1

I'm attempting to read a specific subkey within the HKCR\CLSID\ subkey. {04271989-C4D2-####-####-############}

I put # for the values that can differ from user to user. This CLSID is related to the OneDrive client. I want to read, and change the DWORD. Through some google work, I put together the following code.

    const HKEY_CLASSES_ROOT = &H80000000
    const REG_PATH = "CLSID\"
    const ONEDRIVE_MASK = "{04271989-C4D2-*"
    
    dim re: set re = New RegExp
    re.IgnoreCase = True
    re.Global = True
    re.Pattern = ONEDRIVE_MASK
    
    dim oReg: set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")
    oReg.EnumKey HKEY_CLASSES_ROOT, REG_PATH, arrSubKeys
    Set WshShell = CreateObject( "WScript.Shell" )
    dim intValue
    dim intCnt
    
    for each subkey In arrSubKeys
        if re.test(subkey) then
           oReg.GetExpandedStringValue HKEY_CLASSES_ROOT, REG_PATH & subkey, "System.IsPinnedToNameSpaceTree", intValue
           WScript.Echo "CLSID Value: " & subkey
           WScript.Echo "System.IsPinnedToNameSpaceTree Value: " & intValue
           'WshShell.RegWrite "HKCR" & REG_PATH & subkey & "\System.IsPinnedToNameSpaceTree", 1,"REG_DWORD"
        end if
    next

The result is that the (subkey) I'm looking for is never found. I modified the script to just output all the subkeys it could see, and then compared that list to an export of the CLSID registry, which I then scrubbed to only show the list of subkeys within one level below CLSID. The total list was over 7800 entries, with the following list of subkeys found in the export, but not visible to the vbscript.

{00425F68-FFC1-445F-8EDF-EF78B84BA1C7}  
{018D5C66-4533-4307-9B53-224DE2ED1FE6}  
{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}  
{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}  
{20894375-46AE-46E2-BAFD-CB38975CDCE6}  
{2DAEC322-90B2-47E4-BB08-0DA841935A6B}  
{389510b7-9e58-40d7-98bf-60b911cb0ea9}  
{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}  
{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}  
{5AB7172C-9C11-405C-8DD5-AF20F3606282}  
{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}  
{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}  
{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}  
{8F3C945C-4222-45BD-BFFF-3B1A67BE13E3}  
{917E8742-AA3B-7318-FA12-10485FB322A2}  
{94269C4E-071A-4116-90E6-52E557067E4E}  
{9489FEB2-1925-4D01-B788-6D912C70F7F2}  
{9AA2F32D-362A-42D9-9328-24A483E2CCC3}  
{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}  
{A78ED123-AB77-406B-9962-2A5D9D2F7F30}  
{A926714B-7BFC-4D08-A035-80021395FFA8}  
{BBACC218-34EA-4666-9D7A-C78F2274A524}  
{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}  
{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}  
{CBDC4B31-CBE4-4A5B-BECF-64B29E47D2AD}  
{d1b22d3d-8585-53a6-acb3-0e803c7e8d2a}  
{D39E7BDD-7D05-46b8-8721-80CF035F57D7}  
{ED81C073-1F84-4ca8-A161-183C776BC651}  
{F241C880-6982-4CE5-8CF7-7085BA96DA5A}  

Some more internet searches I came across people talking about 64bit vs 32 bit registry entries. I have seen registry subkeys that reference the 64vs32.

Example: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node

But the concept of there being some registry entries that are 32bit that can't be read by 64 bit, and the inverse.... is new to me. Is there actually such a thing, or am I misreading what I've seen? If it is a thing, do such differences exist within HKCR? and... how can you tell the difference?

If I'm wrong, what could the problem be in vbscript being able to see the above entries?

JamesA
  • 115
  • 2
  • 10
  • 2
    Have you tried running your script from an elevated (Administrator:) Cmd prompt? – LesFerch Oct 02 '21 at 01:04
  • 1
    Does this answer your question? [How to run vbs as administrator from vbs?](https://stackoverflow.com/questions/17466681/how-to-run-vbs-as-administrator-from-vbs) – user692942 Oct 04 '21 at 11:40
  • Running the script from an elevated command prompt produces the same result. It still doesn't see the identified subkeys. – JamesA Oct 04 '21 at 14:51
  • I have also done comparisons on the permissions for subkeys the script can see and subkeys it can't. I don't see any difference. – JamesA Oct 04 '21 at 15:17
  • Could anyone run the script against their own registry to see if this is common? Add the following lines Add the following before current line 10 outFile=".\OneDriveScriptOutput.txt" Add the following after current line 14 objFile.Write subkey & vbCrLf Add the following at the end of the script objFile.Close Compare that list, to an export from the clsid of the registry. 1. Sort all entries, so all the {clsid entry} are grouped together. 2. Delete all the records that don't start with "{" 3. Add a FIND("]", A1:A25000) 4. Sort by new column 5. Remove all entries that find "]" – JamesA Oct 04 '21 at 15:24
  • Found the following that does confirm some CLSIDs are 64bit while others are 32bit. Now I just need to find how to change my script, unsure if I'm currently seeing 32bit or 64bit, but likely looking at the 32bit. https://stackoverflow.com/questions/58969428/hkey-classes-root-clsid-not-all-subkeys-are-retrieved-cant-find-my-classid – JamesA Oct 04 '21 at 15:47
  • @JamesA It follows the same pattern. On a 64-bit OS, the 32-bit keys are stored in `HKEY_CLASSES_ROOT\WOW6432Node`. – user692942 Oct 05 '21 at 11:48
  • @user692942 then I'm at a loss as to why a very small set of subkeys can't be read by vbscript, when they aren't located within a subkey structure that would mark them as different.... – JamesA Oct 05 '21 at 14:16

1 Answers1

2

Came to realize why I was having all the difficulties. The list of CLSIDs I provided are all User Defined settings. This had me look in the HKCU portion of the registry to then discover all the "special" CLSIDs I couldn't find in HKCR. The problem was that those registry entries didn't exist within the CLASSES_ROOT, they were just being displayed there visually, even though you can also export them from there. So with a slight change to the script.

    const HKEY_CURRENT_USER = &H80000001
const REG_PATH = "SOFTWARE\Classes\CLSID\"
const ONEDRIVE_MASK = "{04271989-C4D2-*"

Set objFSO=CreateObject("Scripting.FileSystemObject")
dim re: set re = New RegExp
re.IgnoreCase = True
re.Global = True
re.Pattern = ONEDRIVE_MASK

dim oReg: set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")
oReg.EnumKey HKEY_CURRENT_USER, REG_PATH, arrSubKeys
Set WshShell = CreateObject( "WScript.Shell" )
dim intValue

for each subkey In arrSubKeys
    if re.test(subkey) then
       oReg.GetDWORDValue HKEY_CURRENT_USER, REG_PATH & subkey, "System.IsPinnedToNameSpaceTree", intValue
       WshShell.RegWrite "HKCU\" & REG_PATH & subkey & "\System.IsPinnedToNameSpaceTree", 0,"REG_DWORD"
    end if
next
JamesA
  • 115
  • 2
  • 10