[Excel] VBA and Registry Windows 7 Pro 64 bit.. a trick I am missing.

[Putertechn]

I manage a few kiosk style machines, network restricted and with all the protections we can heap on them.. well, they are all autologon, so have a user name and password in the registry. Unders windows XP I had no problem with reading the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon and the sub keys DefaultUserName and Default Password. and then even writing back a new password from my Excel list of machine and accounts.. but I have discovered that even though I read the above key, it seems that the StdRegProv is actually reading HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon.. and even on the Windows 7 machines, the values in use are in the first location.

The code I am using, right now just to read the values, is:

Const HKEY_LOCAL_MACHINE = &H80000002
Defpwd = "DefaultPassword"
Defname = "DefaultUserName"
On Error Resume Next
For a = 2 To 501
Cells(1, 12) = a
strhostname = Cells(a, 1).Value
Debug.Print strhostname
Call ResolveIP(strhostname)
If strhostname <> "Unreachable" Then
strhostname = Cells(a, 1).Value
Set objReg = GetObject("winmgmts:\\" & strhostname & "\root\default:StdRegProv")
strKeyPath = "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
objReg.GetStringValue HKEY_LOCAL_MACHINE, strKeyPath, Defpwd, strValue1
Debug.Print strValue1
objReg.GetStringValue HKEY_LOCAL_MACHINE, strKeyPath, Defname, strValue2
Debug.Print strValue2
Cells(a, 8).Value = strValue1
Cells(a, 9).Value = strValue2
strValue1 = ""
strValue2 = ""
Else: Cells(a, 8) = "Unreachable"
End If
Next a

It actually specifies the correct location, but in Windows 7 it defaults to the second location. I am reasonably sure of this as I have gone in with Regedit and applied the settings to the WOW6432Node location and then this existing script "finds" the values. But changing the password in the Wow6432Node location does not get the password applied to the location that is read out in the autologon operation.

Anyone have any idea on how to get it to read out the right set of keys?

I have tried a lot of code pieces I have found on the internet, and so far they don't get me where I need to be.

[Putertechn]

Oh, some things you might need to know....

cells(1, 12) is just so I can keep track of progress of execution

resolve(IP) is basically a ping command, see if the machine is online before we try reading/righting to it

[westconn1]

is your script running with elevated permissions?
i would guess, it would need to, hard to do with vba, unless you run excel elevated

[Putertechn]

is your script running with elevated permissions?
i would guess, it would need to, hard to do with vba, unless you run excel elevated

Actually, yes, my account is a domain admin level account, I can use regedit, Connect Network Registry to connect to most any machine in the domain to edit the registry manually.. But with 500 machines, I would rather not do that, since I need to coordinate the change with the server guys.. best if we both have a script, and run them at the same time.. then reboot the kiosk machines.. hence my efforts here.. may have to just use the VBA to generate an external script and run it.. but I like doing it within Excel as I can have it mark the ones that it has done in a cell, and not the ones that do not respond.. I know what I have to catch again later.

When I did this last time, all machines were XP.. did the read, verified the machine had an old password, and then wrote the new password for that machine to the registry key..

Right now I am only working with the read portion because I found I can still read the XP.. but not the list path on the Windows 7. If I manually install the information in the wow6432Node side of things, then the script reads the right data, but that is the wrong location as the listed path is the one the system reads on an autologon. The wonders of windows 7, eh?

[westconn1]

Actually, yes, my account is a domain admin level account

this is different from running programs elevated, even when logged in as admin

[Putertechn]

this is different from running programs elevated, even when logged in as admin

I follow what you are saying, and in this case it makes no difference. And the account the remote machine sees is my admin account. I can read it, so the script is working, it is doing what it is just reading the wrong one... If I go in and put the same entries in the WOW6432Node path for WINLOGON as in the normal path, then it returns those values. The problem is that the system reads the HKLM\Software\Microsoft path at boot up for autologon, not the WOW6432Node path.. so changing them in that path would not accomplish my needs.

I do not know why it is being redirected. I had read that they had stopped automatic redirection of the registry.. I looked in the about Excel to see if there was any indication that the application was 32 bit running under the 64 bit OS, but it tells me the OS is 64 bit, but no mention of the application.. maybe the remote registry is detecting it as a 32 bit and redirecting it?

I just did not want to have to do something like export my machine list to a cmd file and insert the commands to make the change, verify the change, write to a log try again if not set to what I expect, rinse and repeat until you get what you want. Then compare the log file to the spreadsheet to see if they were changed or not..

And this is not the only time I have to make these kinds of changes to a list.. it would always be nice if I had my script working, just put the list in a spreadsheet with the current and new info in cells and let'er rip.. But the best laid plans.. M$ can always find a way to make it harder to do, not easier..

Don't get me wrong, Thanks for your effort! Even if we don't come up with a solution, it is the thought that counts, eh?

[westconn1]

I do not know why it is being redirected

this is virtulization, it works both with protected folders and parts of the registry, as part of UAC (user access control in vista and later)
if the script is not elevated, the virtulization is used when reading parts of the registry

you should at least try running an elevated script, to see what the result is