Trying to create configuration item on file property within user profile

Question

We want to use compliance management to know if anybody has modified a configuration .xml file in the user profile under %userprofile%\appdata\roaming\appname\common

I created a configuration item with these properties:
Type: File
Path: %userprofile%\appdata\roaming\appname\common
File or folder name: Configuration.xml

For the compliance rule I have tried checking Modify Date between two dates, and I have also tried checking file size equals, the problem is no matter what I do the compliance check always comes back compliant. I have tried copying non-compliant files into the folder and refreshing policy. But when I re-run evaluation it still thinks my system is compliant.

I am starting to think it might have a problem interpreting the variable %userprofile% in my path? Is there a better way to do this?

Thanks for reading

Answer 1

You can add logging to your script to confirm what folder it is looking at but it likely looking at the local system account.

Answer 2

Hi, @Elroy
Thank you for posting in Microsoft Q&A forum.

I test it in my lab with the same configuration like yours, and get the same result.
I checked the DcmWmiProvider.log on client, and found %userprofile%\appdata\roaming\ evaluated to : C:\Users\Default\appdata\roaming\

Then, if we haven't check "Report noncompliance if this setting instance is not found", then it will report as "Compliance" if the file is not found. If we checked it, it will report as "Non-Compliance" if the file is not found.

We may follow this guidance to create user data and profiles configuration items:
https://learn.microsoft.com/en-us/mem/configmgr/compliance/deploy-use/create-user-data-and-profiles-configuration-items

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.