Video Screencast Help

Delete Entry for a HKCU registry value for all users

Created: 03 Dec 2012 | 2 comments

I need to create a Delete Entry in SWV that will delete a HKCU registry value for all users, but I can't seem to figure out how this is done after reading through the SWV User's Guide.

When I create a new layer, and perform a global capture, I am deleting the following registry value:

[HKCU\Control Panel\International]
sShortDate (REG_SZ)

After I finish the capture, when I go to edit the layer, I browse to the Delete Entries tab, and the Delete entry is specific to my user's SID in the USER_TEMPLATE, as opposed to applying the Delete Entry for all users.

i.e. The Delete Entry appears as follows:

FLAG         |        KEY NAME  | SUBKEY / VALUE

VALUE       |        \REGISTRY\USER\S-1-5-21-1696978660-36652233744-2630816380-500\Control Panel\International      |   sShortDate

How can I modify this setting to apply for all users?

Thank you.

Comments 2 CommentsJump to latest comment

EdT's picture

Place the entry "Control Panel\International " under HKey_Current_User. That way it will always refer to the current user.

If your issue has been solved, please use the "Mark as Solution" link on the most relevant thread.

techhit's picture

Hi, EdT.

If you look at the SWV Admin Console GUI, there's no such hkey_current_user placement within Delete Entries.  Only USER_TEMPLATE, and it expects the key to be in the format of the path to the actual hive as per

If you perform a global capture, and delete a user or machine based registry key, they correspond to the format as per the technet article.

So it doesn't seem that it's possible to have a HKCU delete entry that applies to all users, by that logic.