Video Screencast Help
Search Video Help Close Back
to help

Delete Entry for a HKCU registry value for all users

Created: 03 Dec 2012 | 2 comments
techhit's picture
0 0 Votes
Login to vote

I need to create a Delete Entry in SWV that will delete a HKCU registry value for all users, but I can't seem to figure out how this is done after reading through the SWV User's Guide.

When I create a new layer, and perform a global capture, I am deleting the following registry value:

[HKCU\Control Panel\International]
sShortDate (REG_SZ)

After I finish the capture, when I go to edit the layer, I browse to the Delete Entries tab, and the Delete entry is specific to my user's SID in the USER_TEMPLATE, as opposed to applying the Delete Entry for all users.

i.e. The Delete Entry appears as follows:

FLAG         |        KEY NAME  | SUBKEY / VALUE

VALUE       |        \REGISTRY\USER\S-1-5-21-1696978660-36652233744-2630816380-500\Control Panel\International      |   sShortDate

 

How can I modify this setting to apply for all users?

Thank you.

 

 

 

 

Comments 2 CommentsJump to latest comment

EdT's picture

Place the entry "Control Panel\International " under HKey_Current_User. That way it will always refer to the current user.

If your issue has been solved, please use the "Mark as Solution" link on the most relevant thread.

0
Login to vote
techhit's picture

Hi, EdT.

If you look at the SWV Admin Console GUI, there's no such hkey_current_user placement within Delete Entries.  Only USER_TEMPLATE, and it expects the key to be in the format of the path to the actual hive as per http://technet.microsoft.com/en-us/library/cc95168...

If you perform a global capture, and delete a user or machine based registry key, they correspond to the format as per the technet article.

So it doesn't seem that it's possible to have a HKCU delete entry that applies to all users, by that logic. 

 

 

0
Login to vote