Windows 11 Compatibility report

[sdoty]

Greetings,

In running the Windows Compatibility report from Lansweeper, I may have discovered an error in the reporting, or I may simply have put my 'where' clause in the wrong spot. Odds are its the second one. 

In the following section of code below, for the secure boot enabled, two checks are made, with a 'Yes' and 'No' answer, but also with a 'Regkey not found' value as a default. When I run this report in our environment, that field always returns a 'Regkey not found' value for the secure boot enabled field, for ALL machines. Even the ones that pass. I proved this out by typing in my own response to that query, and it kicked that response into that field as a result.

It was noted in the release article of this report that we would have to put the registry key in (provided in article) and scan for the value of 1 or 0. It seems to conflict with the aforementioned checks. I verified by hand that the machines cited as not having UEFI boot enabled, had that registry key set to 1. Could someone please assist with figuring this out? Both code excerpts are below.

" Case
When CPU.AssetID = tblAssets.AssetID Then 'Pass'
Else 'Fail'
End As [CPU Compatible],
Case
When TPM.[TPM Version] Is Null Then 'Fail'
Else TPM.[TPM Version]
End As [TPM Version 2.0],
BIOS.[BIOS Type] As [BIOS Type UEFI],
Case
When SecureBoot.Value = 0 Then 'No'
When SecureBoot.Value = 1 Then 'Yes'
Else 'Regkey not found'       ---------- I changed this to 'No UEFI Found' as a test and it showed up on every device.
End As [Secure Boot Enabled],"

--- conflicting test? -----
Left Join (Select Top 1000000 tblRegistry.AssetID,
tblRegistry.Regkey,
tblRegistry.Valuename,
tblRegistry.Value,
tblRegistry.Lastchanged
From tblRegistry
Where
tblRegistry.Regkey Like
'%HKLM\SYSTEM\ControlSet001\Control\SecureBoot\State%' And
tblRegistry.Valuename = 'UEFISecureBootEnabled') As SecureBoot On
SecureBoot.AssetID = tblAssets.AssetID
Left Join (Select Top 1000000 tblAssets.AssetID,
tblAssets.AssetName,
Cast(Cast(tblDiskdrives.Freespace As bigint) / 1024 / 1024 /
1024 As numeric) As free,
Cast(tblDiskdrives.Size / 1024 / 1024 / 1024 As numeric) As TotalSize,
tblComputersystem.SystemType,
tblDiskdrives.Caption

[sdoty]

Greetings,

Thank you for the response. Originally the report was written in the format you mention, and wasn't working so that is why I changed it to hklm at the beginning to see if that was the issue. I will change that back when I run it next.

The option to have this pre-scanned in our registry scanning wasn't mentioned as a requirement for the report, so I have added it to our registry scanning and simply waiting for scan results to be built up. I assumed by the way the report script read, that it did the scan at the time, but in hindsight that does seem a bit silly. I didn't set up our original scanning and assumed it was something already included somewhere. It is now included in our registry scanning and I will let you know if it produces results.

Thank you for the tip, have a great day!

[soapofett · Accepted solution]

If you take out the root key of the registry it should work. Reports don't like when you include it. Also make sure the registry you're scanning under "Custom Scanning" does not have 'HKLM' in the regpath, I've made that mistake before. 

Try "%\SYSTEM\ControlSet001\Control\SecureBoot\State%' , if that doesn't work, just double check the custom scanning of the registry is set up correctly. 

[AlbertoMC]

That makes sense, I’ve run into similar issues before where including HKLM would break the report unexpectedly. Appreciate the tip on using just the subpath, easy to overlook when setting up custom scans.