Or this:
*-------------------------------
Check Category: File Check
Check Type: File Version
Check Name: ns_ffversion
File Path: SYSTEM_PROGRAMS\Mozilla Firefox\firefox.exe
Operator: later than
File Version: 1.0.6.9
Check Description: Checks to see if the version firefox.exe is > the last minor release
Operating System: Windows ALL
*------------------------------
We then build a requirement that is a File Distribution.
Simon
>>> [log in to unmask] 10/6/2005 5:37 PM >>>
How about checking this key:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla (1.7.12)
Cal A. Krzywiec
Residential Network Consultant
The University of Scranton
Email: [log in to unmask]
Phone: 570-941-6960
-----Original Message-----
From: Perfigo SecureSmart and CleanMachines Discussion List
[mailto:[log in to unmask]] On Behalf Of Michael Grinnell
Sent: Thursday, October 06, 2005 3:08 PM
To: [log in to unmask]
Subject: Re: Mozilla or Firefox checks
Cal,
Here's a list of the keys that we're checking for Mozilla. The ones
for Firefox are almost the same, but it seems that Mozilla is
problematic (see below).
Checks
regMozillaExists
HKLM\SOFTWARE\mozilla.org\Mozilla\ exists
fileMozillaExists
SYSTEM_PROGRAMS\mozilla.org\Mozilla\mozilla.exe exists
regMozillaCurrent
HKLM\SOFTWARE\mozilla.org\Mozilla\CurrentVersion string starts
with 1.7.12
Rules
MozillaNeedsUpdate (Version 1)
!regMozillaExists | (regMozillaExists & regMozillaCurrent)
MozillaNeedsUpdate (Version 2)
!(regMozillaExists & fileMozillaExists) | (regMozillaExists &
fileMozillaExists & regMozillaCurrent)
The problem is, some versions of Thunderbird sometimes, but not
always, create a HKLM\SOFTWARE\mozilla.org\Mozilla\CurrentVersion
key. Depending on the version of Thunderbird installed, this could
be wildly out of date, and so version 1 of the rule makes them
install Mozilla when they didn't have it installed before.
Unlike Firefox, Mozilla does not create a generic key in HKLM\SOFTWARE
\Mozilla\ that you can test to see if it's installed.
I'm testing version 2 of the rule on some of my coworkers right now
to see what happens.
Michael Grinnell
Network Security Administrator
The American University
e-mail: [log in to unmask]
On Oct 5, 2005, at 5:30 PM, Calvin A. Krzywiec wrote:
> What registry keys are you currently checking?
>
> Cal A. Krzywiec
> Residential Network Consultant
> The University of Scranton
> Email: [log in to unmask]
> Phone: 570-941-6960
>
> -----Original Message-----
> From: Perfigo SecureSmart and CleanMachines Discussion List
> [mailto:[log in to unmask]] On Behalf Of Michael Grinnell
> Sent: Wednesday, October 05, 2005 4:59 PM
> To: [log in to unmask]
> Subject: Mozilla or Firefox checks
>
> We're trying to create rules that will catch users running older
> versions of Mozilla or Mozilla Firefox so that we can make them
> upgrade. I'm having problems creating appropriate rules due to the
> way Mozilla, Mozilla Firefox, and Mozilla Thunderbird create registry
> keys. In particular, I keep getting false positives on my check for
> Mozilla when some users have certain versions of Thunderbird or
> Firefox. Unfortunately, I'm having trouble replicating these issues
> in my test environment, which makes it very difficult to fix the
> rules.
>
> Has anybody tried doing rules for Mozilla or Firefox before, and if
> so, would you be willing to share them?
>
> Michael Grinnell
> Network Security Administrator
> The American University
> e-mail: [log in to unmask]
>
|