SCOM: Registry discovery on 64 bit OS

When you're running 32 bit applications on 64 bit servers with a 64 bit SCOM Agent, you really should read this post. Same goes for people who wonder why their discovery does work on 32 bit servers and not on 64 bit servers.

32 bit Application on 64 bit OS

When a 32 bit application is installed on a 32 bit Windows OS, the registry keys are usually writen to :
HKEY_LOCAL_MACHINE\Software\YourVendor\ApplicationName.

This changes when the OS is a 64 bit version.
Then a 32 bit installation sets its registry keys in:
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\YourVendor\AppicationName

Attribute Discovery
This is tricky when you don't know if one or both of these scenarios exists in your environment. There is more than one solution for your attribute discovery. (SCOM 2007 R2 is required for solution #2).

1. Copy the right child keys from the key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\ to HKEY_LOCAL_MACHINE\Software\
2. Add an extra XML element to the Registry Discovery in your MP to make a '32 bit discovery' work on a 64 bit Agent.
3. Use a VBScript for the discovery in which you have multiple ways of checking for CPU Archicture en reading registry keys
   

I will show you how to use solution 2. If you also would like to see how to work with solution 3.

Enable the Discovery using the 32 bit part of 64 bit registry

• Open your Management Pack with a text editor, e.g. notepad.exe
• Go to Discoveries section
• Search for the Discovery in which you want to enable 32 bit discovery
• Within the section , add the following XML element
• <registryview>32bit</registryview>
• Save your Management Pack
• Done!
  

In XML it will probably will look like this:

<RegistryAttributeDefinition>
  <AttributeName>AppExists</AttributeName>
  <Path>SOFTWARE\YourVendor\ApplicationName\Value</Path>
  <PathType>1</PathType>
  <AttributeType>1</AttributeType>
  <RegistryView>32bit</RegistryView>
</RegistryAttributeDefinition>

As other users have already noticed: If you make a change to the attribute from the Operations Console or Authoring console, the RegistryView element is deleted. So watch out for that!

See also: http://social.technet.microsoft.com/Forums/en/operationsmanagermgmtpacks/thread/bf566244-1164-4bf7-b08c-558bc7bc2363