MPAuthor.RegistryMonitor 1.0.0.2 MPAuthor.RegistryMonitor Microsoft.SystemCenter.Library 6.1.7221.0 31bf3856ad364e35 Microsoft.Windows.Library 6.1.7221.0 31bf3856ad364e35 System.Health.Library 6.1.7221.0 31bf3856ad364e35 System.Library 6.1.7221.0 31bf3856ad364e35 FileInfo.ps1 fileName $Config/FileName$ 30 System!System.PropertyBagData true $Config/IntervalSeconds$ $Config/SyncTime$ $Config/ComputerName$ RegValue $Config/RegPath$ 1 1 Values/RegValue Equal $Config/DesiredRegValue$ Values/RegValue NotEqual $Config/DesiredRegValue$ Discovery $Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$ AppExists SOFTWARE\MPAuthor\PropertyBag 0 0 3600 $MPElement[Name="MPAuthor.RegistryMonitor.TargetClass"]$ $MPElement[Name="Windows!Microsoft.Windows.Computer"]/PrincipalName$ $Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$ $MPElement[Name="System!System.Entity"]/DisplayName$ $Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$ Values/AppExists Equal True Custom 120 $Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$ SOFTWARE\MPAuthor\RegistryMonitor\TestValue ThisValue StateCollection MPAuthor Sample - Property Bag This management pack provides an example of a monitor based on a registry value. A monitor type is included that will periodically check a specified registry value and compare it to a desired value. The monitor provides the path to the value, the duration to check, and the value to compare it to. The included monitor checks the value at HKLM\SOFTWARE\MPAuthor\RegistryMonitor\TestValue and sets the monitor to a critical state if the value is not "ThisValue". A different registry value and desired value can be used by changing the configuration of the monitor. All rules and monitors are targeted at a class called MPAuthor.RegistryMonitor.Target. This is discovered by creating a registry key at HKLM\SOFTWARE\MPAuthor\RegisterMonitor. This registry key must be on the same agent with the registry value being checked. MPAuthor Discover PropertyBag Target Class MPAuthor Sample Registry Monitor File size Please see the alert context for details. Reg Value Match NoMatch Registry Value Monitor Type MPAuthor File Info Probe Action MPAuthor Registry MonitorTarget Registry Monitor Target