Re: .audit code question

Thanks Paul, the settings are defined under hkcu so I'm stuck quering that path.  

--
"When the legend becomes fact, print the legend." 


 -------------- Original message ----------------------
From: Paul Davis <[email protected]>
> John,
> 
> The syntax looks fine at a glance, however, it usually makes sense to query from 
> HKLM and not HKCU whenever possible because of the transient 
> nature of HKCU.
> 
> [email protected] wrote:
> > Hello Everyone, does anyone see anything wrong with the below or anything that 
> I should add. 
> > 
> > I just want the test to check the regkey and pass it the value_data matches or 
> fail it it doesn't.
> > 
> > <custom_item>
> > type: REGISTRY_SETTING
> > description: "CCE-1543  - Excel 2007 - Enable Block opening of Html and Xmlss 
> files types"
> > value_type: POLICY_DWORD
> > value_data: "1"
> > reg_key: 
> "HKCU\Software\Policies\Microsoft\Office\12.0\Excel\Security\FileOpenBlock\"
> > reg_item: "HtmlandXmlssFiles"
> > </item>
> > 
> > Thanks --John
> > --
> > "When the legend becomes fact, print the legend." 
> > _______________________________________________
> > Nessus mailing list
> > [email protected]
> > http://mail.nessus.org/mailman/listinfo/nessus
> > 
> 
> -- 
> Best Regards,
> 
> Paul Davis
> Research Engineer
> Tenable Network Security Inc
> Phone: 410.872.0555 x245
> www.tenablesecurity.com
> 
> Is your network TENABLE?

_______________________________________________
Nessus mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus