Searching Specific File

[cbraafhart]

Dear Forums,

I am currently trying to search and find a specific file under a specific folder.

I have created a search query under Scanning - Data Selection - File and Registry Scanning that should look under the Appdata folder. I am currently trying to query all details regarding zoom, when the installer file has been created/modified.

i have tried the following combinations

%AppData%\Zoom\Uninstall\Installer.exe but also C:\Users\%Username%\AppData\Roaming\Zoom\Uninstall\Installer.exe without any type of success. they both give me a False result.

I have also tried with the following:
%SystemDrive%\Users\%username%\AppData\Roaming\Zoom\uninstall\installer.exe but with no luck.

But when i use an actual user path as it is within the result for example: C:\Users\lansweeper\AppData\Roaming\Zoom\Uninstall\Installer.exe i get a result with the correct date created and modified.

Does anyone know any tips or tricks without having to create specific file paths for every single user in my AD?

[KrisNelson]

This likely isn't going to be possible due to the fact that %appdata% will return with c:\users\<lansweers scanning account>\appdata\ which likely doesn't exist and certainly isn't the folder/file you really want to scan.

You would need to either hard code it or find a way to write the current username variable into a system one. You could do it with a startup script, but if that's a acceptable solution than it would just be better to use a startup script to write the file information to a registry key and then scan that. That way you get the information your looking for without a user needing to be logged on at the time of a scan.

-Kris

[mzipperer]

I'm having the same issue please let me know if you found a work around