration/com.apple.PowerManagement.plist" ) elsefalse ) elsefalse )
if ((it="WinXP"ORit="WinXP-2003"ORit="WinVista"ORit="Win7"ORit="Win2008"ORit="Win2008R2") of name of operating system) then ((exists values whose(name ofit="PnPCapabilities"ANDitas integer =48 ) of keys whose(value "Characteristics"ofitas integer =132) of key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}"of registry)) else (if (name of operating system ="Mac OS X") then (ifexists file "/Library/Preferences/SystemConfiguration/com.apple.PowerManagement.plist"then ((ifit=1thentrueelsefalse) of integer "Wake On LAN"of dictionary "AC Power"of dictionary "Custom Profile"of dictionary of file "/Library/Preferences/SystemConfiguration/com.apple.PowerManagement.plist") elsefalse) elsefalse)
if ( ( it="WinXP"ORit="WinXP-2003"ORit="WinVista"ORit="Win7"ORit="Win2008"ORit="Win2008R2" ) of name of operating system ) then ( ( notexists values whose ( name ofit="PnPCapabilities"ANDitas integer =288 ) of keys whose ( value "Characteristics"ofitas integer =132 ) of key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}"of registry ) ) else ( if ( name of operating system ="Mac OS X" ) then ( ifexists file "/Library/Preferences/SystemConfiguration/com.apple.PowerManagement.plist"then ( ( ifit=0thentrueelsefalse ) of integer "Wake On LAN"of dictionary "AC Power"of dictionary "Custom Profile"of dictionary of file "/Library/Preferences/SystemConfiguration/com.apple.PowerManagement.plist" ) elsefalse ) elsefalse )
if ((it="WinXP"ORit="WinXP-2003"ORit="WinVista"ORit="Win7"ORit="Win2008"ORit="Win2008R2") of name of operating system) then ((notexists values whose (name ofit="PnPCapabilities"ANDitas integer =288) of keys whose (value "Characteristics"ofitas integer =132) of key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}"of registry)) else (if (name of operating system ="Mac OS X") then (ifexists file "/Library/Preferences/SystemConfiguration/com.apple.PowerManagement.plist"then ((ifit=0thentrueelsefalse) of integer "Wake On LAN"of dictionary "AC Power"of dictionary "Custom Profile"of dictionary of file "/Library/Preferences/SystemConfiguration/com.apple.PowerManagement.plist") elsefalse) elsefalse)
if ( name of operating system ="AIX 5.3" ) then ( existstruewhose ( iftruethen ( current technology level of operating system >= "5300-08" ) elsefalse ) ) elsetrue
if (name of operating system ="AIX 5.3") then (existstruewhose (iftruethen (current technology level of operating system >= "5300-08") elsefalse)) elsetrue
if ( ( ( exists match ( regex "AIX (6.1|7.1)" ) of name of operating system ) ) AND ( architecture of operating system ="ppc64" ) ) then ( existstruewhose ( iftruethen ( current technology level of operating system >= "6100-04" ) elsefalse ) ) elsetrue
if (((exists match (regex "AIX (6.1|7.1)") of name of operating system)) AND (architecture of operating system ="ppc64")) then (existstruewhose (iftruethen (current technology level of operating system >= "6100-04") elsefalse)) elsetrue
if ( name of operating system contains"Linux SuSE" ) then ( ( exists match ( regex "^i[0-9]86$" ) ofitORit="x86_64" ) of architecture of operating system ) elsetrue
if (name of operating system contains"Linux SuSE") then ( (exists match (regex "^i[0-9]86$") ofitORit="x86_64") of architecture of operating system) elsetrue
if ( version of client >= "8.2.425" ) then ( existstruewhose ( iftruethen ( current technology level of operating system as string >= "5300-08" ) elsefalse ) ) elsetrue
if (version of client >= "8.2.425") then (existstruewhose (iftruethen (current technology level of operating system as string >= "5300-08") elsefalse)) elsetrue
if ( version of client >= "8.2.425" ) then ( existstruewhose ( iftruethen ( current technology level of operating system as string >= "6100-04" ) elsefalse ) ) elsetrue
if (version of client >= "8.2.425") then (existstruewhose (iftruethen (current technology level of operating system as string >= "6100-04") elsefalse)) elsetrue
exists service whose ( itas string contains"BESClientLoggingService" ) AND ( exists file whose ( name ofitcontains"BESClientLoggingService" ) of folder ( pathname of parent folder of regapp "besclient.exe" & "\BESClientLoggingService" ) )
exists service whose (itas string contains"BESClientLoggingService") AND (exists file whose (name ofitcontains"BESClientLoggingService") of folder (pathname of parent folder of regapp "besclient.exe" & "\BESClientLoggingService"))
( ( ( notexists key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\DLP"whose ( exists value "installedPath"ofit ) of registry ) OR ( notexists folder ( value "installedPath"of key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\DLP"of registry as string ) whose ( exists file "BESLeakProofCTRL.exe"ofit ) ) ) ) AND ( ( notexists regapp "BigFixAntiPest.exe" ) ) AND ( ( notexists key "HKEY_LOCAL_MACHINE\SOFTWARE\ComputerAssociates\eTrustAntivirus"of registry ORnotexists key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\AntiVirus"of registry ) ) AND ( ( NOTexists key "HKEY_LOCAL_MACHINE\SOFTWARE\CA\HIPSEngine\Products\BigFixFW"whose ( exists value "UninstallCmdLine"ofit ) of registry ) ) AND ( NOT ( ( exists setting "PowerManagement_PowerTrackingEnabled"whose ( value ofit="1"or value ofit="2" ) of client ) ) OR ( ( ( exists setting "PowerManagement_PowerTrackingEnabled"whose ( value ofit="1"or value ofit="2" ) of client ) ) AND ( ( ( ( name of operating system startswith"Win" ) AND ( version of client >= "8" ) ) AND ( exists setting "_BESClient_PowerHistory_EnablePowerHistory"whose ( exists value whose ( it="1" ) ofit ) of client ) ) ) ) )
(((notexists key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\DLP"whose (exists value "installedPath"ofit) of registry) OR (notexists folder (value "installedPath"of key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\DLP"of registry as string) whose (exists file "BESLeakProofCTRL.exe"ofit)))) AND ((notexists regapp "BigFixAntiPest.exe")) AND ((notexists key "HKEY_LOCAL_MACHINE\SOFTWARE\ComputerAssociates\eTrustAntivirus"of registry ORnotexists key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\AntiVirus"of registry)) AND ((NOTexists key "HKEY_LOCAL_MACHINE\SOFTWARE\CA\HIPSEngine\Products\BigFixFW"whose (exists value "UninstallCmdLine"ofit) of registry)) AND (NOT ((exists setting "PowerManagement_PowerTrackingEnabled"whose (value ofit="1"or value ofit="2") of client)) OR (((exists setting "PowerManagement_PowerTrackingEnabled"whose (value ofit="1"or value ofit="2") of client)) AND ((((name of operating system startswith"Win") AND (version of client >= "8") ) AND (exists setting "_BESClient_PowerHistory_EnablePowerHistory"whose (exists value whose (it="1") ofit) of client)))))
( ( ( exists key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\DLP"whose ( exists folder ( values "installedPath"ofitas string ) whose ( exists file "BESLeakProofCTRL.exe"whose ( version ofit >= "1.1.0.17" ) ofit ) ) of registry ) ) ) OR ( ( exist regapp "BigFixAntiPest.exe"whose ( version ofit >= "0.9.0.34" ) ) ) OR ( ( if ( exists key "HKEY_LOCAL_MACHINE\SOFTWARE\ComputerAssociates\eTrustAntivirus\CurrentVersion\Path"whose ( exists value "HOME"ofit ) of registry ) then ( exists file ( ( value "HOME"of key "HKEY_LOCAL_MACHINE\SOFTWARE\ComputerAssociates\eTrustAntivirus\CurrentVersion\Path"of registry as string ) & "\InoOEM.dll" ) whose ( version ofit="7.1" ) ) else ( false ) ) AND ( exists key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\AntiVirus"of registry ) ) OR ( ( exists key "HKEY_LOCAL_MACHINE\SOFTWARE\CA\HIPSEngine\Products\BigFixFW"whose ( exists value "UninstallCmdLine"ofit ) of registry ) ) OR ( ( ( exists setting "PowerManagement_PowerTrackingEnabled"whose ( value ofit="1"or value ofit="2" ) of client ) ) AND ( NOT ( ( ( ( name of operating system startswith"Win" ) AND ( version of client >= "8" ) ) AND ( exists setting "_BESClient_PowerHistory_EnablePowerHistory"whose ( exists value whose ( it="1" ) ofit ) of client ) ) ) ) )
(((exists key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\DLP"whose (exists folder (values "installedPath"ofitas string) whose (exists file "BESLeakProofCTRL.exe"whose (version ofit >= "1.1.0.17") ofit)) of registry))) OR ((exist regapp "BigFixAntiPest.exe"whose (version ofit >= "0.9.0.34"))) OR ((if (exists key "HKEY_LOCAL_MACHINE\SOFTWARE\ComputerAssociates\eTrustAntivirus\CurrentVersion\Path"whose (exists value "HOME"ofit) of registry) then (exists file ((value "HOME"of key "HKEY_LOCAL_MACHINE\SOFTWARE\ComputerAssociates\eTrustAntivirus\CurrentVersion\Path"of registry as string) & "\InoOEM.dll") whose (version ofit="7.1")) else (false)) AND (exists key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\AntiVirus"of registry)) OR ((exists key "HKEY_LOCAL_MACHINE\SOFTWARE\CA\HIPSEngine\Products\BigFixFW"whose (exists value "UninstallCmdLine"ofit) of registry)) OR (((exists setting "PowerManagement_PowerTrackingEnabled"whose (value ofit="1"or value ofit="2") of client)) AND (NOT ((((name of operating system startswith"Win") AND (version of client >= "8") ) AND (exists setting "_BESClient_PowerHistory_EnablePowerHistory"whose (exists value whose (it="1") ofit) of client)))))
( ( ( exists key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\DLP"whose ( exists folder ( values "installedPath"ofitas string ) whose ( exists file "BESLeakProofCTRL.exe"whose ( version ofit >= "1.1.0.17" ) ofit ) ) of registry ) ) ) OR ( ( exist regapp "BigFixAntiPest.exe"whose ( version ofit >= "0.9.0.34" ) ) ) OR ( ( if ( exists key "HKEY_LOCAL_MACHINE\SOFTWARE\ComputerAssociates\eTrustAntivirus\CurrentVersion\Path"whose ( exists value "HOME"ofit ) of registry ) then ( exists file ( ( value "HOME"of key "HKEY_LOCAL_MACHINE\SOFTWARE\ComputerAssociates\eTrustAntivirus\CurrentVersion\Path"of registry as string ) & "\InoOEM.dll" ) whose ( version ofit="7.1" ) ) else ( false ) ) AND ( exists key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\AntiVirus"of registry ) ) OR ( ( exists key "HKEY_LOCAL_MACHINE\SOFTWARE\CA\HIPSEngine\Products\BigFixFW"whose ( exists value "UninstallCmdLine"ofit ) of registry ) ) OR ( ( ( exists setting "PowerManagement_PowerTrackingEnabled"whose ( value ofit="1"or value ofit="2" ) of client ) ) ANDNOT ( ( ( ( name of operating system startswith"Win" ) AND ( version of client >= "8" ) ) AND ( exists setting "_BESClient_PowerHistory_EnablePowerHistory"whose ( exists value whose ( it="1" ) ofit ) of client ) ) ) )
(((exists key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\DLP"whose (exists folder (values "installedPath"ofitas string) whose (exists file "BESLeakProofCTRL.exe"whose (version ofit >= "1.1.0.17") ofit)) of registry))) OR ((exist regapp "BigFixAntiPest.exe"whose (version ofit >= "0.9.0.34"))) OR ((if (exists key "HKEY_LOCAL_MACHINE\SOFTWARE\ComputerAssociates\eTrustAntivirus\CurrentVersion\Path"whose (exists value "HOME"ofit) of registry) then (exists file ((value "HOME"of key "HKEY_LOCAL_MACHINE\SOFTWARE\ComputerAssociates\eTrustAntivirus\CurrentVersion\Path"of registry as string) & "\InoOEM.dll") whose (version ofit="7.1")) else (false)) AND (exists key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\AntiVirus"of registry)) OR ((exists key "HKEY_LOCAL_MACHINE\SOFTWARE\CA\HIPSEngine\Products\BigFixFW"whose (exists value "UninstallCmdLine"ofit) of registry)) OR (((exists setting "PowerManagement_PowerTrackingEnabled"whose (value ofit="1"or value ofit="2") of client)) ANDNOT ((((name of operating system startswith"Win") AND (version of client >= "8") ) AND (exists setting "_BESClient_PowerHistory_EnablePowerHistory"whose (exists value whose (it="1") ofit) of client))))
if ( name of operating system startswith"Win" ) then ( ( it >= "7" ) of ( if ( version of client >= "8.0" ) then ( version of relay service ) else ( version of regapp "besrelay.exe" ) ) ) elsetrue
if (name of operating system startswith"Win") then ((it >= "7") of (if (version of client >= "8.0") then (version of relay service) else (version of regapp "besrelay.exe"))) elsetrue
( exists regapp "besclient.exe" ) AND ( version of client < "7.0.9.164"AND ( notexists regapp "besrelay.exe"OR version of regapp "besrelay.exe" >= "7.0.9.164" ) )
(exists regapp "besclient.exe") AND (version of client < "7.0.9.164"AND (notexists regapp "besrelay.exe"OR version of regapp "besrelay.exe" >= "7.0.9.164"))
exists key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\Enterprise Server"whose ( exists ( ( value "Version"ofit ) as string as version ) whose ( it < "7.0.9.164"ANDit >= "6" ) ANDexists value "BESInstalled"ofitAND value "BESInstalled"ofit=1 ) of registry OR ( exists regapp "BESConsole.exe"whose ( version ofit < "7.0.9.164"AND version ofit >= "6" ) )
exists key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\Enterprise Server"whose (exists ((value "Version"ofit) as string as version) whose (it < "7.0.9.164"ANDit >= "6") ANDexists value "BESInstalled"ofitAND value "BESInstalled"ofit=1) of registry OR (exists regapp "BESConsole.exe"whose (version ofit < "7.0.9.164"AND version ofit >= "6"))
( exists file ( ( pathname of parent folder of regapp "besclient.exe" ) & "\BESClient.dmp" ) ) OR ( if login account of service "BESClient"!="LocalSystem"thenexists file ( value of variable "userprofile"of environment & "\Local Settings\Application Data\BigFix\BESClient.dmp" ) elsefalse )
(exists file ((pathname of parent folder of regapp "besclient.exe") & "\BESClient.dmp")) OR (if login account of service "BESClient"!="LocalSystem"thenexists file (value of variable "userprofile"of environment & "\Local Settings\Application Data\BigFix\BESClient.dmp") elsefalse)
( ( exists regapp "BESConsole.exe" ) AND ( version of regapp "BESConsole.exe" >= "7.0" ) ) OR ( ( exists regapp "BESAdmin.exe" ) AND ( version of regapp "BESAdmin.exe" >= "7.0" ) )
((exists regapp "BESConsole.exe") AND (version of regapp "BESConsole.exe" >= "7.0")) OR ((exists regapp "BESAdmin.exe") AND (version of regapp "BESAdmin.exe" >= "7.0"))
NOT ( ( ( exists rule whose ( ( NOTexists local ports string ofitOR local ports string ofitcontains ( value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string ) OR local ports string ofit="*" ) AND ( ( ( application name ofit ends with"\BESClient.exe" ) ANDNOT ( service name ofit="BESClient" ) ) OR ( regex "^(\s)*$"= application name ofitAND regex "^(\s)*$"= service name ofit ) ) and enabled ofitand protocol ofit= udp and inbound ofitand profile ( current profile type of firewall ) ofit ) of firewall ) OR ( exists internet connection firewall whose ( enabled ofitANDexists port mapping whose ( enabled ofitAND protocol ofit="udp"AND internal port ofitas string = ( value "ListenPort"of key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry ) as string ) ofit ) of adapters of network ) OR ( exist key "HKLM\Software\Policies\Microsoft\WindowsFirewall\FirewallRules"whose ( ( exists value whose ( itas string as lowercase contains"|action=allow|"anditas string as lowercase contains"|active=true|"ANDitas string as lowercase contains"|dir=in|"and ( itas string as lowercase contains"|protocol=17|"orNOT ( itas string as lowercase contains"|protocol" ) ) AND ( itas string as lowercase contains"|lport=" & ( value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string ) & "|"ORnot ( itas string as lowercase contains"|lport=" ) ) AND ( not ( ( itas string as lowercase contains"|app=" ) ) OR ( itas string as lowercase contains"|app="anditas string contains"\BESClient.exe|" ) ) AND ( ( itas string as lowercase contains"|profile=" & ( if ( current profile type of firewall = domain firewall profile type ) then"domain|"elseif ( current profile type of firewall = public firewall profile type ) then"public|"elseif ( current profile type of firewall = private firewall profile type ) then"private|"else"INVALID" ) ) ORnot ( itas string as lowercase contains"|profile" ) ) ) ofit ) ) of native registry ) OR ( ( ( exists key ( "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & ( if ( current profile type of firewall = domain firewall profile type ) then"DomainProfile"else"StandardProfile" ) & "\GloballyOpenPorts" ) whose ( exists value whose ( ( name ofitas lowercase ="enabled" ) AND ( it=1 ) ) ofit ) ofit ) AND ( exists key ( "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & ( if ( current profile type of firewall = domain firewall profile type ) then"DomainProfile"else"StandardProfile" ) & "\GloballyOpenPorts\List" ) whose ( exists value whose ( ( name ofitstartswith value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of x32 registry as string & ":" ) AND ( regex "^(\d)+:UDP:(.+)?:enabled:(.+)$"= name ofit ) ) ofit ) ofit ) ) of native registry ) OR ( ( ( exists key ( "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & ( if ( current profile type of firewall = domain firewall profile type ) then"DomainProfile"else"StandardProfile" ) & "\AuthorizedApplications" ) whose ( exists value whose ( ( name ofitas lowercase ="enabled" ) AND ( it=1 ) ) ofit ) ofit ) AND ( exists key ( "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & ( if ( current profile type of firewall = domain firewall profile type ) then"DomainProfile"else"StandardProfile" ) & "\AuthorizedApplications\List" ) whose ( exists value whose ( ( regex "^(.+)?\\BESClient.exe:(.+)?:enabled:(.+)$"= name ofit ) ) ofit ) ofit ) ) of native registry ) ) AND ( ( exists key ( "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & ( if ( current profile type of firewall = domain firewall profile type ) then"DomainProfile"else"StandardProfile" ) & "\IcmpSettings" ) whose ( exists value whose ( name ofit="AllowInboundEchoRequest"andit=1 ) ofit ) of native registry ) OR ( ( ( exists rule whose ( ( enabled ofitand ( protocol ofit= internet protocol 1 ) and inbound ofitand profile ( current profile type of firewall ) ofitand ( regex "^(\s)*$"= application name ofitOR application name ofit ends with"\BESClient.exe" ) AND regex "^(\s)*$"= service name ofit ) ) of firewall ) OR ( exist key "HKLM\Software\Policies\Microsoft\WindowsFirewall\FirewallRules"whose ( exists value whose ( itas string as lowercase contains"|action=allow|"anditas string as lowercase contains"|active=true|"ANDitas string as lowercase contains"|dir=in|"and ( itas string as lowercase contains"|protocol=1|"orNOT ( itas string as lowercase contains"|protocol" ) ) AND ( itas string as lowercase contains"|lport=" & ( value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string ) & "|"ORnot ( itas string as lowercase contains"|lport=" ) ) AND ( not ( ( itas string as lowercase contains"|app=" ) ) OR ( if ( itas string as lowercase contains"|app=" ) then ( itas string contains"\BESClient.exe|" ) elsetrue ) AND ( ( itas string as lowercase contains"|profile=" & ( if ( current profile type of firewall = domain firewall profile type ) then"domain|"elseif ( current profile type of firewall = public firewall profile type ) then"public|"elseif ( current profile type of firewall = private firewall profile type ) then"private|"else"INVALID" ) ) ORnot ( itas string as lowercase contains"|profile" ) ) ) ofit ) ofit ) of native registry ) ) AND ( ( exists rule whose ( ( enabled ofitand ( protocol ofit= internet protocol 58 ) and inbound ofitand profile ( current profile type of firewall ) ofitand ( regex "^(\s)*$"= application name ofitOR application name ofit ends with"\BESClient.exe" ) AND regex "^(\s)*$"= service name ofit ) ) of firewall ) OR ( exist key "HKLM\Software\Policies\Microsoft\WindowsFirewall\FirewallRules"whose ( exists value whose ( itas string as lowercase contains"|action=allow|"anditas string as lowercase contains"|active=true|"ANDitas string as lowercase contains"|dir=in|"and ( itas string as lowercase contains"|protocol=58|"orNOT ( itas string as lowercase contains"|protocol" ) ) AND ( itas string as lowercase contains"|lport=" & ( value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string ) & "|"ORnot ( itas string as lowercase contains"|lport=" ) ) AND ( not ( ( itas string as lowercase contains"|app=" ) ) OR ( if ( itas string as lowercase contains"|app=" ) then ( itas string contains"\BESClient.exe|" ) elsetrue ) AND ( ( itas string as lowercase contains"|profile=" & ( if ( current profile type of firewall = domain firewall profile type ) then"domain|"elseif ( current profile type of firewall = public firewall profile type ) then"public|"elseif ( current profile type of firewall = private firewall profile type ) then"private|"else"INVALID" ) ) ORnot ( itas string as lowercase contains"|profile" ) ) ) ofit ) ofit ) of native registry ) ) ) ) )
NOT (((exists rule whose ((NOTexists local ports string ofitOR local ports string ofitcontains (value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string) OR local ports string ofit="*") AND (((application name ofit ends with"\BESClient.exe") ANDNOT (service name ofit="BESClient")) OR (regex "^(\s)*$"= application name ofitAND regex "^(\s)*$"= service name ofit)) and enabled ofitand protocol ofit= udp and inbound ofitand profile (current profile type of firewall) ofit) of firewall) OR (exists internet connection firewall whose (enabled ofitANDexists port mapping whose (enabled ofitAND protocol ofit="udp"AND internal port ofitas string = (value "ListenPort"of key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry) as string) ofit) of adapters of network) OR (exist key "HKLM\Software\Policies\Microsoft\WindowsFirewall\FirewallRules"whose ((exists value whose (itas string as lowercase contains"|action=allow|"anditas string as lowercase contains"|active=true|"ANDitas string as lowercase contains"|dir=in|"and (itas string as lowercase contains"|protocol=17|"orNOT (itas string as lowercase contains"|protocol")) AND (itas string as lowercase contains"|lport=" & (value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string) & "|"ORnot (itas string as lowercase contains"|lport=")) AND (not ((itas string as lowercase contains"|app=")) OR (itas string as lowercase contains"|app="anditas string contains"\BESClient.exe|")) AND ((itas string as lowercase contains"|profile=" & (if (current profile type of firewall = domain firewall profile type) then"domain|"elseif (current profile type of firewall = public firewall profile type) then"public|"elseif (current profile type of firewall = private firewall profile type) then"private|"else"INVALID")) ORnot (itas string as lowercase contains"|profile"))) ofit)) of native registry) OR (((exists key ("HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & (if (current profile type of firewall = domain firewall profile type) then"DomainProfile"else"StandardProfile") & "\GloballyOpenPorts") whose (exists value whose ((name ofitas lowercase ="enabled") AND (it=1)) ofit) ofit) AND (exists key ("HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & (if (current profile type of firewall = domain firewall profile type) then"DomainProfile"else"StandardProfile") & "\GloballyOpenPorts\List") whose (exists value whose ((name ofitstartswith value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of x32 registry as string & ":") AND (regex "^(\d)+:UDP:(.+)?:enabled:(.+)$"= name ofit)) ofit) ofit)) of native registry) OR (((exists key ("HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & (if (current profile type of firewall = domain firewall profile type) then"DomainProfile"else"StandardProfile") & "\AuthorizedApplications") whose (exists value whose ((name ofitas lowercase ="enabled") AND (it=1)) ofit) ofit) AND (exists key ("HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & (if (current profile type of firewall = domain firewall profile type) then"DomainProfile"else"StandardProfile") & "\AuthorizedApplications\List") whose (exists value whose ((regex "^(.+)?\\BESClient.exe:(.+)?:enabled:(.+)$"= name ofit)) ofit) ofit)) of native registry)) AND ((exists key ("HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & (if (current profile type of firewall = domain firewall profile type) then"DomainProfile"else"StandardProfile") & "\IcmpSettings") whose (exists value whose (name ofit="AllowInboundEchoRequest"andit=1) ofit) of native registry) OR (((exists rule whose ((enabled ofitand (protocol ofit= internet protocol 1) and inbound ofitand profile (current profile type of firewall) ofitand (regex "^(\s)*$"= application name ofitOR application name ofit ends with"\BESClient.exe") AND regex "^(\s)*$"= service name ofit)) of firewall) OR (exist key "HKLM\Software\Policies\Microsoft\WindowsFirewall\FirewallRules"whose (exists value whose (itas string as lowercase contains"|action=allow|"anditas string as lowercase contains"|active=true|"ANDitas string as lowercase contains"|dir=in|"and (itas string as lowercase contains"|protocol=1|"orNOT (itas string as lowercase contains"|protocol")) AND (itas string as lowercase contains"|lport=" & (value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string) & "|"ORnot (itas string as lowercase contains"|lport=")) AND (not ((itas string as lowercase contains"|app=")) OR (if (itas string as lowercase contains"|app=") then (itas string contains"\BESClient.exe|") elsetrue) AND ((itas string as lowercase contains"|profile=" & (if (current profile type of firewall = domain firewall profile type) then"domain|"elseif (current profile type of firewall = public firewall profile type) then"public|"elseif (current profile type of firewall = private firewall profile type) then"private|"else"INVALID")) ORnot (itas string as lowercase contains"|profile"))) ofit) ofit) of native registry)) AND ((exists rule whose ((enabled ofitand (protocol ofit= internet protocol 58) and inbound ofitand profile (current profile type of firewall) ofitand (regex "^(\s)*$"= application name ofitOR application name ofit ends with"\BESClient.exe") AND regex "^(\s)*$"= service name ofit)) of firewall) OR (exist key "HKLM\Software\Policies\Microsoft\WindowsFirewall\FirewallRules"whose (exists value whose (itas string as lowercase contains"|action=allow|"anditas string as lowercase contains"|active=true|"ANDitas string as lowercase contains"|dir=in|"and (itas string as lowercase contains"|protocol=58|"orNOT (itas string as lowercase contains"|protocol")) AND (itas string as lowercase contains"|lport=" & (value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string) & "|"ORnot (itas string as lowercase contains"|lport=")) AND (not ((itas string as lowercase contains"|app=")) OR (if (itas string as lowercase contains"|app=") then (itas string contains"\BESClient.exe|") elsetrue) AND ((itas string as lowercase contains"|profile=" & (if (current profile type of firewall = domain firewall profile type) then"domain|"elseif (current profile type of firewall = public firewall profile type) then"public|"elseif (current profile type of firewall = private firewall profile type) then"private|"else"INVALID")) ORnot (itas string as lowercase contains"|profile"))) ofit) ofit) of native registry)))))
( exists relay service AND ( ( it < "7.2"ANDit >= "6" ) of ( if ( version of client >= "8.0" ) then ( version of relay service ) else ( version of regapp "besrelay.exe" ) ) ) ) or ( exists key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\Enterprise Server"whose ( exists ( ( value "Version"ofit ) as string as version ) whose ( it < "7.2"ANDit >= "6" ) ANDexists value "BESInstalled"ofitAND value "BESInstalled"ofit=1 ) of registry )
(exists relay service AND ((it < "7.2"ANDit >= "6") of (if (version of client >= "8.0") then (version of relay service) else (version of regapp "besrelay.exe")))) or (exists key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\Enterprise Server"whose (exists ((value "Version"ofit) as string as version) whose (it < "7.2"ANDit >= "6") ANDexists value "BESInstalled"ofitAND value "BESInstalled"ofit=1) of registry)