How do I create a registry detection check for a DWORD value? DWORD values are not working for detection or applicability rules.
ITMS 8.x
DWORD values are not natively supported in ITMS, however there is a way to configure a registry rule to work with DWORD values.
By adding dword to the front of your value, you can use DWORD values in your detection check. See this screenshot for examples of how this should be configured:
Registry example:
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects]
"VisualFXSetting"=dword:00000003
Rule Configuration:
NOTE: You should use Substring as the Match criteria.