Editing a remote registry

[JPJeffery]

Following on from an earlier thread, I've written a function that writes a Local GPO entry to a remote registry.

Although the VBScript code does what it's meant to the remaining problem is that what it's writing isn't always being correctly interpreted as valid data so the target PC doesn't recognise that it has a Local GPO at all.

The issue seems to the ExecTime value. I'm using the VBScript objWSHShell.Run to run reg.exe (I couldn't get RegWrite to write to a remote PC) and that seems to work just fine except when it comes to entering Hex data for the ExecTime value. Specifically, part of the problem is that this value is a REG_QWORD for which REG.EXE doesn't have an option.

What I'd like the value to be is

"ExecTime"=hex(b):00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00"

but specifying a data value of 0 when using the REG_NONE, REG_DWORD or any other RegKey data type (apart from REG_SZ) option does not populate the value with 0!

So, to get round this I've tried copying the equivalent value from a pre-existing GPO on the same PC but even that doesn't seem to always work.

I expect you'll be wanting to see some code (to laugh at). Here are the two functions that do the work:

Function EditRegistry(strTargetPC,strTargetAccount)
    strDestFolder = "\\" & strTargetPC & strGPOLocalPath & "\"
    strDestFolderShort = "\\" & strTargetPC & strGPOLocalPath
    'wscript.echo "Checking for " & strDestFolderShort
    if not objFSO.FolderExists(strDestFolderShort) then
    '    wscript.echo "Can't find " & strDestFolderShort & " so will create it."
        strFolderExists = MakeDir(strDestFolderShort)
    Else
        strFolderExists = True
    End if
'    strFolderExists = FALSE
'    wscript.echo "strFolderExists = " & strFolderExists
    if strFolderExists = False then
        strErrorMsg = "The folder " & strDestFolderShort & " couldn't be found or created." & vbCrLf & vbCrLf & "Quitting."
        QuitOut()
    End If
    objFSO.CopyFile strGPOScript , strDestFolder, TRUE
' wscript.quit

' First we need to copy the existing registry entry on the target machine from 0 to 1 (as local GPOs get processed first)
    strRegCopyCommandFIRST = strCopyRegCommandBASE & strTargetPC & strCopyRegCommandMID & strTargetPC & strCopyRegCommandEND
    wscript.echo "objWSHShell.Run (" & strRegCopyCommandFIRST & ",1,true)"
    strReturn = objWSHShell.Run (strRegCopyCommandFIRST,1,true)
    if strReturn >0 then
        wscript.echo "strReturn in EditTheRegistry = " & strReturn
    End If

' Now we can create the local GPO entries (apart from ExecTime which proved to be too much of a pain to create programmatically)
    i = 0
    Do Until objRegistryFileName1.AtEndOfStream
       ' wscript.echo "------------------------------------------------------------------------------------------------------------------------------------------------"
        strNextLine = objRegistryFileName1.Readline
        arrFileLines = split(strNextLine,"=") '.ReadLine
        if i < 1 then
            strRegCommandBASE = "reg add ""\\" & strTargetPC & "\" & arrFileLines(0) & """ /v "
            i = i + 1
        else
            strValue = arrFileLines(0)
            strData = arrFileLines(1)
            'i = i + 1
            call AddRegData(strRegCommandBASE,strValue,strData)
        end if
    Loop
    objRegistryFileName1.Close

    i = 0
    Do Until objRegistryFileName2.AtEndOfStream
        strNextLine = objRegistryFileName2.Readline
        arrFileLines = split(strNextLine,"=") '.ReadLine
        if i < 1 then
            strRegCommandBASE = "reg add ""\\" & strTargetPC & "\" & arrFileLines(0) & """ /v "
            i = i + 1
        else
            strValue = arrFileLines(0)
            strData = arrFileLines(1)
            call AddRegData(strRegCommandBASE,strValue,strData)
        end if
    Loop
    objRegistryFileName2.Close

End Function
'==================================================================================================================================================
Sub AddRegData(strRegCommandBASE,strValue,strData)
    if strValue = "ExecTime" then
        strRegCommand = strRegCommandBASE & strValue & " /t REG_NONE /d """ & strData & """ /f"' strUserName & """"
    Else
        strRegCommand = strRegCommandBASE & strValue & " /t REG_SZ /d """ & strData & """ /f"' strUserName & """"
    End If
    
    strReturn = objWSHShell.Run (strRegCommand,1,true)
    if strReturn >0 then
        wscript.echo "strReturn in AddRegData = " & strReturn
    End If
End Sub

Contents of objRegistryFileName1:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup\0
GPO-ID=LocalGPO
SOM-ID=Local
FileSysPath=C:\WINNT\System32\GroupPolicy\Machine
DisplayName=Local Group Policy
GPOName=Local Group Policy

]Contents of objRegistryFileName2:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup\0\0
Script=RenameFolder.vbs
Parameters=VimesS

Any suggestions will be much appreciated.

JJ
[small][purple]Variables won't. Constants aren't[/purple][/small]

 

[tsuji]

>strReturn = objWSHShell.Run(strRegCopyCommandFIRST,1,true)
This line means run the command on the local m/c to the script, _not_ on the remote m/c.

Get the sysinternals.com's psexec.exe to run it on the remote m/c.

I make no representation on the rest.

 

[JPJeffery]

No, the strRegCopyCommandFIRST variable is made up of

strCopyRegCommandBASE & strTargetPC & strCopyRegCommandMID & strTargetPC & strCopyRegCommandEND

which in turn is made up of

strCopyRegCommandBASE 
 = "reg copy ""\\"
strTargetPC
  = the remote PC hostname
strCopyRegCommandMID 
  = "\HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup\0"" ""\\"
strTargetPC
  = the remote PC hostname (again)
strCopyRegCommandEND 
  = "\HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup\1"" /s /f"

which expands in to

reg copy "\\PC001\HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup\0" "\\PC001\HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup\1" /s /f,1,true)

The bottom line is, I know that line of the vbscript is working because the registry key does get copied as intended from Startup\0 to Startup\1.

JJ
[small][purple]Variables won't. Constants aren't[/purple][/small]

 

[tsuji]

Okay, maybe you are right. Just not spent too much time on it.