Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions

Windows Registry Key/Value Date Created/Date Modified Time Stamp and other Registry Questions

Posted on 2009-05-04
Last Modified: 2013-12-03
Question 1 (the toughest I believe)
I thought that I saw somewhere the information when a Registry Key or Value was added to the Registry Database or when it was Modified. I know that you cannot see that in the Windows Registry Editor. Is there a way to find that out?

Or is this information not even stored in the Registry Database Files themselves and also not in any other DB of Windows that could be accessed. WMI comes into my mind.
Question 2
How can I determine using VBScript what the Data Type of a Registry Value is? Important to me are subtle differences like REG_SZ, REG_EXPAND_SZ or REG_MULTI_SZ. The functions of the Windows Script Host do not provide that information. For them String is String, but it makes a big difference for the Registry. Following this question, how can I create a value with VBScript with the data type REG_MULTI_SZ. The WshShellObject (WScript.Shell) reference for RegWrite method explicitly states that writing Multi String values is not supported by WSH.

Question 3.
How can I open and the read, write or delete keys and values from a registry file that is not a registry database file from my own operating system, for example the registry of a system that crashed and where I booted from a boot disk with file access to that system and would like to use some scripts for extracting or inserting data for data recovery purposes and/or to may be fix what causes the system to crash.

I know that you can somehow load registry files into your own system registry (although I don't know how that actually works) with different Key and Hive names. I saw some tools doing it, but I would like to do it myself and be able to write my own scripts to have the flexibility that I need.

VBScript Code samples or links to them would be appreciated. Thanks

I will reward 200 points full answers of the first question and 150 points each for the 2nd and 3rd question. If you are able to answer all three, you will get the full 500 points.

'WSH RegWrite Method
Set WshShell = WScript.CreateObject("WScript.Shell") 
WshShell.RegWrite "HKCU\Software\ACME\FortuneTeller\", 1, "REG_BINARY" 
WshShell.RegWrite "HKCU\Software\ACME\FortuneTeller\MindReader", "Goocher!", "REG_SZ"
'Not Supported Data Type: REG_MULTI_SZ

Open in new window

Question by:Cumbrowski
  • 5
  • 4
LVL 86

Expert Comment

ID: 24296793

'RegQueryInfoKey()' (http://msdn.microsoft.com/en-us/library/ms724902(VS.85).aspx) can do that for keys, but there is no equivalent API to retrieve the creation/modification time of values.


'RegEnumValue()' (http://msdn.microsoft.com/en-us/library/ms724865(VS.85).aspx) allows you to interate through a key's values and also obtain the data type as well as the contents.


That can be done using 'RegLoadKey()' (http://msdn.microsoft.com/en-us/library/ms724889(VS.85).aspx) for a registry file on your machine or 'RegConnectRegistry()' (http://msdn.microsoft.com/en-us/library/ms724840(VS.85).aspx) if you want to read the registry of a remote computer.

Author Comment

ID: 24299207
Thanks JKR,

Half way from how it seems.
I am not a C++ programmer, but all the MSDN articles are for C++.
How can I make use of those in VBScript?

LVL 86

Expert Comment

ID: 24299610
Well, these APIs should be accessible from VBS also - at least they are from any 'managed' languages (or 'regular' VB), so there must be some way...
Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.


Author Comment

ID: 24300730
Not always, but pretty much always differently than with C++ or even VB.NET

I'd would like to give you half the points (250) (for half the overall answer). How do I do that?

Author Comment

ID: 24369806
I was able to figure out the answers for Question 2 and 3 myself. See code samples below.

I have not found an answer for Question 1 yet though. If somebody could translate the C++ stuff to VBScript that would be great. I am referring to this:

'RegQueryInfoKey()' (http://msdn.microsoft.com/en-us/library/ms724902(VS.85).aspx)

Question 2)
Creating Expanded String Values
Uses WMI to create an expanded string value under HKLM\SOFTWARE\System Admin Scripting Guide.
const HKEY_LOCAL_MACHINE = &H80000002
strComputer = "."
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_ 
strComputer & "\root\default:StdRegProv")
strKeyPath = "SOFTWARE\System Admin Scripting Guide"
strValueName = "Expanded String Value Name"
strValue = "%PATHEXT%"
oReg.SetExpandedStringValue _
Uses WMI to list all the registry values and their types 
under HKLM\SYSTEM\CurrentControlSet\Control\Lsa.
const HKEY_LOCAL_MACHINE = &H80000002
const REG_SZ = 1
const REG_EXPAND_SZ = 2
const REG_BINARY = 3
const REG_DWORD = 4
const REG_MULTI_SZ = 7
strComputer = "."
Set StdOut = WScript.StdOut
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_ 
strComputer & "\root\default:StdRegProv")
strKeyPath = "SYSTEM\CurrentControlSet\Control\Lsa"
oReg.EnumValues HKEY_LOCAL_MACHINE, strKeyPath,_
 arrValueNames, arrValueTypes
For i=0 To UBound(arrValueNames)
    StdOut.WriteLine "Value Name: " & arrValueNames(i) 
    Select Case arrValueTypes(i)
        Case REG_SZ
            StdOut.WriteLine "Data Type: String"
        Case REG_EXPAND_SZ
            StdOut.WriteLine "Data Type: Expanded String"
        Case REG_BINARY
            StdOut.WriteLine "Data Type: Binary"
        Case REG_DWORD
            StdOut.WriteLine "Data Type: DWORD"
        Case REG_MULTI_SZ
            StdOut.WriteLine "Data Type: Multi String"
    End Select 
Question 3)
You can attach registry databases from other systems to your own registry (and detach them) with the REG command line command.
Load Registry
REG LOAD KeyName FileName
  KeyName    ROOTKEY\SubKey (local machine only)
             ROOTKEY  [ HKLM | HKU ]
  SubKey   The key name to load the hive file into. Creating a new key
  FileName   The name of the hive file to load
             You must use REG SAVE to create this file
 REG LOAD HKLM\TempHive TempHive.hiv
     Loads the file TempHive.hiv to the Key HKLM\TempHive
  KeyName    ROOTKEY\SubKey (local machine only)
              ROOTKEY  [ HKLM | HKU ]
  SubKey   The key name of the hive to unload
    Unloads the hive TempHive in HKLM
The REG LOAD and REG UNLOAD commands can easily be executed using the RUN method of the WScript.Shell object like:
Dim strCmdLine 
strCmdLine = "REG LOAD HKLM\TempHive TempHive.hiv"
CreateObject("WScript.Shell").Run strCmdLine, 0, True

Open in new window

LVL 86

Accepted Solution

jkr earned 500 total points
ID: 24370119

Author Comment

ID: 24370953
Thanks jkr. The article is interesting in itself, but did not answer question 1.... however.. it refers to an article by the same author that does address that question. See

Reading and Writing Registry Keys with Visual Basic

especially the paragraph "Getting Information about Keys"

Author Closing Comment

ID: 31577617
Not directly answered the remaining question, but pointed (by accident or on purpose) to the right direction, which lead to the actual answer :)
LVL 86

Expert Comment

ID: 24370984
Glad to be of some help - make sure your next Q is more C/C++ related, please ;o)

Featured Post

Free Tool: Postgres Monitoring System

A PHP and Perl based system to collect and display usage statistics from PostgreSQL databases.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

I. Introduction There's an interesting discussion going on now in an Experts Exchange Group — Attachments with no extension (http://www.experts-exchange.com/discussions/210281/Attachments-with-no-extension.html). This reminded me of questions tha…
Deploying a Microsoft Access application in a Citrix environment is not difficult but takes a few steps. However, Citrix system people are often of little help, as they typically know next to nothing about Access. The script provided here will take …
This is Part 3 in a 3-part series on Experts Exchange to discuss error handling in VBA code written for Excel. Part 1 of this series discussed basic error handling code using VBA. http://www.experts-exchange.com/videos/1478/Excel-Error-Handlin…
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…

840 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question