> Source: [sk132932](https://support.checkpoint.com/results/sk/sk132932)

# sk132932 - How to modify a registry entry or replace/install a file on Endpoint Security Client using the Compliance Blade

| Property | Value |
|----------|-------|
| Solution ID | sk132932 |
| Date Created | 2018-07-27 |
| Last Modified | 2023-11-30 |
| Technical Level | General |
| Products | Security Management Server, Endpoint Security |
| Versions | R82.10, R82, R81.20, Cloud, R82.x, R82.20, E89.X, E88.X |
| OS | Windows |

## Solution

Introduction
------------

The Endpoint Security Compliance Blade contains two new enhancement features. The new features let you modify the registry entries that do not comply with system policy, and add/replace missing or incorrect files on the client computer.

Registry modification enhancement
---------------------------------

1. Create a rule that checks a specific registry entry in the policy. ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk132912/registry11807260351.png)

   ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk132912/registry_rule31807260354.png)

   ![](https://sc1.checkpoint.com/sc//SolutionsStatics/NEW_SK_NOID1532599866348/registry_rule21807260337.png)
2. Select the Action that has to be performed before the test. **ADD** - Adds the value when the value does not exist

   **REMOVE** - Removes the existing value

   **REPLACE** - Replaces the existing value

   **UPDATE** - Adds the value even if it exists (acts as **ADD** or **REPLACE**)
3. Specify the type of the entry. **REG_SZ** for strings and **REG_DWORD** for numbers.

4. Modify the **Registry Value Name** entry. Add Action and Value type, separated by spaces before the key path. For example:

   ```
   UPDATE REG_DWORD HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\CheckPoint\EndPoint Security\LCID
   ```

   ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk132912/registry21807260402.png)
5. Save and install the policy.

<br />

After the policy is deployed to the client and Compliance performs rules validation, the requested entry will be modified.

![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk132912/registry31807260405.png)

File modification enhancement
-----------------------------

This enhancement lets you add or replace the file on the client computer.

1. Create a rule that checks that the correct file already exists on the target computer. If you want to install a new file, it could be a simple "File exists" rule. If you need to replace an existing file, it is recommended to use MD5 hash validation. ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk132912/file11807260406.png)

2. Create a **Run File Remediation** .

   ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk132912/file21807260407.png)
3. In the **Download Path** entry, you **must** specify a full path for the downloaded file, including hardcoded name *EPComplianceRemediationFile.bat* . **This name cannot be changed** . It will force the enhancement to work.

   ```
   %PUBLIC%\EPComplianceRemediationFile.bat
       
   ```

4. In the **URL** entry, you must specify the file to be copied to the target system. If the file is not *bat* or *exe,* it will not be shown in the Browse dialog, and you will have to copy its name into the URL field directly.

   ```
   File://C:\Users\admin.VART\Desktop\561992C9.key
       
   ```

5. In the **Parameters** entry, write *MOVE* and after a space, the full path including the real file name on the target system, where the file has to be installed:

   *MOVE C:\\Program Files (x86)\\CheckPoint\\Endpoint Security\\Anti-Malware\\Avsys\\license\\**561992C9.key***
6. Associate the created remediation action with the rule, and change the Action to **Restrict** to force remediation execution in the event of a rule check failure.

   ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk132912/file31807260408.png)
7. Save and install the policy.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content