Decrypt my World

Cryptography, Security, Debugging and more!

How to read a registry key and its values (VBScript)

How to read a registry key and its values (VBScript)

  • Comments 10

Hi all, welcome back,

Today I'll share with you a couple of VBScript samples I developed the other day. They use WMI and its StdRegProv class to read the Windows registry.

This sample will take a registry key and show its subkeys and the values within those subkeys:

' Constants (taken from WinReg.h)
'
Const HKEY_CLASSES_ROOT   = &H80000000
Const HKEY_CURRENT_USER   = &H80000001
Const HKEY_LOCAL_MACHINE  = &H80000002
Const HKEY_USERS          = &H80000003

Const REG_SZ        = 1
Const REG_EXPAND_SZ = 2
Const REG_BINARY    = 3
Const REG_DWORD     = 4
Const REG_MULTI_SZ  = 7

' Chose computer name, registry tree and key path
'
strComputer = "." ' Use . for current machine
hDefKey = HKEY_LOCAL_MACHINE
strKeyPath = "SOFTWARE\Microsoft\Cryptography\Defaults\Provider"

' Connect to registry provider on target machine with current user
'
Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")

' Enum the subkeys of the key path we've chosen
'
oReg.EnumKey hDefKey, strKeyPath, arrSubKeys

For Each strSubkey In arrSubKeys

  ' Show the subkey
  '
  wscript.echo strSubkey

  ' Show its value names and types
  '
  strSubKeyPath = strKeyPath & "\" & strSubkey
  oReg.EnumValues hDefKey, strSubKeyPath, arrValueNames, arrTypes

  For i = LBound(arrValueNames) To UBound(arrValueNames)
    strValueName = arrValueNames(i)
    Select Case arrTypes(i)

      ' Show a REG_SZ value
      '
      Case REG_SZ          
        oReg.GetStringValue hDefKey, strSubKeyPath, strValueName, strValue
        wscript.echo "  " & strValueName & " (REG_SZ) = " & strValue

      ' Show a REG_EXPAND_SZ value
      '
      Case REG_EXPAND_SZ
        oReg.GetExpandedStringValue hDefKey, strSubKeyPath, strValueName, strValue
        wscript.echo "  " & strValueName & " (REG_EXPAND_SZ) = " & strValue

      ' Show a REG_BINARY value
      '          
      Case REG_BINARY
        oReg.GetBinaryValue hDefKey, strSubKeyPath, strValueName, arrBytes
        strBytes = ""
        For Each uByte in arrBytes
          strBytes = strBytes & Hex(uByte) & " "
        Next
        wscript.echo "  " & strValueName & " (REG_BINARY) = " & strBytes

      ' Show a REG_DWORD value
      '
      Case REG_DWORD
        oReg.GetDWORDValue hDefKey, strSubKeyPath, strValueName, uValue
        wscript.echo "  " & strValueName & " (REG_DWORD) = " & CStr(uValue)				  

      ' Show a REG_MULTI_SZ value
      '
      Case REG_MULTI_SZ
        oReg.GetMultiStringValue hDefKey, strSubKeyPath, strValueName, arrValues				  				
        wscript.echo "  " & strValueName & " (REG_MULTI_SZ) ="
        For Each strValue in arrValues
          wscript.echo "    " & strValue 
        Next

    End Select
  Next

Next

But what if we only need to know if a registry key exists? We could just do the following:

' Constants (taken from WinReg.h)
'
Const HKEY_CLASSES_ROOT   = &H80000000
Const HKEY_CURRENT_USER   = &H80000001
Const HKEY_LOCAL_MACHINE  = &H80000002
Const HKEY_USERS          = &H80000003

' Chose computer name, registry tree and key path
'
strComputer = "." ' Use . for current machine
hDefKey = HKEY_LOCAL_MACHINE
strKeyPath = "SOFTWARE\Microsoft\Cryptography\Defaults\Provider"

' Connect to registry provider on target machine with current user
'
Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")

' Try to enum the subkeys of the key path we've chosen. We can't if the key doesn't exist
'
If oReg.EnumKey(hDefKey, strKeyPath, arrSubKeys) = 0 Then
  wscript.echo "Key exists!"
Else
  wscript.echo "Key does not exists!"
End If

 

I hope this helps.

Cheers,

 

Alex (Alejandro Campos Magencio)

  • This worked for me.

    I had to add in 'On Error Resume Next' though or it would error on subkeys with only the Default entry inside.

    I actually used it to get a list of installed software, much faster than using WMI's WIN32_Product.

  • i want how to get version of registry using vb script

  • This code looks like VB not VBScript!

  • Hi GR,

    This code is indeed VBScript.

  • So why don't you write it as a useful function that accepts a key and returns a value?

    For example:  function GetResitsryKey(Key){}

    Get into the good habit of creating functions and procedures not just loose code dumps!

  • Hi GR,

    Feel free to post your own sample using functions/procedures and share it with the community if you think that will help even more people.

    Thank you!

  • Hi,

    Is there any chance that you can modify the script to write results in a file in place of the msg screen ?

    thanks in advance for your help.

  • Regarding the second example, testing for the existence of a key:

    I beat my head against the wall on this issue for hours and I hope to save someone else some contusions.  Just because the script returns with "Key does not exist" does NOT mean the key isn't there.  In my case, I could see/change/delete and add the key in REGEDIT, but the script insisted the "Key does not exist".  

    The issue turned out to be the permissions on the key.  Even though I could do anything I wanted with the key using REGEDIT, my account did not have permissions to read the key.  That's because UAC is enabled on my PC (WS101) and so REGEDIT was running as elevated.  The script was not.  Doh!!!

    I granted WS101\Users READ permission to the key and then the script works as expected.  Lesson learned.

  • I will be attempting to save the data on a file (may be a table), and if I succeed, I will post it here.

    Thanks Again Alejandro, your time is highly appreciated,

    Alvaro

  • You can do a simple check with RegRead to trap errors checking for errors other than just existence.  This would have helped Ken with the permissions issue.

    There are many ways you can do this probably more gracefully.  "RegistryKey" below represents the variable holding the full key path you are reading.

    Dim WSO

    Set WSO = CreateObject("WScript.Shell")

    WSO.RegRead RegistryKey

    Select Case Err

    Case 0:

    '  Successful read of the key, so do something here

    Wscript.echo "Reg key exists..."

    Case &h80070002:

    '  Trapped an error, do something here

    Wscript.echo Err.description

    Case Else:

    '  Some other error condition, not trapped above

    Wscript.echo "Unexpected error"

    End Select

Page 1 of 1 (10 items)
Leave a Comment
  • Please add 4 and 3 and type the answer here:
  • Post
Translate This Page