WSUS Updates: Applicability rules - Front

[jhaynes]

Hi,

We have had an issue today where a user reported that the application named "Front" kept being installed on their machine. I managed to determine it was Patch my PC and then later the reason.

It was due to a weak applicability rule where it was looking under HKLM\...\Uninstall hive for a key where the display name starts with Front.

The user had a game installed that starts with Front so the applicability rule was picking this up and installing the "Update".

Can you review the applicability rule please? if you can include something like publisher to avoid this reappearing? This wasn't the first time this occurred, but I now can't recall what application it was previously, however the user just uninstalled the app causing the applicability rule to trigger so, we just left it at that. But I have seen this trpe of rule before where it's just doing a version check below this X number and display name starts with "Name" type check. I understand that likely works for most things but including the publisher in this and/or perhaps install path would strengthen this?

The full rules if you need it

Is Installed Rule

<bar:RegKeyLoop Key="HKEY_LOCAL_MACHINE" Subkey="SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" TrueIf="Any">
<lar:And>
  <bar:RegSzToVersion Key="HKEY_LOOP_TARGET" Subkey="\" Comparison="GreaterThanOrEqualTo" Data="3.80.0.0" Value="DisplayVersion" />
  <bar:RegSz Key="HKEY_LOOP_TARGET" Subkey="\" Comparison="BeginsWith" Data="Front " Value="DisplayName" />
</lar:And>
</bar:RegKeyLoop>

Is Installable Rule <- problem rule

<lar:And>
  <bar:RegKeyLoop Key="HKEY_LOCAL_MACHINE" Subkey="SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" TrueIf="Any">
  <lar:And>
    <bar:RegSzToVersion Key="HKEY_LOOP_TARGET" Subkey="\" Comparison="LessThan" Data="3.80.0.0" Value="DisplayVersion" />
    <bar:RegSz Key="HKEY_LOOP_TARGET" Subkey="\" Comparison="BeginsWith" Data="Front " Value="DisplayName" />
  </lar:And>
  </bar:RegKeyLoop>
  <bar:WindowsVersion Comparison="GreaterThanOrEqualTo" MajorVersion="10" MinorVersion="0" />
</lar:And>

[jhaynes]

OR, I forgot to add.

Could you add functionality that allows people to edit the applicability rules maybe? I could have modified this to fix the problem, but I can't.

[Andrew Jimenez (Patch My PC)]

We'll get the rules adjusted for this app. Thanks for the information!

We have an idea on our ideas page for editing applicability rules here: https://ideas.patchmypc.com/ideas/PATCHMYPC-I-6909

[Andrew Jimenez (Patch My PC)]

Can you let us know the Display name of the software installed on the device? We want to make sure any rule we make doesn't target it again.

[jhaynes]

Can you let us know the Display name of the software installed on the device? We want to make sure any rule we make doesn't target it again.

Thanks for the quick response! And sorry, I tried to grab it from the registry, but they have just uninstalled after I mentioned what was causing it.
I have grabbed it from SCCM hardware Inventory

FRONT MISSION 1st: Remake
FRONT MISSION 3: Remake