Windows Registry Key/Value Date Created/Date Modified Time Stamp and other Registry Questions

Posted on 2009-05-04
Medium Priority
Last Modified: 2013-12-03
Question 1 (the toughest I believe)
I thought that I saw somewhere the information when a Registry Key or Value was added to the Registry Database or when it was Modified. I know that you cannot see that in the Windows Registry Editor. Is there a way to find that out?

Or is this information not even stored in the Registry Database Files themselves and also not in any other DB of Windows that could be accessed. WMI comes into my mind.
Question 2
How can I determine using VBScript what the Data Type of a Registry Value is? Important to me are subtle differences like REG_SZ, REG_EXPAND_SZ or REG_MULTI_SZ. The functions of the Windows Script Host do not provide that information. For them String is String, but it makes a big difference for the Registry. Following this question, how can I create a value with VBScript with the data type REG_MULTI_SZ. The WshShellObject (WScript.Shell) reference for RegWrite method explicitly states that writing Multi String values is not supported by WSH.

Question 3.
How can I open and the read, write or delete keys and values from a registry file that is not a registry database file from my own operating system, for example the registry of a system that crashed and where I booted from a boot disk with file access to that system and would like to use some scripts for extracting or inserting data for data recovery purposes and/or to may be fix what causes the system to crash.

I know that you can somehow load registry files into your own system registry (although I don't know how that actually works) with different Key and Hive names. I saw some tools doing it, but I would like to do it myself and be able to write my own scripts to have the flexibility that I need.

VBScript Code samples or links to them would be appreciated. Thanks

I will reward 200 points full answers of the first question and 150 points each for the 2nd and 3rd question. If you are able to answer all three, you will get the full 500 points.

'WSH RegWrite Method
Set WshShell = WScript.CreateObject("WScript.Shell") 
WshShell.RegWrite "HKCU\Software\ACME\FortuneTeller\", 1, "REG_BINARY" 
WshShell.RegWrite "HKCU\Software\ACME\FortuneTeller\MindReader", "Goocher!", "REG_SZ"
'Not Supported Data Type: REG_MULTI_SZ

Open in new window

Question by:Cumbrowski
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4
LVL 86

Expert Comment

ID: 24296793

'RegQueryInfoKey()' (http://msdn.microsoft.com/en-us/library/ms724902(VS.85).aspx) can do that for keys, but there is no equivalent API to retrieve the creation/modification time of values.


'RegEnumValue()' (http://msdn.microsoft.com/en-us/library/ms724865(VS.85).aspx) allows you to interate through a key's values and also obtain the data type as well as the contents.


That can be done using 'RegLoadKey()' (http://msdn.microsoft.com/en-us/library/ms724889(VS.85).aspx) for a registry file on your machine or 'RegConnectRegistry()' (http://msdn.microsoft.com/en-us/library/ms724840(VS.85).aspx) if you want to read the registry of a remote computer.

Author Comment

ID: 24299207
Thanks JKR,

Half way from how it seems.
I am not a C++ programmer, but all the MSDN articles are for C++.
How can I make use of those in VBScript?

LVL 86

Expert Comment

ID: 24299610
Well, these APIs should be accessible from VBS also - at least they are from any 'managed' languages (or 'regular' VB), so there must be some way...
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!


Author Comment

ID: 24300730
Not always, but pretty much always differently than with C++ or even VB.NET

I'd would like to give you half the points (250) (for half the overall answer). How do I do that?

Author Comment

ID: 24369806
I was able to figure out the answers for Question 2 and 3 myself. See code samples below.

I have not found an answer for Question 1 yet though. If somebody could translate the C++ stuff to VBScript that would be great. I am referring to this:

'RegQueryInfoKey()' (http://msdn.microsoft.com/en-us/library/ms724902(VS.85).aspx)

Question 2)
Creating Expanded String Values
Uses WMI to create an expanded string value under HKLM\SOFTWARE\System Admin Scripting Guide.
const HKEY_LOCAL_MACHINE = &H80000002
strComputer = "."
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_ 
strComputer & "\root\default:StdRegProv")
strKeyPath = "SOFTWARE\System Admin Scripting Guide"
strValueName = "Expanded String Value Name"
strValue = "%PATHEXT%"
oReg.SetExpandedStringValue _
Uses WMI to list all the registry values and their types 
under HKLM\SYSTEM\CurrentControlSet\Control\Lsa.
const HKEY_LOCAL_MACHINE = &H80000002
const REG_SZ = 1
const REG_EXPAND_SZ = 2
const REG_BINARY = 3
const REG_DWORD = 4
const REG_MULTI_SZ = 7
strComputer = "."
Set StdOut = WScript.StdOut
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_ 
strComputer & "\root\default:StdRegProv")
strKeyPath = "SYSTEM\CurrentControlSet\Control\Lsa"
oReg.EnumValues HKEY_LOCAL_MACHINE, strKeyPath,_
 arrValueNames, arrValueTypes
For i=0 To UBound(arrValueNames)
    StdOut.WriteLine "Value Name: " & arrValueNames(i) 
    Select Case arrValueTypes(i)
        Case REG_SZ
            StdOut.WriteLine "Data Type: String"
        Case REG_EXPAND_SZ
            StdOut.WriteLine "Data Type: Expanded String"
        Case REG_BINARY
            StdOut.WriteLine "Data Type: Binary"
        Case REG_DWORD
            StdOut.WriteLine "Data Type: DWORD"
        Case REG_MULTI_SZ
            StdOut.WriteLine "Data Type: Multi String"
    End Select 
Question 3)
You can attach registry databases from other systems to your own registry (and detach them) with the REG command line command.
Load Registry
REG LOAD KeyName FileName
  KeyName    ROOTKEY\SubKey (local machine only)
             ROOTKEY  [ HKLM | HKU ]
  SubKey   The key name to load the hive file into. Creating a new key
  FileName   The name of the hive file to load
             You must use REG SAVE to create this file
 REG LOAD HKLM\TempHive TempHive.hiv
     Loads the file TempHive.hiv to the Key HKLM\TempHive
  KeyName    ROOTKEY\SubKey (local machine only)
              ROOTKEY  [ HKLM | HKU ]
  SubKey   The key name of the hive to unload
    Unloads the hive TempHive in HKLM
The REG LOAD and REG UNLOAD commands can easily be executed using the RUN method of the WScript.Shell object like:
Dim strCmdLine 
strCmdLine = "REG LOAD HKLM\TempHive TempHive.hiv"
CreateObject("WScript.Shell").Run strCmdLine, 0, True

Open in new window

LVL 86

Accepted Solution

jkr earned 1500 total points
ID: 24370119

Author Comment

ID: 24370953
Thanks jkr. The article is interesting in itself, but did not answer question 1.... however.. it refers to an article by the same author that does address that question. See

Reading and Writing Registry Keys with Visual Basic

especially the paragraph "Getting Information about Keys"

Author Closing Comment

ID: 31577617
Not directly answered the remaining question, but pointed (by accident or on purpose) to the right direction, which lead to the actual answer :)
LVL 86

Expert Comment

ID: 24370984
Glad to be of some help - make sure your next Q is more C/C++ related, please ;o)

Featured Post

WordPress Tutorial 4: Recommended Plugins

Now that you have WordPress installed, understand the interface, and know how to install new parts, let’s take a look at our recommended plugins.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I don't know if many of you have made the great mistake of using the Cisco Thin Client model with the management software VXC. If you have then you are probably more then familiar with the incredibly clunky interface, the numerous work arounds, and …
If you need to start windows update installation remotely or as a scheduled task you will find this very helpful.
This is Part 3 in a 3-part series on Experts Exchange to discuss error handling in VBA code written for Excel. Part 1 of this series discussed basic error handling code using VBA. http://www.experts-exchange.com/videos/1478/Excel-Error-Handlin…
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…

765 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question