Home > Enterprise >  Issue retrieving "(Default)" string values from remote registry key
Issue retrieving "(Default)" string values from remote registry key

Time:12-08

Thank you for reading.

"HKLM\SOFTWARE\Classes\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0\Win32"

has a single "(Default)" String Value showing the path to the MS Office MSO.dll:

i.e.: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\MSO.DLL

I was having trouble retrieving that string value into a $KEY_VAL variable using this..

$Reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey("LocalMachine", $COMPUTER)
$RegKey = $Registry.OpenSubKey("SOFTWARE\Classes\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0\Win32")
$KEY_VAL = $RegKey.getvalue("(Default)")
"$KEY_VAL"

But, if I create a fake String value in same location (i.e. "TEST") I can retrieve it without issue.

$Reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', $COMPUTER)
$RegKey = $Reg.OpenSubKey("SOFTWARE\\Classes\\TypeLib\\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\\2.8\\0\\Win32")
$KEY_VAL = $RegKey.GetValue("TEST")
"$KEY_VAL"
C:\My\fake\path

I tried experimenting with various kinds of quotes, back-ticking etc.

Similarly this:

foreach ($KEY in $RegKey.GetValueNames()){
$KEY
}

TEST

... only lists my newly created "TEST" key, not the "(Default)" key.

The workaround I`ve used (as there is normally only the single "(Default)" key) is to do this:

foreach ($rVALUE in $RegKey.GetValueNames()){
$KEY_VAL = $RegKey.getvalue($rVALUE)
"$KEY_VAL"
}

Which also works for setting a new value for that "(Default)" key..

$RegKey = $Registry.OpenSubKey("$REG_KEY",$TRUE)
foreach ($rVALUE in $RegKey.GetValueNames()){
$ValueData = "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\MSO.DLL"
$RegKey.SetValue($rVALUE,$ValueData, [Microsoft.Win32.RegistryValueKind]::String)
}

My question is, have I missed a simple issue of appropriately escaping the key name (as it contains braces), or is it just really difficult to work with these "(Default)" keys? Is it a weird MS thing where it looks a certain way on screen but is stored differently?

CodePudding user response:

To Get the default key value use empty quotes, like this $RegKey.Getvalue("")

$Reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey("LocalMachine", $env:COMPUTERNAME)
$RegKey = $Reg.OpenSubKey("software\Classes\TypeLib\{00000205-0000-0010-8000-00AA006D2EA4}\2.5\0\win32")
$KEY_VAL = $RegKey.GetValue("")

$KEY_VAL
C:\Program Files (x86)\Common Files\System\ado\msado25.tlb
  • Related