You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
What operating system does the GRR server run on? Ubuntu 18.04
What operating system does the affected GRR client run on, if applicable? [e.g. Windows 10]
Describe the issue
Some artifacts are unable to be collected on Windows 10 due to CheckCondition logic failing on the minor version. Windows 10 has major version 10 and minor version 0. For the artifact WindowsAMCacheHveFile which has major: 6 and minor 2
GRR is unable to complete the flow because of the minor version mismatch.
WMIDNSClientCache [os_major_version >= 6 AND os_minor_version >= 2]
WMINetNeighbors [os_major_version >= 6 AND os_minor_version >= 2]
WMINetTCPConnections [os_major_version >= 6 AND os_minor_version >= 2]
WMINetUDPEndpoints [os_major_version >= 6 AND os_minor_version >= 2]
WMIScheduledTasks [os_major_version >= 6 AND os_minor_version >= 2]
Error logs
N/A
Additional context ForensicArtifacts/artifacts/issues/274 is from the original issue back in 2018 and the author lists some suggestions like combining os_major and os_minor into os_version. There is also the possibility of removing the condition altogether. Thoughts?
The text was updated successfully, but these errors were encountered:
Environment
Describe the issue
Some artifacts are unable to be collected on Windows 10 due to CheckCondition logic failing on the minor version. Windows 10 has major version
10
and minor version0
. For the artifactWindowsAMCacheHveFile
which has major: 6 and minor 2GRR is unable to complete the flow because of the minor version mismatch.
Affected artifacts:
Windows:
WMI:
Error logs
N/A
Additional context
ForensicArtifacts/artifacts/issues/274 is from the original issue back in 2018 and the author lists some suggestions like combining os_major and os_minor into os_version. There is also the possibility of removing the condition altogether. Thoughts?
The text was updated successfully, but these errors were encountered: