Report on Registry Key

[brandon_jones]

I have set up a registry key to be scanned under the scanning settings. The key is HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon and the regvalue is shell. How ever I want a report that gives me the computers where shell is not equal to explorer.exe How would I go about creating this?

[sbAYVdQu]

I think this will do it:

Select Top 1000000 tblAssets.AssetID,
  tblAssets.AssetName,
  tsysAssetTypes.AssetTypename,
  tsysAssetTypes.AssetTypeIcon10 As icon,
  tblAssets.IPAddress,
  tblAssets.Lastseen,
  tblAssets.Lasttried
From tblAssets
  Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
  Inner Join tsysAssetTypes On tsysAssetTypes.AssetType = tblAssets.Assettype
  Inner Join tblRegistry On tblAssets.AssetID = tblRegistry.AssetID
Where tblAssetCustom.State = 1 and tblregistry.regkey = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion' and tblregistry.Valuename = 'shell' and tblregistry.Value <> 'explorer.exe'