Solved

Key re-appears in HKLM after deleting one of its values.

Posted on 2014-09-24
6
191 Views
Last Modified: 2014-10-11
I've got a script that runs during a deployment which deletes a value from a certain Registry key.

The value is called "Stubpath", I delete that from the key "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{26923b43-4d38-484f-9b9e-de460746276c}".

The command, which works fine, is:

%windir%\System32\reg.exe DELETE "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{26923b43-4d38-484f-9b9e-de460746276c}" /v StubPath /f

Open in new window

%windir%\System32\reg.exe DELETE "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{26923b43-4d38-484f-9b9e-de460746276c}" /v StubPath /f

It does delete just fine, however, it appears that this key's name changes to ">{26923b43-4d38-484f-9b9e-de460746276c}" in the same path, and has the same Stubpath value back in it.


This key contains one of the many different references for pinning the Internet Explorer .lnk shorcut to the Start menu. I'm aware of other alternatives such as logon scripts, Imagex, etc., but I'm really trying to get to the core of the issue on this particular situation and be advised on how to fix it.

I appreciate any help here!

Thanks
0
Comment
Question by:garryshape
  • 4
  • 2
6 Comments
 
LVL 38

Expert Comment

by:BillDL
Comment Utility
What is the on-screen message if you temporarily remove the  /f  ("force" or "delete without prompt") switch from the command and run the script?
0
 
LVL 38

Expert Comment

by:BillDL
Comment Utility
Here's an oddity that I have to admit I have never noticed in my registry before.  I am on an XP computer right now, but I see the following registry keys down at the bottom of:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components

<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}
>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
>{26923b43-4d38-484f-9b9e-de460746276c}
>{60B49E34-C7CC-11D0-8953-00A0C90347FF}
>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS
>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}

The components are for Internet Explorer, Windows Media Player, and Outlook Express.

The only one that exists in the list of keys above these is one that relates to Media Player 6 (an artefact for some kind of backward compatibility in XP even though a much more recent version of Windows Media Player is the default in XP).

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}

This makes me suspect that the keys with the < and > prefix are backup registry keys.  I have never (as far as I recall) run a REG DELETE command on any of these component keys, although I always configure my computers by tinkering manually in the registry.  I am puzzled by the < prefix on the first one and the > prefix on the rest of the key names though.

Here are the values in the same key as you have, and it obviously refers to IE8 as installed on this XP computer:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
@="Internet Explorer"
"ComponentID"="IEACCESS"
"Dontask"=dword:00000002
"IsInstalled"=dword:00000001
"Locale"="*"
"StubPath"="C:\\WINDOWS\\system32\\ie4uinit.exe -UserIconConfig"
"Version"="8,0,6001,18702"
"LocalizedName"="@C:\\WINDOWS\\system32\\ie4uinit.exe.mui,-21"

I am going to have to research a bit, however by the look of things that key already existed in your registry before running the script, and looks to be a normal condition.
0
 

Author Comment

by:garryshape
Comment Utility
Yeah that's what I was trying to figure out
Really confusing lol

I guess I will have to resort to a runonce silent, hidden logon script that deletes the IE .lnk from the start menu for the user, if I can't keep it removed via the registry, at least in the meantime. Not a huge deal
0
What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

 
LVL 38

Accepted Solution

by:
BillDL earned 500 total points
Comment Utility
I've done some searching to see if I can find out the purpose of those keys preceded by a < or >, but I cannot find any pages with an explanation.

The keys with the < and > prefix in HKLM exist in HKCU and under my {SID} in HKU.  The only difference between the Current_User and the one under my {SID} key are that they only contain Version and Locale values, whereas the ones under HKLM are more fully populated.

I'm sorry, but this one is beyond my scope of knowledge.
0
 

Author Closing Comment

by:garryshape
Comment Utility
It appears we just have to accept for now that a logon script would be best to delete the shortcut since this reg key is re-generating.
I have accomplished this with a simple RunOnce script to run cmd file to delete the IE .lnk shortcut.
The registry issue at hand doesn't appear to cause the Windows Media Player to re-generate, however, but that's probably because I'm on WES7.
0
 
LVL 38

Expert Comment

by:BillDL
Comment Utility
Thank you Garry
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Our Group Policy work started with Small Business Server in 2000. Microsoft gave us an excellent OU and GPO model in subsequent SBS editions that utilized WMI filters, OU linking, and VBS scripts. These are some of experiences plus our spending a lo…
If you get continual lockouts after changing your Active Directory password, there are several possible reasons.  Two of the most common are using other devices to access your email and stored passwords in the credential manager of windows.
This Micro Tutorial will teach you the basics of configuring your computer to improve its speed. It will also teach you how to disable programs that are running in the background simultaneously. This will be demonstrated using Windows 7 operating…
This Micro Tutorial will give you a introduction in two parts how to utilize Windows Live Movie Maker to its maximum capability. This will be demonstrated using Windows Live Movie Maker on Windows 7 operating system.

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now