Software signature based on a registry key windows

[Alex Moreira]

Hello guys,

I created a software signature based on a registry key windows.

*this software it is possible to find only registry key. (WinRM)

I would like to discover all the workstations that shows the machines that are in the service "Start"

Attached is the configuration that I did, but found no machine. Did I do something wrong setting?

 

Thanks!

Alex

 

 

[Gordon Lamothe]

In the Value section try just '2*'

 

and you might also try Architecture 32bit

 

Don't make both changes at the same time

[Alex Moreira]

Gordon,

I changed as you said I also created another definition of software to 32 bit, but so far has not brought nemhuma machine.

 

[Leo_Evers]

Alex,

In the Path, you need to enter:

SYSTEM\CurrentControlSet\services\WinRM\Start

 

so NOT enclosed in double quotes (i admit the description underneath is confusing).

You entered WinRMI rather than WinRM and did not include the Start key?

 

For Value, enter 2

No quotes here either.

 

Architecture needs to remain at 64-bit.

 

Ran a test myself with these values and the product release was discovered well.

 

regards,

Leo

[Alex Moreira]

Hi Leo,

After I removed the quotes started to bring results

Thank you for your help.

Alex