( ( exists value "EnterpriseServerFolder"of key "HKEY_LOCAL_MACHINE\SOFTWARE\Bigfix\Enterprise Server"of registry ) AND compressed of ( value "EnterpriseServerFolder"of key "HKEY_LOCAL_MACHINE\SOFTWARE\Bigfix\Enterprise Server"of registry as folder ) ) OR ( ( exists value "RelayUpgradePath"of key "HKEY_LOCAL_MACHINE\SOFTWARE\Bigfix\Enterprise Server"of registry ) AND compressed of ( value "RelayUpgradePath"of key "HKEY_LOCAL_MACHINE\SOFTWARE\Bigfix\Enterprise Server"of registry as folder ) )
((exists value "EnterpriseServerFolder"of key "HKEY_LOCAL_MACHINE\SOFTWARE\Bigfix\Enterprise Server"of registry) AND compressed of (value "EnterpriseServerFolder"of key "HKEY_LOCAL_MACHINE\SOFTWARE\Bigfix\Enterprise Server"of registry as folder)) OR ((exists value "RelayUpgradePath"of key "HKEY_LOCAL_MACHINE\SOFTWARE\Bigfix\Enterprise Server"of registry) AND compressed of (value "RelayUpgradePath"of key "HKEY_LOCAL_MACHINE\SOFTWARE\Bigfix\Enterprise Server"of registry as folder))
name of operating system startswith"Win"AND ( ( ( it="BES Client"ORit="Enterprise Client" ) of name of parent folder of regapp "BESClient.exe" ) ANDexists ( values "DisplayName"of keys of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"of registry ) whose ( ( it="BigFix Enterprise Client"ORit="BigFix for IBM Proventia ESC Client"ORit="ESP Agent"ORit="Trend Micro Endpoint Security Platform"ORit="Tivoli Endpoint Manager Client" ) of ( itas string ) ) )
name of operating system startswith"Win"AND (((it="BES Client"ORit="Enterprise Client") of name of parent folder of regapp "BESClient.exe") ANDexists (values "DisplayName"of keys of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"of registry) whose ((it="BigFix Enterprise Client"ORit="BigFix for IBM Proventia ESC Client"ORit="ESP Agent"ORit="Trend Micro Endpoint Security Platform"ORit="Tivoli Endpoint Manager Client") of (itas string)))
exists key whose ( exists value "DisplayName"ofitAND value "DisplayName"ofit="BigFix Enterprise Client"AND name ofitstartswith"{" ) of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"of registry
exists key whose (exists value "DisplayName"ofitAND value "DisplayName"ofit="BigFix Enterprise Client"AND name ofitstartswith"{") of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"of registry
( notexists key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall"of registry AND firewall enabled of current profile of local policy of firewall ) OR ( exists key ( "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & ( if ( current profile type of firewall = domain firewall profile type ) then ( "DomainProfile" ) else ( "StandardProfile" ) ) ) whose ( value "EnableFirewall"ofit=1 ) of registry )
(notexists key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall"of registry AND firewall enabled of current profile of local policy of firewall) OR (exists key ("HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\" & (if (current profile type of firewall = domain firewall profile type) then ("DomainProfile") else ("StandardProfile"))) whose (value "EnableFirewall"ofit=1) of registry)
exists key ( if ( exists key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall"of registry ) then ( "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\" ) else ( "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\" ) & ( if ( current profile type of firewall = domain firewall profile type ) then ( "DomainProfile" ) else ( "StandardProfile" ) ) ) whose ( value "DoNotAllowExceptions"ofit=1 ) of registry OR ( ( notexists globally open port whose ( port ofitas string = ( value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string ) AND protocol ofit= udp AND enabled ofit ) ofitANDnotexists authorized application whose ( process image file name ofitas lowercase ends with"besclient.exe"AND enabled ofit ) ofit ) of current profile of local policy of firewall ANDexists internet connection firewall whose ( enabled ofitANDnotexists port mapping whose ( enabled ofitAND protocol ofit="udp"AND internal port ofitas string = ( value "ListenPort"of key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry ) as string ) ofit ) of adapters of network )
exists key (if (exists key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall"of registry) then ("HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\") else ("HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\") & (if (current profile type of firewall = domain firewall profile type) then ("DomainProfile") else ("StandardProfile"))) whose (value "DoNotAllowExceptions"ofit=1) of registry OR ((notexists globally open port whose (port ofitas string = (value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string) AND protocol ofit= udp AND enabled ofit) ofitANDnotexists authorized application whose (process image file name ofitas lowercase ends with"besclient.exe"AND enabled ofit) ofit) of current profile of local policy of firewall ANDexists internet connection firewall whose (enabled ofitANDnotexists port mapping whose (enabled ofitAND protocol ofit="udp"AND internal port ofitas string = (value "ListenPort"of key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry) as string) ofit) of adapters of network)
( ( exists running service "BESRelay" ) OR ( exists running service "BESRootServer" ) ) AND ( exists value "carboncopypath"of key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\Enterprise Server\PostResults"of registry AND value "carboncopypath"of key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\Enterprise Server\PostResults"of registry !="" )
((exists running service "BESRelay") OR (exists running service "BESRootServer")) AND (exists value "carboncopypath"of key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\Enterprise Server\PostResults"of registry AND value "carboncopypath"of key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\Enterprise Server\PostResults"of registry !="")
exists key ( if ( exists key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall"of registry ) then ( "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\" ) else ( "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\" ) & ( if ( current profile type of firewall = domain firewall profile type ) then ( "DomainProfile" ) else ( "StandardProfile" ) ) ) whose ( value "DoNotAllowExceptions"ofit=1 ) of registry OR ( ( notexists globally open port whose ( enabled ofitAND port ofitas string = ( value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string ) AND protocol ofit= tcp ) of current profile of local policy of firewall ) AND ( exists internet connection firewall whose ( enabled ofitAND ( notexists port mapping whose ( enabled ofitAND protocol ofit="tcp"AND internal port ofitas string = ( value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string ) ) ofit ) ) of adapters of network ) AND ( notexists authorized application whose ( enabled ofitAND ( it ends with"besrelay.exe"ORit ends with"filldb.exe" ) of ( process image file name ofitas lowercase ) ) of current profile of local policy of firewall ) ) OR ( ( notexists globally open port whose ( enabled ofitAND port ofitas string = ( value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string ) AND protocol ofit= udp ) of current profile of local policy of firewall ) AND ( exists internet connection firewall whose ( enabled ofitAND ( notexists port mapping whose ( enabled ofitAND protocol ofit="udp"AND internal port ofitas string = ( value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string ) ) ofit ) ) of adapters of network ) AND ( notexists authorized application whose ( enabled ofitAND ( it ends with"besclient.exe" ) of ( process image file name ofitas lowercase ) ) of current profile of local policy of firewall ) )
exists key (if (exists key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall"of registry) then ("HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\") else ("HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\") & (if (current profile type of firewall = domain firewall profile type) then ("DomainProfile") else ("StandardProfile"))) whose (value "DoNotAllowExceptions"ofit=1) of registry OR ((notexists globally open port whose (enabled ofitAND port ofitas string = (value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string) AND protocol ofit= tcp) of current profile of local policy of firewall) AND (exists internet connection firewall whose (enabled ofitAND (notexists port mapping whose (enabled ofitAND protocol ofit="tcp"AND internal port ofitas string = (value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string)) ofit)) of adapters of network) AND (notexists authorized application whose (enabled ofitAND (it ends with"besrelay.exe"ORit ends with"filldb.exe") of (process image file name ofitas lowercase)) of current profile of local policy of firewall)) OR ((notexists globally open port whose (enabled ofitAND port ofitas string = (value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string) AND protocol ofit= udp) of current profile of local policy of firewall) AND (exists internet connection firewall whose (enabled ofitAND (notexists port mapping whose (enabled ofitAND protocol ofit="udp"AND internal port ofitas string = (value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string)) ofit)) of adapters of network) AND (notexists authorized application whose (enabled ofitAND (it ends with"besclient.exe") of (process image file name ofitas lowercase)) of current profile of local policy of firewall))
( ( ( sum of sizes of files of folders of folders ofit ) + ( sum of sizes of files ofit ) ) of folder "sha1"of folder ( if ( ( exists setting "_BESRelay_UploadManager_BufferDirectory"ofitandexists value of setting "_BESRelay_UploadManager_BufferDirectory"ofit ) of client ) then ( value of setting "_BESRelay_UploadManager_BufferDirectory"of client as string ) else ( if ( name of operating system startswith"Win" ) then ( parent folder of parent folder of client as string & "\BES Relay\UploadManagerData\BufferDir" ) else ( "/var/opt/BESRelay/UploadManagerData/BufferDir" ) ) ) >= it ) of ( if ( ( exists setting "_BESRelay_UploadManager_BufferDirectoryMaxSize"ofitandexists value of setting "_BESRelay_UploadManager_BufferDirectoryMaxSize"ofit ) of client ) then ( value of setting "_BESRelay_UploadManager_BufferDirectoryMaxSize"of client as integer ) else ( 20971520 ) )
(((sum of sizes of files of folders of folders ofit) + (sum of sizes of files ofit)) of folder "sha1"of folder (if ((exists setting "_BESRelay_UploadManager_BufferDirectory"ofitandexists value of setting "_BESRelay_UploadManager_BufferDirectory"ofit) of client) then (value of setting "_BESRelay_UploadManager_BufferDirectory"of client as string) else (if (name of operating system startswith"Win") then (parent folder of parent folder of client as string & "\BES Relay\UploadManagerData\BufferDir") else ("/var/opt/BESRelay/UploadManagerData/BufferDir"))) >= it) of (if ((exists setting "_BESRelay_UploadManager_BufferDirectoryMaxSize"ofitandexists value of setting "_BESRelay_UploadManager_BufferDirectoryMaxSize"ofit) of client) then (value of setting "_BESRelay_UploadManager_BufferDirectoryMaxSize"of client as integer) else (20971520))
exists file whose ( name ofitas string ="rmdir.bat"OR name ofitas string ="client.bat" ) of folder ( pathname of client folder of site "bessupport" ) ORexists folder "__besdiag"of folder ( pathname of client folder of site "bessupport" )
exists file whose (name ofitas string ="rmdir.bat"OR name ofitas string ="client.bat") of folder (pathname of client folder of site "bessupport") ORexists folder "__besdiag"of folder (pathname of client folder of site "bessupport")
( ( language of version block of file "kernel32.dll"of system folder does not contain "English" ) AND ( notexists values of keys "HKLM\System\CurrentControlSet\Control\Nls\MUILanguages"of registry ) )
((language of version block of file "kernel32.dll"of system folder does not contain "English") AND (notexists values of keys "HKLM\System\CurrentControlSet\Control\Nls\MUILanguages"of registry))
exists key whose ( value "DisplayName"ofitas string contains"BigFix Enterprise Suite Installation Generator"AND value "DisplayVersion"ofitas string as version < "6.0.28.4"AND value "DisplayVersion"ofitas string as version !="6.0.8.5" ) of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"of registry
exists key whose (value "DisplayName"ofitas string contains"BigFix Enterprise Suite Installation Generator"AND value "DisplayVersion"ofitas string as version < "6.0.28.4"AND value "DisplayVersion"ofitas string as version !="6.0.8.5") of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"of registry
( exists key "HKLM\Software\BigFix\Enterprise Server"whose ( value "UseRemoteDb"ofitas string ="1" ) of registry OR version of registration server >= "6" )
(exists key "HKLM\Software\BigFix\Enterprise Server"whose (value "UseRemoteDb"ofitas string ="1") of registry OR version of registration server >= "6")
exists key whose ( ( value "DisplayName"ofit="BES Relay"OR value "DisplayName"ofit="BigFix Enterprise Relay" ) AND value "DisplayVersion"ofitas string as version < "6.0" ) of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"of registry
exists key whose ((value "DisplayName"ofit="BES Relay"OR value "DisplayName"ofit="BigFix Enterprise Relay") AND value "DisplayVersion"ofitas string as version < "6.0") of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"of registry
( exists key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\Enterprise Server"whose ( ( value "Version"ofit ) as string as version < "6.0"AND ( value "Version"ofit ) as string as version >= "5.1"ANDexists value "BESInstalled"ofitAND value "BESInstalled"ofit =1 ) of registry ) OR ( exists regapp "BESConsole.exe"whose ( version ofit < "6.0"AND version ofit >= "5.1" ) )
(exists key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\Enterprise Server"whose ((value "Version"ofit) as string as version < "6.0"AND (value "Version"ofit) as string as version >= "5.1"ANDexists value "BESInstalled"ofitAND value "BESInstalled"ofit =1) of registry) OR (exists regapp "BESConsole.exe"whose (version ofit < "6.0"AND version ofit >= "5.1"))