( ( name ofit="Win2003"AND service pack major version ofit >= 1 ) OR ( ( version of registration server >= "7.2" ) AND ( ( ( name ofit="WinVista"AND product type ofit!= nt workstation product type ) OR ( name ofit="Win2008" ) ) ) AND ( exists regapp "iexplore.exe" ) ) OR ( ( version of registration server >= "8" ) AND ( ( ( name ofit="Win2008R2" ) ) ) AND ( exists regapp "iexplore.exe" ) ) ) of operating system
((name ofit="Win2003"AND service pack major version ofit >= 1) OR ((version of registration server >= "7.2") AND (((name ofit="WinVista"AND product type ofit!= nt workstation product type) OR (name ofit="Win2008"))) AND (exists regapp "iexplore.exe")) OR ((version of registration server >= "8") AND (((name ofit="Win2008R2"))) AND (exists regapp "iexplore.exe"))) of operating system
NOT ( ( version of regapp "iexplore.exe" >= "7" ) AND ( exists key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60"of registry ) AND ( exists folder "macromed\flash"whose ( exists file whose ( ( ( itstartswith"flash"ANDit ends with".ocx" ) OR ( it="swflash.ocx" ) ) of ( name ofitas lowercase ) AND version ofit >= "9" ) ofit ) of system folder ) AND ( exists key ( "HKEY_USERS\" & ( ( ifit="LocalSystem"then"S-1-5-18"elseifit="LocalService"then"S-1-5-19"elseifit="NetworkService"then"S-1-5-20"else ( string value of select ( ( "SID from Win32_UserAccount where NAME='" & following text of last "\"ofit & "' and DOMAIN='" & ( ( ifit="."then computer name elseit ) of preceding text of last "\"ofit ) & "'" ) of ( ( login account of service "BESWebReportsServer" ) as string ) ) of wmi ) ) of login account of service "BESWebReportsServer" ) & "\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\" & ( first match ( regex "^[^:]+" ) of first match ( regex "[^/]+$" ) of ( itas string ) ) of value "Hostname"of key "HKLM\SOFTWARE\BigFix\Enterprise Server\Installer\"of registry ) whose ( exists value "http"whose ( it=2 ) ofitANDexists value "https"whose ( it=2 ) ofit ) of registry ) AND ( exists key "HKLM\Software\BigFix\Enterprise Server\BESReports"whose ( ( ( exists value "PDFEnable"whose ( it="1" ) ofit ) OR ( exists key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports"whose ( exists value ( ( ( value "EnterpriseServerFolder"of key "HKLM\SOFTWARE\BigFix\Enterprise Server"of x32 registry ) as string ) & "BESReportsData\ArchiveData\__pdf\out.ps" ) ofit ) of native registry ) ) AND value "PDFPostScriptPath"ofit= ( ( ( value "EnterpriseServerFolder"of key "HKLM\SOFTWARE\BigFix\Enterprise Server"of x32 registry ) as string ) & "BESReportsData\ArchiveData\__pdf\out.ps" ) AND value "PDFPrinterName"ofit="BES Web Reports Printer" ) of registry ) AND ( exists key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment"whose ( ( exists key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60"whose ( exists value "UninstallString"ofit ) of registry ) AND ( ( itcontains parenthesized part 1of ( first match ( regex "^(.*)uninstgs.exe" ) of ( value "UninstallString"of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60"of registry as string ) ) & "gs8.60\bin"ANDitcontains parenthesized part 1of ( first match ( regex "^(.*)uninstgs.exe" ) of ( value "UninstallString"of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60"of registry as string ) ) & "gs8.60\lib" ) of ( value "Path"ofitas string ) ) ) of registry ) AND ( exists key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports"whose ( exists value ( ( ( value "EnterpriseServerFolder"of key "HKLM\SOFTWARE\BigFix\Enterprise Server"of x32 registry ) as string ) & "BESReportsData\ArchiveData\__pdf\out.ps" ) ofit ) of native registry ) AND ( exists key ( "HKU\" & ( ( ifit="LocalSystem"then"S-1-5-18"elseifit="LocalService"then"S-1-5-19"elseifit="NetworkService"then"S-1-5-20"else ( string value of select ( ( "SID from Win32_UserAccount where NAME='" & following text of last "\"ofit & "' and DOMAIN='" & ( ( ifit="."then computer name elseit ) of preceding text of last "\"ofit ) & "'" ) of ( ( login account of service "BESWebReportsServer" ) as string ) ) of wmi ) ) of login account of service "BESWebReportsServer" ) & "\Software\Microsoft\Internet Explorer\PageSetup" ) of registry ) )
NOT ((version of regapp "iexplore.exe" >= "7") AND (exists key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60"of registry) AND (exists folder "macromed\flash"whose (exists file whose (((itstartswith"flash"ANDit ends with".ocx") OR (it="swflash.ocx")) of (name ofitas lowercase) AND version ofit >= "9") ofit) of system folder) AND (exists key ("HKEY_USERS\" & ((ifit="LocalSystem"then"S-1-5-18"elseifit="LocalService"then"S-1-5-19"elseifit="NetworkService"then"S-1-5-20"else (string value of select (("SID from Win32_UserAccount where NAME='" & following text of last "\"ofit & "' and DOMAIN='" & ((ifit="."then computer name elseit) of preceding text of last "\"ofit) & "'") of ((login account of service "BESWebReportsServer") as string)) of wmi)) of login account of service "BESWebReportsServer") & "\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\" & (first match (regex "^[^:]+") of first match (regex "[^/]+$") of (itas string)) of value "Hostname"of key "HKLM\SOFTWARE\BigFix\Enterprise Server\Installer\"of registry) whose (exists value "http"whose (it=2) ofitANDexists value "https"whose (it=2) ofit) of registry) AND (exists key "HKLM\Software\BigFix\Enterprise Server\BESReports"whose (((exists value "PDFEnable"whose (it="1") ofit) OR (exists key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports"whose (exists value (((value "EnterpriseServerFolder"of key "HKLM\SOFTWARE\BigFix\Enterprise Server"of x32 registry) as string) & "BESReportsData\ArchiveData\__pdf\out.ps") ofit) of native registry)) AND value "PDFPostScriptPath"ofit= (((value "EnterpriseServerFolder"of key "HKLM\SOFTWARE\BigFix\Enterprise Server"of x32 registry) as string) & "BESReportsData\ArchiveData\__pdf\out.ps") AND value "PDFPrinterName"ofit="BES Web Reports Printer") of registry) AND (exists key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment"whose ((exists key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60"whose (exists value "UninstallString"ofit) of registry) AND ((itcontains parenthesized part 1of (first match (regex "^(.*)uninstgs.exe") of (value "UninstallString"of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60"of registry as string)) & "gs8.60\bin"ANDitcontains parenthesized part 1of (first match (regex "^(.*)uninstgs.exe") of (value "UninstallString"of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60"of registry as string)) & "gs8.60\lib") of (value "Path"ofitas string))) of registry) AND (exists key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports"whose (exists value (((value "EnterpriseServerFolder"of key "HKLM\SOFTWARE\BigFix\Enterprise Server"of x32 registry) as string) & "BESReportsData\ArchiveData\__pdf\out.ps") ofit) of native registry) AND (exists key ("HKU\" & ((ifit="LocalSystem"then"S-1-5-18"elseifit="LocalService"then"S-1-5-19"elseifit="NetworkService"then"S-1-5-20"else (string value of select (("SID from Win32_UserAccount where NAME='" & following text of last "\"ofit & "' and DOMAIN='" & ((ifit="."then computer name elseit) of preceding text of last "\"ofit) & "'") of ((login account of service "BESWebReportsServer") as string)) of wmi)) of login account of service "BESWebReportsServer") & "\Software\Microsoft\Internet Explorer\PageSetup") of registry))
( ( version of regapp "iexplore.exe" >= "7" ) AND ( exists key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60"of registry ) AND ( exists folder "macromed\flash"whose ( exists file whose ( ( ( itstartswith"flash"ANDit ends with".ocx" ) OR ( it="swflash.ocx" ) ) of ( name ofitas lowercase ) AND version ofit >= "9" ) ofit ) of system folder ) AND ( exists key ( "HKEY_USERS\" & ( ( if ( it="LocalSystem" ) then ( "S-1-5-18" ) elseif ( it="LocalService" ) then ( "S-1-5-19" ) elseif ( it="NetworkService" ) then ( "S-1-5-20" ) elseif ( itcontains"@" ) then ( component string of sid of security account ( it ) ) else ( string value of select ( ( "SID from Win32_UserAccount where NAME='" & following text of last "\"ofit & "' and DOMAIN='" & ( ( ifit="."then computer name elseit ) of preceding text of last "\"ofit ) & "'" ) of ( ( login account of service "BESWebReportsServer" ) as string ) ) of wmi ) ) of login account of service "BESWebReportsServer" ) & "\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\" & ( first match ( regex "^[^:]+" ) of first match ( regex "[^/]+$" ) of ( itas string ) ) of value "Hostname"of key "HKLM\SOFTWARE\BigFix\Enterprise Server\Installer\"of registry ) whose ( exists value "http"whose ( it=2 ) ofitANDexists value "https"whose ( it=2 ) ofit ) of registry ) AND ( exists key "HKLM\Software\BigFix\Enterprise Server\BESReports"whose ( ( ( exists value "PDFEnable"whose ( it="1" ) ofit ) OR ( exists key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports"whose ( exists value ( ( ( value "EnterpriseServerFolder"of key "HKLM\SOFTWARE\BigFix\Enterprise Server"of x32 registry ) as string ) & "BESReportsData\ArchiveData\__pdf\out.ps" ) ofit ) of native registry ) ) AND value "PDFPostScriptPath"ofit= ( ( ( value "EnterpriseServerFolder"of key "HKLM\SOFTWARE\BigFix\Enterprise Server"of x32 registry ) as string ) & "BESReportsData\ArchiveData\__pdf\out.ps" ) AND value "PDFPrinterName"ofit="BES Web Reports Printer" ) of registry ) AND ( exists key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment"whose ( ( exists key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60"whose ( exists value "UninstallString"ofit ) of registry ) AND ( ( itcontains parenthesized part 1of ( first match ( regex "^(.*)uninstgs.exe" ) of ( value "UninstallString"of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60"of registry as string ) ) & "gs8.60\bin"ANDitcontains parenthesized part 1of ( first match ( regex "^(.*)uninstgs.exe" ) of ( value "UninstallString"of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60"of registry as string ) ) & "gs8.60\lib" ) of ( value "Path"ofitas string ) ) ) of registry ) AND ( exists key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports"whose ( exists value ( ( ( value "EnterpriseServerFolder"of key "HKLM\SOFTWARE\BigFix\Enterprise Server"of x32 registry ) as string ) & "BESReportsData\ArchiveData\__pdf\out.ps" ) ofit ) of native registry ) AND ( exists key ( "HKU\" & ( ( if ( it="LocalSystem" ) then ( "S-1-5-18" ) elseif ( it="LocalService" ) then ( "S-1-5-19" ) elseif ( it="NetworkService" ) then ( "S-1-5-20" ) elseif ( itcontains"@" ) then ( component string of sid of security account ( it ) ) else ( string value of select ( ( "SID from Win32_UserAccount where NAME='" & following text of last "\"ofit & "' and DOMAIN='" & ( ( ifit="."then computer name elseit ) of preceding text of last "\"ofit ) & "'" ) of ( ( login account of service "BESWebReportsServer" ) as string ) ) of wmi ) ) of login account of service "BESWebReportsServer" ) & "\Software\Microsoft\Internet Explorer\PageSetup" ) of registry ) )
((version of regapp "iexplore.exe" >= "7") AND (exists key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60"of registry) AND (exists folder "macromed\flash"whose (exists file whose (((itstartswith"flash"ANDit ends with".ocx") OR (it="swflash.ocx")) of (name ofitas lowercase) AND version ofit >= "9") ofit) of system folder) AND (exists key ("HKEY_USERS\" & ((if (it="LocalSystem") then ("S-1-5-18") elseif (it="LocalService") then ("S-1-5-19") elseif (it="NetworkService") then ("S-1-5-20") elseif (itcontains"@") then (component string of sid of security account (it)) else (string value of select (("SID from Win32_UserAccount where NAME='" & following text of last "\"ofit & "' and DOMAIN='" & ((ifit="."then computer name elseit) of preceding text of last "\"ofit) & "'") of ((login account of service "BESWebReportsServer") as string)) of wmi)) of login account of service "BESWebReportsServer") & "\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\" & (first match (regex "^[^:]+") of first match (regex "[^/]+$") of (itas string)) of value "Hostname"of key "HKLM\SOFTWARE\BigFix\Enterprise Server\Installer\"of registry) whose (exists value "http"whose (it=2) ofitANDexists value "https"whose (it=2) ofit) of registry) AND (exists key "HKLM\Software\BigFix\Enterprise Server\BESReports"whose (((exists value "PDFEnable"whose (it="1") ofit) OR (exists key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports"whose (exists value (((value "EnterpriseServerFolder"of key "HKLM\SOFTWARE\BigFix\Enterprise Server"of x32 registry) as string) & "BESReportsData\ArchiveData\__pdf\out.ps") ofit) of native registry)) AND value "PDFPostScriptPath"ofit= (((value "EnterpriseServerFolder"of key "HKLM\SOFTWARE\BigFix\Enterprise Server"of x32 registry) as string) & "BESReportsData\ArchiveData\__pdf\out.ps") AND value "PDFPrinterName"ofit="BES Web Reports Printer") of registry) AND (exists key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment"whose ((exists key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60"whose (exists value "UninstallString"ofit) of registry) AND ((itcontains parenthesized part 1of (first match (regex "^(.*)uninstgs.exe") of (value "UninstallString"of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60"of registry as string)) & "gs8.60\bin"ANDitcontains parenthesized part 1of (first match (regex "^(.*)uninstgs.exe") of (value "UninstallString"of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60"of registry as string)) & "gs8.60\lib") of (value "Path"ofitas string))) of registry) AND (exists key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports"whose (exists value (((value "EnterpriseServerFolder"of key "HKLM\SOFTWARE\BigFix\Enterprise Server"of x32 registry) as string) & "BESReportsData\ArchiveData\__pdf\out.ps") ofit) of native registry) AND (exists key ("HKU\" & ((if (it="LocalSystem") then ("S-1-5-18") elseif (it="LocalService") then ("S-1-5-19") elseif (it="NetworkService") then ("S-1-5-20") elseif (itcontains"@") then (component string of sid of security account (it)) else (string value of select (("SID from Win32_UserAccount where NAME='" & following text of last "\"ofit & "' and DOMAIN='" & ((ifit="."then computer name elseit) of preceding text of last "\"ofit) & "'") of ((login account of service "BESWebReportsServer") as string)) of wmi)) of login account of service "BESWebReportsServer") & "\Software\Microsoft\Internet Explorer\PageSetup") of registry))
( ( itstartswith"Win" ) OR ( itstartswith"AIX" ) OR ( itstartswith"HP-UX" ) OR ( itstartswith"Mac OS X" ) OR ( itstartswith"VMWare" ) OR ( itstartswith"SunOS" ) OR ( itstartswith"Linux" ) ) of name of operating system
((itstartswith"Win") OR (itstartswith"AIX") OR (itstartswith"HP-UX") OR (itstartswith"Mac OS X") OR (itstartswith"VMWare") OR (itstartswith"SunOS") OR (itstartswith"Linux")) of name of operating system
( name of operating system ="Win2000" ) OR ( name of operating system ="WinNT" ) OR ( name of operating system ="WinXP" ) OR ( name of operating system ="WinXPe" )
(name of operating system ="Win2000") OR (name of operating system ="WinNT") OR (name of operating system ="WinXP") OR (name of operating system ="WinXPe")
( ( ( name ofit="WinXP"or name ofit="WinXPe" ) AND ( it=""ORit ends with"1" ) of csd version ofit ) OR ( ( name ofit="Win2003"OR name ofit="WinXP-2003" ) AND csd version ofit="" ) ) of operating system
(((name ofit="WinXP"or name ofit="WinXPe") AND (it=""ORit ends with"1") of csd version ofit) OR ((name ofit="Win2003"OR name ofit="WinXP-2003") AND csd version ofit="")) of operating system
( name of registration server as string as lowercase ) = ( preceding text of first "/"of following text of first "//"of ( value of setting "__Relay_Control_RootServer"of client as string as lowercase ) )
(name of registration server as string as lowercase) = (preceding text of first "/"of following text of first "//"of (value of setting "__Relay_Control_RootServer"of client as string as lowercase))
( preceding text of first ".:"of name of registration server as string as lowercase ) = ( preceding text of first ":"of following text of first "//"of ( value of setting "__Relay_Control_RootServer"of client as string as lowercase ) )
(preceding text of first ".:"of name of registration server as string as lowercase) = (preceding text of first ":"of following text of first "//"of (value of setting "__Relay_Control_RootServer"of client as string as lowercase))
name of operating system startswith"Win"AND ( ( ( it="BES Client"ORit="Enterprise Client" ) of name of parent folder of regapp "BESClient.exe" ) ANDexists ( values "DisplayName"of keys of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"of registry ) whose ( ( it="BigFix Enterprise Client"ORit="BigFix for IBM Proventia ESC Client"ORit="ESP Agent"ORit="Trend Micro Endpoint Security Platform"ORit="Tivoli Endpoint Manager Client" ) of ( itas string ) ) )
name of operating system startswith"Win"AND (((it="BES Client"ORit="Enterprise Client") of name of parent folder of regapp "BESClient.exe") ANDexists (values "DisplayName"of keys of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"of registry) whose ((it="BigFix Enterprise Client"ORit="BigFix for IBM Proventia ESC Client"ORit="ESP Agent"ORit="Trend Micro Endpoint Security Platform"ORit="Tivoli Endpoint Manager Client") of (itas string)))
exists key whose ( exists value "DisplayName"ofitAND value "DisplayName"ofit="BigFix Enterprise Client"AND name ofitstartswith"{" ) of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"of registry
exists key whose (exists value "DisplayName"ofitAND value "DisplayName"ofit="BigFix Enterprise Client"AND name ofitstartswith"{") of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"of registry
( ( name ofit="WinXP"AND ( it!=""AND last 1ofit > "1" ) of csd version ofit ) OR ( ( name ofit="Win2003"OR name ofit="WinXP-2003" ) AND csd version ofit!="" ) ) of operating system
((name ofit="WinXP"AND (it!=""AND last 1ofit > "1") of csd version ofit) OR ((name ofit="Win2003"OR name ofit="WinXP-2003") AND csd version ofit!="")) of operating system
exists key ( if ( exists key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall"of registry ) then ( "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\" ) else ( "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\" ) & ( if ( current profile type of firewall = domain firewall profile type ) then ( "DomainProfile" ) else ( "StandardProfile" ) ) ) whose ( value "DoNotAllowExceptions"ofit=1 ) of registry OR ( ( notexists globally open port whose ( port ofitas string = ( value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string ) AND protocol ofit= udp AND enabled ofit ) ofitANDnotexists authorized application whose ( process image file name ofitas lowercase ends with"besclient.exe"AND enabled ofit ) ofit ) of current profile of local policy of firewall ANDexists internet connection firewall whose ( enabled ofitANDnotexists port mapping whose ( enabled ofitAND protocol ofit="udp"AND internal port ofitas string = ( value "ListenPort"of key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry ) as string ) ofit ) of adapters of network )
exists key (if (exists key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall"of registry) then ("HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\") else ("HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\") & (if (current profile type of firewall = domain firewall profile type) then ("DomainProfile") else ("StandardProfile"))) whose (value "DoNotAllowExceptions"ofit=1) of registry OR ((notexists globally open port whose (port ofitas string = (value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string) AND protocol ofit= udp AND enabled ofit) ofitANDnotexists authorized application whose (process image file name ofitas lowercase ends with"besclient.exe"AND enabled ofit) ofit) of current profile of local policy of firewall ANDexists internet connection firewall whose (enabled ofitANDnotexists port mapping whose (enabled ofitAND protocol ofit="udp"AND internal port ofitas string = (value "ListenPort"of key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry) as string) ofit) of adapters of network)
number of keys whose ( value "DisplayVersion"ofitas string as version ="10"AND ( character 1ofit="9"AND ( it="0"ORit="1" ) of character 2ofitAND ( it="11"ORit="12"ORit="13"ORit="28"ORit="15"ORit="16"ORit="17"ORit="18"ORit="19"ORit="1A"ORit="1B"ORit="27"ORit="29"ORit="2A"ORit="2B"ORit="3A"ORit="3B"ORit="51"ORit="54" ) of first 2of following text of first 3ofitAND ( preceding text of first "%7D"ofit ends with"6000-11D3-8CFE-0050048383C9" ) ) of name ofit ) of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"of registry > 1
number of keys whose (value "DisplayVersion"ofitas string as version ="10"AND (character 1ofit="9"AND (it="0"ORit="1") of character 2ofitAND (it="11"ORit="12"ORit="13"ORit="28"ORit="15"ORit="16"ORit="17"ORit="18"ORit="19"ORit="1A"ORit="1B"ORit="27"ORit="29"ORit="2A"ORit="2B"ORit="3A"ORit="3B"ORit="51"ORit="54") of first 2of following text of first 3ofitAND (preceding text of first "%7D"ofit ends with"6000-11D3-8CFE-0050048383C9")) of name ofit) of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"of registry > 1
exists key ( if ( exists key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall"of registry ) then ( "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\" ) else ( "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\" ) & ( if ( current profile type of firewall = domain firewall profile type ) then ( "DomainProfile" ) else ( "StandardProfile" ) ) ) whose ( value "DoNotAllowExceptions"ofit=1 ) of registry OR ( ( notexists globally open port whose ( enabled ofitAND port ofitas string = ( value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string ) AND protocol ofit= tcp ) of current profile of local policy of firewall ) AND ( exists internet connection firewall whose ( enabled ofitAND ( notexists port mapping whose ( enabled ofitAND protocol ofit="tcp"AND internal port ofitas string = ( value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string ) ) ofit ) ) of adapters of network ) AND ( notexists authorized application whose ( enabled ofitAND ( it ends with"besrelay.exe"ORit ends with"filldb.exe" ) of ( process image file name ofitas lowercase ) ) of current profile of local policy of firewall ) ) OR ( ( notexists globally open port whose ( enabled ofitAND port ofitas string = ( value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string ) AND protocol ofit= udp ) of current profile of local policy of firewall ) AND ( exists internet connection firewall whose ( enabled ofitAND ( notexists port mapping whose ( enabled ofitAND protocol ofit="udp"AND internal port ofitas string = ( value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string ) ) ofit ) ) of adapters of network ) AND ( notexists authorized application whose ( enabled ofitAND ( it ends with"besclient.exe" ) of ( process image file name ofitas lowercase ) ) of current profile of local policy of firewall ) )
exists key (if (exists key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall"of registry) then ("HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\") else ("HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\") & (if (current profile type of firewall = domain firewall profile type) then ("DomainProfile") else ("StandardProfile"))) whose (value "DoNotAllowExceptions"ofit=1) of registry OR ((notexists globally open port whose (enabled ofitAND port ofitas string = (value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string) AND protocol ofit= tcp) of current profile of local policy of firewall) AND (exists internet connection firewall whose (enabled ofitAND (notexists port mapping whose (enabled ofitAND protocol ofit="tcp"AND internal port ofitas string = (value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string)) ofit)) of adapters of network) AND (notexists authorized application whose (enabled ofitAND (it ends with"besrelay.exe"ORit ends with"filldb.exe") of (process image file name ofitas lowercase)) of current profile of local policy of firewall)) OR ((notexists globally open port whose (enabled ofitAND port ofitas string = (value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string) AND protocol ofit= udp) of current profile of local policy of firewall) AND (exists internet connection firewall whose (enabled ofitAND (notexists port mapping whose (enabled ofitAND protocol ofit="udp"AND internal port ofitas string = (value "ListenPort"of key "HKLM\SOFTWARE\BigFix\EnterpriseClient\GlobalOptions"of registry as string)) ofit)) of adapters of network) AND (notexists authorized application whose (enabled ofitAND (it ends with"besclient.exe") of (process image file name ofitas lowercase)) of current profile of local policy of firewall))
( ( ( sum of sizes of files of folders of folders ofit ) + ( sum of sizes of files ofit ) ) of folder "sha1"of folder ( if ( ( exists setting "_BESRelay_UploadManager_BufferDirectory"ofitandexists value of setting "_BESRelay_UploadManager_BufferDirectory"ofit ) of client ) then ( value of setting "_BESRelay_UploadManager_BufferDirectory"of client as string ) else ( if ( name of operating system startswith"Win" ) then ( parent folder of parent folder of client as string & "\BES Relay\UploadManagerData\BufferDir" ) else ( "/var/opt/BESRelay/UploadManagerData/BufferDir" ) ) ) >= it ) of ( if ( ( exists setting "_BESRelay_UploadManager_BufferDirectoryMaxSize"ofitandexists value of setting "_BESRelay_UploadManager_BufferDirectoryMaxSize"ofit ) of client ) then ( value of setting "_BESRelay_UploadManager_BufferDirectoryMaxSize"of client as integer ) else ( 20971520 ) )
(((sum of sizes of files of folders of folders ofit) + (sum of sizes of files ofit)) of folder "sha1"of folder (if ((exists setting "_BESRelay_UploadManager_BufferDirectory"ofitandexists value of setting "_BESRelay_UploadManager_BufferDirectory"ofit) of client) then (value of setting "_BESRelay_UploadManager_BufferDirectory"of client as string) else (if (name of operating system startswith"Win") then (parent folder of parent folder of client as string & "\BES Relay\UploadManagerData\BufferDir") else ("/var/opt/BESRelay/UploadManagerData/BufferDir"))) >= it) of (if ((exists setting "_BESRelay_UploadManager_BufferDirectoryMaxSize"ofitandexists value of setting "_BESRelay_UploadManager_BufferDirectoryMaxSize"ofit) of client) then (value of setting "_BESRelay_UploadManager_BufferDirectoryMaxSize"of client as integer) else (20971520))
( ( name ofit="WinXP"AND ( it=""ORit ends with"1" ) of csd version ofit ) OR ( ( name ofit="Win2003"OR name ofit="WinXP-2003" ) AND csd version ofit="" ) ) of operating system
((name ofit="WinXP"AND (it=""ORit ends with"1") of csd version ofit) OR ((name ofit="Win2003"OR name ofit="WinXP-2003") AND csd version ofit="")) of operating system
exists file whose ( name ofitas string ="rmdir.bat"OR name ofitas string ="client.bat" ) of folder ( pathname of client folder of site "bessupport" ) ORexists folder "__besdiag"of folder ( pathname of client folder of site "bessupport" )
exists file whose (name ofitas string ="rmdir.bat"OR name ofitas string ="client.bat") of folder (pathname of client folder of site "bessupport") ORexists folder "__besdiag"of folder (pathname of client folder of site "bessupport")