{"id":10,"date":"2008-02-11T14:00:00","date_gmt":"2008-02-11T22:00:00","guid":{"rendered":"http:\/\/testblog.sapien.com\/index.php\/2008\/02\/11\/remote-registry-reading-the-vbscript-way\/"},"modified":"2008-02-11T15:20:13","modified_gmt":"2008-02-11T23:20:13","slug":"remote-registry-reading-the-vbscript-way","status":"publish","type":"post","link":"https:\/\/dev.sapien.com\/blog\/2008\/02\/11\/remote-registry-reading-the-vbscript-way\/","title":{"rendered":"Remote Registry Reading the VBScript Way"},"content":{"rendered":"

Last week I blogged<\/a> about using REG.EXE in a batch file to read a registry key. The batch file I provided works, but the output is limited. You could probably parse it a bit more to get it in some other format. But I’d probably turn to VBScript and WMI if I wanted better output control or if I had more complicated needs.<\/p>\n

Without resorting to third party controls, you need to use the WMI registry provider to access remote registries.<\/p>\n

strComputer=”localhost”<\/font><\/p>\n

Set objReg=GetObject(“winmgmts:{impersonationLevel=impersonate}!\\” &_
\nstrComputer & “\\root\\default:StdRegProv”)<\/font><\/p>\n

Once you have a connection you can enumerate keys or values. I’m going to look at the method for enumerating values since my goal is to read a specified key.<\/p>\n

Const HKEY_LOCAL_MACHINE = &H80000002<\/font><\/p>\n

‘the registry path to query
\nstrKeyPath =”Software\\Microsoft\\Windows NT\\CurrentVersion”
\n‘the registry key value to get
\nstrValueName=”RegisteredOwner”<\/font><\/p>\n

objReg.EnumValues HKEY_LOCAL_MACHINE, strKeyPath, arrValues, arrTypes<\/font><\/p>\n

The EnumValues method takes several parameters: the registry hive to connect to (I’m using a constant value), the registry path, and two variables for the output. The first will store all values found in the registry path and the second will store the type of each value. This is important.<\/p>\n

Registry keys can be of different types such as REG_SZ. You need to know the type so you can call the appropriate method. There are different methods depending on the type. The types returned will be numeric so I prefer to use constants<\/p>\n

Const REG_SZ = 1
\nConst REG_EXPAND_SZ = 2
\nConst REG_BINARY = 3
\nConst REG_DWORD = 4
\nConst REG_MULTI_SZ = 7<\/font><\/p>\n

You’ll see how I use these in a moment.<\/p>\n

Suppose I determine that the key I want to read is a string, then I’ll need to use a line like this:<\/p>\n

objReg.GetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue<\/font><\/p>\n

The last parameter,I’m using strValue, is the variable that will hold the method’s result. All that’s left at this point is to display the contents of strValue<\/p>\n

wscript.echo strValue<\/font><\/p>\n

I’ve created a VBScript you can use to make the whole process a little easier (it is also attached as a text file).<\/p>\n

’ NAME: ReadRegistry.vbs
\n’ VERSION: 1.0 2\/7\/2008
\n’ AUTHOR: Jeffery Hicks jhicks@sapien.com
\n’ USAGE: cscript ReadRegistry [\/s:computername] <\/font><\/p>\n

’ DESCRIPTION: Use the WMI registry provider to read a remote
\n’ registry key value. If you don’t specify a computer name the script
\n’ will default to localhost. <\/font><\/p>\n

‘ *********************************************************************************
\n‘ * THIS PROGRAM IS OFFERED AS IS AND MAY BE FREELY MODIFIED OR ALTERED AS *
\n‘ * NECESSARY TO MEET YOUR NEEDS. THE AUTHOR MAKES NO GUARANTEES OR WARRANTIES, *
\n‘ * EXPRESS, IMPLIED OR OF ANY OTHER KIND TO THIS CODE OR ANY USER MODIFICATIONS. *
\n‘ * DO NOT USE IN A PRODUCTION ENVIRONMENT UNTIL YOU HAVE TESTED IN A SECURED LAB *
\n‘ * ENVIRONMENT. USE AT YOUR OWN RISK. *
\n‘ ********************************************************************************* <\/font><\/p>\n

On Error Resume Next <\/font><\/p>\n

Const HKEY_LOCAL_MACHINE = &H80000002
\nConst REG_SZ = 1
\nConst REG_EXPAND_SZ = 2
\nConst REG_BINARY = 3
\nConst REG_DWORD = 4
\nConst REG_MULTI_SZ = 7 <\/font><\/p>\n

‘the registry path to query
\nstrKeyPath =”Software\\Microsoft\\Windows NT\\CurrentVersion”
\n‘the registry key value to get
\nstrValueName=”RegisteredOwner” <\/font><\/p>\n

If WScript.Arguments.Named.Exists(“S”) Then
\nstrComputer=UCase(WScript.Arguments.Named.Item(“S”))
\nElse
\nstrComputer = “LOCALHOST”
\nEnd If <\/font><\/p>\n

Set objReg=GetObject(“winmgmts:{impersonationLevel=impersonate}!\\” &_
\nstrComputer & “\\root\\default:StdRegProv”)
\nIf Err.Number 0 Then
\nstrMsg=”There was a problem connecting to ” &_
\nstrComputer & “\\root\\default:StdRegProv” & VbCrLf &_
\n“Error ” & Err.Number & ” ” & Err.description
\nWScript.Echo strMsg
\nWScript.Quit
\nEnd If
\nobjReg.EnumValues HKEY_LOCAL_MACHINE, strKeyPath, arrValues, arrTypes
\nFor x=0 To UBound(arrValues)-1
\nif Ucase(arrValues(x)) = UCase(strValueName) Then <\/font><\/p>\n

Select Case arrTypes(x)
\nCase REG_SZ
\nobjReg.GetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue
\nCase REG_EXPAND_SZ
\nobjReg.GetExpandedStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue
\nCase REG_BINARY
\nobjReg.GetBinaryValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue
\nCase REG_DWORD
\nobjReg.GetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue
\nWscript.Echo
\nCase REG_MULTI_SZ
\nobjReg.GetMultiStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue
\nEnd Select
\nEnd If <\/font><\/p>\n

Next <\/font><\/p>\n

If VarType(strValue)=0 Then
\nWScript.Echo “Failed to get a value for ” & strKeyPath & strValueName &_
\n” on ” & strComputer & “. Check your registry keys and permissions.”
\nElse
\nIf IsArray (strValue) Then
\nWScript.Echo strComputer & ” – ” & strValueName
\nFor Each value In strValue
\nWScript.Echo value
\nNext
\nElse
\nWScript.Echo strComputer & ” – ” & strValueName & ” = ” & strValue
\nEnd If
\nEnd If <\/font><\/p>\n

‘EOF<\/font><\/p>\n

You’ll need to edit the file for the registry path and key that you want to read. HKLM is really the only remote hive you can read. The script can take a computer name as a run time parameter:<\/p>\n

cscript readregistry \/s:server01<\/font><\/p>\n

If you don’t specify a computer name the script will default to Localhost.<\/p>\n

The script connects to the remote registry and enumerates all values in the specified path. It then enumerates the collection (arrValues) looking for the value that matches the specified key<\/p>\n

For x=0 To UBound(arrValues)-1
\nif Ucase(arrValues(x)) = UCase(strValueName) Then<\/font><\/p>\n

If it is found, the script checks the data type using a Select Case statement<\/p>\n

Select Case arrTypes(x)
\n<\/font><\/p>\n

Depending on the case, the appropriate method is called to read the value:<\/p>\n

Case REG_SZ
\nobjReg.GetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue
\nCase REG_EXPAND_SZ
\nobjReg.GetExpandedStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue
\nCase REG_BINARY
\nobjReg.GetBinaryValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue
\nCase REG_DWORD
\nobjReg.GetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue
\nWscript.Echo
\nCase REG_MULTI_SZ
\nobjReg.GetMultiStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue
\n<\/font><\/p>\n

At this point all that remains is to display the result. It is possible that the value might be an array as in the case of a multi-string or binary value so I’ll have to check for that and handle it accordingly:<\/p>\n

If IsArray (strValue) Then
\nWScript.Echo strComputer & ” – ” & strValueName
\nFor Each value In strValue
\nWScript.Echo value
\nNext
\nElse
\nWScript.Echo strComputer & ” – ” & strValueName & ” = ” & strValue
\nEnd If<\/font>
\nMy output is pretty simple, but obviously you could do what ever you wanted with it.<\/p>\n

That’s it for now. I have one more idea to explore on this topic so stay tuned.<\/p>\n

Technorati Tags: <\/span>Registry<\/span><\/a>, <\/span>VBScript<\/span><\/a>, <\/span>WMI<\/span><\/a>, <\/span>StdReg<\/span><\/a>, <\/span>Scripting<\/span><\/a><\/div>\n","protected":false},"excerpt":{"rendered":"

Last week I blogged about using REG.EXE in a batch file to read a registry key. The batch file I provided works, but the output is limited. You could probably parse it a bit more to get it in some other format. But I’d probably turn to VBScript and WMI if I wanted better output control or if I had more complicated needs.<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[24],"tags":[59,31,36,57,58,996,35],"class_list":["post-10","post","type-post","status-publish","format-standard","hentry","category-vbscript","tag-hklm","tag-registry","tag-remote","tag-scripting","tag-stdregprov","tag-vbscript","tag-wmi"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts\/10","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/comments?post=10"}],"version-history":[{"count":0,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts\/10\/revisions"}],"wp:attachment":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/media?parent=10"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/categories?post=10"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/tags?post=10"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}