Important Notice: On February 29th, this community was put into read-only mode. All existing posts will remain but customers are unable to add new posts or comment on existing. Please feel to join our Community Discord for any questions and discussions.

Collection for whether file exists?

John Q

May 03, 2021 18:05

I'm trying to create a collection that will show me computers that DO have MpSigStub.exe in c:\Windows\System32 and systems that do NOT have it.

I've tried this but I don't think it's working right. Is this the way?

Additionally my goal here is to deploy a script that deletes the file. Will the system be removed from the collection showing it not having the file, or would I have to add a "File scan" into the PDQ Deployment that I have which scans System32?

Comments

5 comments

kercherm
May 03, 2021 18:07

Are you scanning that directory in your scan profile? Once the file is deleted by your script, it should fall out of the collection after the next file scan.

0
John Q
May 03, 2021 20:09

Yes it is scanned in one of the scan profiles.

However I see duplicate systems in this Dynamic collection that I see in the Collection containing systems that do have the file.

0
kercherm
May 03, 2021 20:24

I would think your first filter is not needed since all of your Windows machines are going to have C:\Windows\System32.

For your second filter, I'd change Comparison from Contains to Equals.

0
kercherm
May 03, 2021 20:26

I also run into false positives every once in a while. I have a dynamic collection for the existence of a particular file, but if I browse the C$ share, the file does not exist.

0
John Q
May 03, 2021 20:47

Ok thanks, I think that works then.

So if file exists:

If file doesn't exist:

0