-
Title
Kace agent redirected to 32-bit applications Registry paths -
Description
When running scripts or custom inventory rules that look in System32 bits directory or KLM\Software registry the OS will redirect the action to the folder/registry designated for 32-bit applications and the script or CIR may fail or not return the required information.
Example: A script is created to create a registry key in the directory HKLM\Software\SoftwareName but instead is found that the kay was created on HKLM\Software\WOW6432Node\SoftwareName.
-
Cause
This is an expected behavior.
Whenever a 32-bit application attempts to access %windir%\System32, the access is redirected to a new directory, %windir%\SysWOW64. Access to %windir%\lastgood\system32 is redirected to %windir%\lastgood\SysWOW64. Access to %windir%\regedit.exe is redirected to %windir%\SysWOW64\regedit.exe.32-bit applications running on 64-bit Windows use the Software\Wow6432Node hive for registry keys anywhere they would have used the Software node on 32-bit Windows. Specifically, this applies to HKEY_CURRENT_USER\Software and HKEY_LOCAL_MACHINE\Software. These two registry hives operate in an analogous manner to the %windir%\System32 and %windir%\SysWOW64 directories described above. -
Resolution
Registry Redirection:
Starting 10.0 NAT can be added to HKLM (HKEY_LOCAL_MACHINE) to access 32- or 64-bit registry space in script tasks, as needed.
For example HKLMNAT\Software\SoftwareName.Example of a task to check registry key that exists on 64 bit OSHKLM\Software\SoftwareName (No extension, this is checking under HKLM\Software\WOW6432Node\SoftwareName)HKLM64\Software\SoftwareName (64-bit extension specified, so checking HKLM\Software\SoftwareName, not the WOW6432Node redirect)HKLM32\Software\SoftwareName (32-bit extension specified, so checking HKLM\Software\WOW6432Node\SoftwareName)
Windir Redirection:
To make sure Kace runs a program 64-bit version from the windows directory, for example, powershell.exe, make sure is ran from the following path:C:\Windows\sysnative\WindowsPowerShell\v1.0