Removing registry keys with Regedit

Many times working with sccm we need to push out registry keys which is easy with a .reg file and regedit...."regedit /s key.reg" This adds all your keys to the registry and is very quick at it.

But what if you want to remove keys. Well you can use Vbscript or other lang to edit the registry or you can use a regedit. Yup a special "minus" sign will remove a key or tree.

[HKEY_LOCAL_ MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\xwing]
"key1"="value"
"key2"="value"
"key3"="value"


Say we want to remove the entire tree. We do this by sending the reg file with the following change

[-HKEY_LOCAL_ MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\xwing]

Everything in xwing and sub keys will be deleted.


Now say you want to just delete key2 then you send this
[HKEY_LOCAL_ MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\xwing]
"key2"=-

This will remove only key2 from the registry.

What is nice about this is that it won't throw an error if nothing is there so you can send it down to all machines whether they have the key or not.


MS KB article
http://support.microsoft.com/kb/310516

Native machine will not pull down computer certificate

Did you ever have a machine that just won't pull down the Computer certificate? You do everything you can think of and it just doesn't work. When you do a run>MMC.exe and add Certificates to the console then you can right click on personal certificates and request a cert. You might see this error

The certificate request failed because of one of the following conditions:-The request required an exchange certificate from a Certification Authority (CA) that is not started.-You do not have the permissions to request certificates from the available CAs.

if so then you might need to add the EnableDCOM entry to the machine with a value of Y

The EnableDCOM registry entry is located in the following registry subkey:
HKEY_LOCAL_MACHINE\Software\Microsoft\Ole

then restart the machine and wait for GPO to pull down the cert. The client should now be happy again.

http://support.microsoft.com/kb/929494

See this other post on Certificate errors
http://sms-hints-tricks.blogspot.com/2008/02/sccm-client-certificate-problems.html

Adobe 8 Pro Fast web viewing

Did you deploy Adobe 8 pro but you want to turn of the Fast Web viewing feature.

-----------------adobefwv.vbs------
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\8.0\Originals]"bAllowByteRangeRequests"=dword:00000000
----------------------------------

Send this registry change to your Adobe 8 Pro collection. Next time it is opened the selection will be disabled. To re-enable simply delete this reg key.

Lock down SMS Control Panel

There are several ways to lock down the control panel I will address the one I know or found. Since this has come up in other forums and newsgroups I thought I would add my 2 cents.
Why would you want to lock it down. Well, if you have a user that is an admin on their machine they might revolt and turn off the service or fool around with the cache to prevent SMS from doing its job. It is a fact of life that some users will have admin rights to their machine. This will hopefully deter or slow them down. There isn't a way to totally stop them.

1. Hide the SMS Control Panel for current user (Systems Managment)
This will require a restart, force it or just wait for them to restart.
-------no show.reg------------------
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Control Panel\don't load]
"SMSCFGRC.cpl"="No"
---------------------------------------------
2. Disable sections of the Contol Panel [Courtesy of Rune Norberg, MS Newsgroup]
For site assignment:>
HKLM\Software\Microsoft\SMS\Mobile Client\Configuration\CP Site Assignment> Options=Disabled (REG_SZ)
For cache:>
HKLM\Software\Microsoft\SMS\Mobile Client\Configuration\CP Cache> Options=Disabled (REG_SZ)
----------------------------------

3. Restart CCM Service on remote machine
If the admin keeps turning off the service you can setup a scheduled task to run say every 3 hours to turn it back on. If they turn off WMI then you have a problem but you can use this to give you a return value if it is failing to start it.

-------------restart sms agent.vbs------------
strComputer = "YourComputer"
strCommand = "net start ccmexec"
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" _
& strComputer & "\root\cimv2")


Set oStartup = objWMIService.Get("Win32_ProcessStartup")
Set objConfig = oStartup.SpawnInstance_
objConfig.ShowWindow = 1

Set oProcess = objWMIService.Get("Win32_Process")
intReturn = oProcess.Create (strCommand, Null, objConfig, intProcessID)
‘’use the intReturn if you want to log success or failure, maybe they turned off Dcom or WMI
--------------------------------------


None of these are top secret and it will only take a little bit of digging for them to fix it. But it will deter some people. You can only try so much.

ODBC Connections

After installing software or during routine application changes, it becomes necessary to add ODBC Settings. Most users don't or won't add these changes. Below is an example of how to add an ODBC connection to System (all users). If you want to do it for a certain user use the Current_User key.

ODBC for Project 2002 Sample
------------------------------------------------
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\ODBC\ODBC.INI\Project2002]
"Driver"="C:\\WINDOWS\\System32\\SQLSRV32.dll"
"Server"="Server-sql"
"LastUser"="LUser"
"Trusted_Connection"="Yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\ODBC\ODBC.INI\ODBC Data Sources]
"Project2002"="SQL Server"
---------------------------

This can also can be achived by setting it up manually and then exporting the Registry key.

Google Search in IE 6

There are several ways to change your search engine. You could just click search and change it. You can use the IE 6 deployment tool to change it and then push it out to your computers. But that seems to only affect the search bar. What happens if you want to change it in the address bar as well. Here is a vbscript that you easily change to a reg file. Either way you can push it through SMS to your clients. I really don't know why I did this a vbscript and not a reg file. I guess I was looking to see what I could do with VBS and the registry. When this is run per user it will set their search default to Google but it will also change the address bar into a google search. No need for the Google tool bar.

--------------------------google-search.vbs
Dim objShell, RegLocate
Set objShell = WScript.CreateObject("WScript.Shell")
On Error Resume Next

'Set Search Assistant

RegLocate = "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Use Search Asst"
objShell.RegWrite RegLocate,"yes","REG_SZ"

RegLocate = "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page"
objShell.RegWrite RegLocate,"http://www.google.com","REG_SZ"

RegLocate = "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Bar"
objShell.RegWrite RegLocate,"http://www.google.com/ie","REG_SZ"

RegLocate = "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchURL\"
objShell.RegWrite RegLocate,"http://www.google.com/keyword/%s","REG_SZ"

RegLocate = "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchURL\provider"
objShell.RegWrite RegLocate,"gogl","REG_SZ"

RegLocate = "HKEY_CURRENT_USER\Software\Microsoft\search Assistant\DefaultSearchURL"
objShell.RegWrite RegLocate,"http://www.google.com/search?q=","REG_SZ"
--------------------------

Recover Deleted Items in Outlook 2003

When most people delete items in Outlook they really mean to do it. What if someone clears their Deleted Items folder but needs something back. Then the admin must pull backups or try other tricks. If you send down this Reg entry to the machines it will Give you a Recover Deleted items option in Outlook.

--------------------------------------
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Exchange\Client\Options]"DumpsterAlwaysOn"=dword:00000001
-------------------------------------

Logged out Background and Screen saver

Here is a simple script that will allow you to have a background when someone is logged out, say company logo or something. It will also set a special screen saver when no one is logged.

Because you are working in the .Default regfile I recommend running this adv when no one is logged on. Changes will not be see until you do a reboot.

Reg file
----------------
Windows Registry Editor Version 5.00
[HKEY_USERS\.DEFAULT\Control Panel\Desktop]
"ScreenSaverIsSecure"="1"
"ScreenSaveTimeOut"="60"
"ScreenSaveActive"="1"
"SCRNSAVE.EXE"="Custom.scr"
"Wallpaper"="CompanyLogo.bmp"

[HKEY_USERS\.DEFAULT\Control Panel\Screen Saver.Slideshow]
"PaintInterval"=dword:00000000
"ChangeInterval"=dword:00001770
"DisplayFilename"=dword:00000000
"MaxScreenPercent"=dword:0000005a
"DisableTransitions"=dword:00000000
"AllowStretching"=dword:00000000
"AllowKeyboardControl"=dword:00000000
"MaxFailedFiles"=dword:000003e8
"MaxSuccessfulFiles"=dword:00010000
"MaxDirectories"=dword:000000c8
"ImageDirectory"="c:\\windows\\screensaver\\"
-------------------------
User.reg
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Control Panel\Desktop]
"SCRNSAVE.EXE"="Custom.scr"
"Tilewallpaper"=0"
"ScreenSaveTimeOut"="600"
"ScreenSaverIsSecure"="1"
"ScreenSaveActive"="1"
------------

user screensaver.reg

[HKEY_CURRENT_USER\Control Panel\Screen Saver.Slideshow]
"PaintInterval"=dword:00000000
"ChangeInterval"=dword:00001770
"DisplayFilename"=dword:00000000
"MaxScreenPercent"=dword:0000005a
"DisableTransitions"=dword:00000000
"AllowStretching"=dword:00000000
"AllowKeyboardControl"=dword:00000000
"MaxFailedFiles"=dword:000003e8
"MaxSuccessfulFiles"=dword:00010000
"MaxDirectories"=dword:000000c8


Install.bat
------------
rem This file must be run as admin since it sets the main default setting for the computer
rem Use company logo for screen saver.
regedit.exe /s no-one.reg
md "%windir%\screensaver\"
copy /y CompanyLogo.jpg"%windir%\screensaver\"
-------------------------

Disk Cleanup

Ever wanted to do a disk clean up on your own schedule? Here is some code that will allow you to just that.

Install:
regedit.exe /s disk-cleanup.reg
------------------
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Compress old files]"StateFlags0200"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Content Indexer Cleaner]"StateFlags0200"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Downloaded Program Files]"StateFlags0200"=dword:00000002
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Internet Cache Files]"StateFlags0200"=dword:00000002
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Memory Dump Files]"StateFlags0200"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Microsoft_Event_Reporting_2.0_Temp_Files]"StateFlags0200"=dword:00000002
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Office Setup Files]"StateFlags0200"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Offline Files]"StateFlags0200"=dword:00000002
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Old ChkDsk Files]"StateFlags0200"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Recycle Bin]"StateFlags0200"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Remote Desktop Cache Files]"StateFlags0200"=dword:00000002
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Setup Log Files]"StateFlags0200"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Temporary Files]"StateFlags0200"=dword:00000002
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Temporary Offline Files]"StateFlags0200"=dword:00000002
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\WebClient and WebPublisher Cache]"StateFlags0200"=dword:00000002
------------------------------
Execute:
cleanmgr.exe /sagerun:200


*****************************
Now what does all this mean...
StateFlags0200 is the level or setting I have created. You can have 0001 to 9999 different ways of doing diskclean up.
dword:00000002 Sets this setting to active.

So now you can control what type of file will be cleaned, including the recycle bin if you wanted.
There are more registry keys that you can control than the ones listed above. Now you can force a disk clean up several times a month with different version.

http://support.microsoft.com/kb/315246