Registry search

Anything VBScript-related, including Windows Script Host, WMI, ADSI, and more.
Forum rules
Do not post any licensing information in this forum.

Any code longer than three lines should be added as code using the 'Select Code' dropdown menu or attached as a file.
User avatar
fr3288
Posts: 23
Joined: Sun Jan 28, 2007 1:37 am

Registry search

Post by fr3288 »

Hello:

I'm trying to do a search in the registry. The script looks at the DisplayName key of every registry folder looking for a specific word, in this case KB951808.

The script works fine but is able to find the target only one level down of the given registry folder. For some reason recursion is not working. The target is found when I specified the folder as this:

strKey = "SOFTWAREMicrosoftWindowsCurrentVersion" _ & "InstallerUserDataS-1-5-18Products" _ & "00002109110000000000000000F01FECPatches"

But it does not find it if I specify a folder higher in the herarchy:

strKey = "SOFTWAREMicrosoftWindowsCurrentVersion" _ & "InstallerUserDataS-1-5-18Products"

This is to search for the existance of MS Office patches since they don't show up under the Uninstall folder of the registry. They show up in different levels under the InstallerUserData folder.

Here is the script:

Const HKLM = &H80000002strComputer = "."Patch1 = "KB951808"strKey = "SOFTWAREMicrosoftWindowsCurrentVersion" _ & "InstallerUserDataS-1-5-18Products" strEntry1a = "DisplayName"

Set objReg = GetObject("winmgmts:" _ & strComputer & "rootdefault:StdRegProv")

ListSubKeys HKLM, strKey

Sub ListSubKeys(HKLM, strKey) objReg.EnumKey HKLM, strKey, arrSubkeys
If IsArray(arrSubkeys) Then
For Each strSubkey In arrSubkeys objReg.GetStringValue HKLM, strKey & strSubkey, strEntry1a, strValue1 If InStr(1,strValue1,Patch1,vbTextCompare) Then KBDesc = strValue1 WScript.Echo KBDesc End If Next End IfEnd Sub

Another issue that I see is when I try to put this code inside a For - Next loop. It gives a Syntax error message.

Thanks in advance for any help you can give.

FR

User avatar
jhicks
Posts: 1789
Joined: Sun Jan 21, 2007 11:31 pm

Registry search

Post by jhicks »

Are you searching 32bit or 64bit systems?

User avatar
jhicks
Posts: 1789
Joined: Sun Jan 21, 2007 11:31 pm

Registry search

Post by jhicks »

Rats. I thought I had this figured out. Your enumeration code is essentially fine. On x64 systems the keys you are searching can get you redirected to a 32bit version of the hive. On my x64 box running Vista if I use the 64 bit version of CSCRIPT I can enumerate the subkeys but not using the 32 bit version. However, I think the issue is that you aren't enumerating recursively which I think you originally asked about. let me take another look.

jvierra
Posts: 14578
Joined: Tue May 22, 2007 9:57 am
Answers: 1
Been upvoted: 1 time
Contact:

Registry search

Post by jvierra »

Jeff - I think you forgot to enum the values

If isArray(arrValues) Then objReg.GetStringValue HKLM, strKey & "" & strSubkey, strEntry1a, strValue1

User avatar
fr3288
Posts: 23
Joined: Sun Jan 28, 2007 1:37 am

Registry search

Post by fr3288 »

I just tried it again in both local and remote PCs and worked. I may had done an error with the copy - paste of your previos post.
My other question is about using this inside a For - Next loop since inside this loop is the instruction to connect to PCs member of an Active Directory group.
The script works perfectly by checking non Office patches found under the Uninstall registry folder since no recursion is done because it is checking only one level down of the folder.
Now I want to include this code so I can check Office patches and it gives a Syntax error message. It's like Sub - End Sub does not work along with For - Next. Any suggestions?
Thanks again.
FR

jvierra
Posts: 14578
Joined: Tue May 22, 2007 9:57 am
Answers: 1
Been upvoted: 1 time
Contact:

Registry search

Post by jvierra »

Here is a good method to get recursion to work from teh top down:

Code: Select all

Const REG_SZ = 1
Const REG_EXPAND_SZ = 2
Const REG_BINARY = 3
Const REG_DWORD = 4
Const REG_MULTI_SZ = 7
Const HKLM = &H80000002
Const HKEY_CLASSES_ROOT = &H80000000
Const HKEY_CURRENT_USER = &H80000001
Const HKEY_LOCAL_MACHINE = &H80000002
Const HKEY_USERS = &H80000003
Const HKEY_CURRENT_CONFIG = &H80000005
Const HKEY_DYN_DATA = &H80000006
 
' Driver code.
Dim objReg : Set objReg = GetObject("winmgmts:.rootdefault:StdRegProv") 
ReturnValue = ListSubKeys( HKEY_LOCAL_MACHINE, "SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Products", "DisplayName", "KB403742")
WScript.Echo ReturnValue
' Function to retrieve specified match value
Function ListSubKeys(iKey, strKey, sKeyLookup, sKeyContent)
    objReg.EnumKey HKLM, strKey, arrSubkeys
    If IsArray(arrSubkeys) Then
        For Each strSubkey In arrSubkeys
            objReg.EnumValues HKLM,strKey & "" & strSubkey,arrValues,arrTypes
            If isArray(arrValues) Then
                For i = 0 To Ubound(arrValues)
                    Select Case arrTypes(i)
                        Case REG_SZ 
                            If arrValues(i) = sKeyLookup Then
                                objReg.GetStringValue HKLM, strKey & "" & strSubkey, arrValues(i), strValue1
                                If InStr(strValue1, sKeyContent) Then 
                                    'WScript.Echo "REG_SZ[ & arrValues(i)  & ]" & "[ & strValue1 & ]"
                                    ListSubKeys = strValue1
                                    Exit Function ' we got teh match so return with it
                                End If
                            End If
                        Case Else ' only interested in strings right now
                        'WScript.Echo  arrTypes(i)
                    End Select
                Next
            End If
            ListSubKeys = ListSubKeys( iKey, strkey & "" & strSubKey, sKeyLookup, sKeyContent)
            If Not IsEmpty( ListSubKeys ) Then
                Exit Function
            End If
        Next
        
    End If
End Function

This allows all info to be returned from the function. It is very fast.

To loop a set of PCs dor the following

Code: Select all

Driver code.
aComputers = Array( "omega2","omega2","comp3")
For Each comp In aComputers
    Dim objReg : Set objReg = GetObject("winmgmts:" & comp & "rootdefault:StdRegProv") 
    ReturnValue = ListSubKeys( HKEY_LOCAL_MACHINE, "SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Products", "DisplayName", "KB403742")
    WScript.Echo comp & " Has " & ReturnValue & " installed/no installed"
Next

User avatar
fr3288
Posts: 23
Joined: Sun Jan 28, 2007 1:37 am

Registry search

Post by fr3288 »

Thanks for these examples. I was looking at them to see if I can use the same to incorporate the code you helped me fix with what I already have. Right now I don't know how to incorporate it.

Anyway, I have attached my script and I added the code. I hope you don't mind taking a look at it to see why it gives a Syntax error one line 213.

The code was added from lines 204 to 237 where it says "inserted code". It is just under one of the patches that the script checks.

The only thing that I have not included is the name of the AD security group that the PCs are member of (line 25).

I think this script will be helpful for others to use so once is done I will post it in the Script Sharing section of the site for the benefit of everybody.

Thanks again for your help.

FR

User avatar
fr3288
Posts: 23
Joined: Sun Jan 28, 2007 1:37 am

Registry search

Post by fr3288 »

I'm still trying to make this work. I put Vierra's function on top of the script and called the function inside the For - Next loop as he suggested
Dim objReg : Set objReg = GetObject("winmgmts:" & strComputer & "rootdefault:StdRegProv")
ReturnValue = ListSubKeys( HKEY_LOCAL_MACHINE, "SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Products", "DisplayName", "KB403742")WScript.Echo comp & " Has " & ReturnValue & " installed/no installed"
When I run the script the first PC it finds is checked without problems but then I get the following error:
Error number: -2147352563
Error description: Memory is locked.
Error source: SWbemObjectEX

Any suggestions?

Thanks again.

jvierra
Posts: 14578
Joined: Tue May 22, 2007 9:57 am
Answers: 1
Been upvoted: 1 time
Contact:

Registry search

Post by jvierra »

Here is a copy that I have made some changes to.

I am forcing teh WMI object to be created on each call to the function since that is better for what you are doing. I also check for teh "not found" condition to prevent nul cat errors.

I can't test this as it is not subroutined well enough to do incremental tests. You stilldind't tell me what line the error was on.

jvierra
Posts: 14578
Joined: Tue May 22, 2007 9:57 am
Answers: 1
Been upvoted: 1 time
Contact:

Registry search

Post by jvierra »

Line 33 looks like you have a bad computer name in teh batch.

You need to st3ep through with the debugger to detect that. DO NOT USE ON Error Resume Next until you resolve this issue.

Locked