I need a solution
I'm creating a rule in HI for SEP 12.1.6 MP3 so that IF a registry key exists AND NOT a registry value with a string value then it runs a program and reports a FAIL. However all are reporting a FAIL when I know that they have already run the command now the registry value with the string value does exist. In looking at one of these test nodes I can also see that, whereas the policy is set to check every 2 minutes, it has not logged anything in the client management>security log since yesterday at 4 PM EST. Below is the screen shot of the rule:
0