Clutching at Security Blankets

Lessons learned while working in Information Security.

Let’s say you’ve got an endpoint management solution in place that doesn’t yet understand Windows 10 and instead reports it as various flavors of Windows 8 or 8.1. How do you detect what flavor of Windows really is running on the system?

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName

Nothing Earth-shattering about this one, but it was a simple solution to the problem. In BigFix Relevance, we can use the following (though it will be unnecessary once we’re running the version that has native detection for Windows 10):

(exists (if (x64 of operating system) then 
            unique values of (it as string as trimmed string) 
                of values "ProductName" 
                    of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" 
                        of (x32 registries;x64 registries) 
        else unique values of (it as string as trimmed string) 
            of values "ProductName" of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" 
                of registry) 
 whose (it starts with "Windows 10"))

This article is tagged: bigfix code windows