how to read the registry of a remote machine with different credentials?

[Gianni]

I would like to read registry keys of remote computers but using different credentials of that ones as the local script is running.

I know that is possible to read remote keys using the RegRead() command by prepending the computername in front of the registry key, but this command does not allow to specify different credentials.

now I'm using a bit articulate way like this:

paexec.exe remotemachine -u remotemachineusername -p password reg query "HKEY_LOCAL_MACHINEkeypath" /V keyname

that is I run the reg query command on the remote machine with the required credentials, and then I will parse the returned output from the paexec command.

but I would like to use a more "native" way, maybe by using WMI.
here I found an example about doing it, but is not clear to me how to use that example in autoit

any advise, suggestion (or better, a working solution ) on how to achieve that goal is welcome.

Thanks a lot for reading.

[UEZ]

Try this:

 

expandcollapse popup

Global Const $oErrorHandler = ObjEvent("AutoIt.Error", "ObjErrorHandler")

MsgBox(0, "Test", "Product Name: " & WMI_GetRemoteRegVal(@ComputerName, "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName") & @CRLF & _
        "Error: " & @error)

Func WMI_GetRemoteRegVal($sHost, $sRegPath, $sUser = "", $sPass = "") ;coded by UEZ build 2016-10-25
    If $sHost = "." Then $sHost = "localhost"
    Local $bLocal = True
    If Not BitOR($sHost = "localhost", $sHost = @ComputerName) Then
        Local $iPing = Ping($sHost, 250)
        If @error Then Return SetError(1, 0, "")
        $bLocal = False
    EndIf

    Local $objWMILocator = ObjCreate("WbemScripting.SWbemLocator")
    Local $objWMIService
    Switch $bLocal
        Case False
            $objWMIService = $objWMILocator.ConnectServer($sHost, "\\.\root\default", $sUser, $sPass, "", "", 128)
        Case True
            $objWMIService = $objWMILocator.ConnectServer($sHost, "\\.\root\default")
    EndSwitch
    If @error Then Return SetError(2, @error, "")
    Local $objReg = $objWMIService.Get("StdRegProv") ;http://msdn.microsoft.com/en-us/library/aa393664(v=vs.85).aspx
    If @error Or Not IsObj($objReg) Then Return SetError(3, @error, "")
    Local Const $wbemImpersonationLevelImpersonate = 3, $wbemAuthenticationLevelPktPrivacy = 6
    $objReg.Security_.ImpersonationLevel = $wbemImpersonationLevelImpersonate
    $objReg.Security_.AuthenticationLevel = $wbemAuthenticationLevelPktPrivacy
    Local $nHKEY, $sPrefix = StringRegExpReplace($sRegPath, "(.+?)\\.*", "$1")
    Switch $sPrefix
        Case "HKEY_CLASSES_ROOT", "HKCR"
            $nHKEY = 0x80000000
        Case "HKEY_CURRENT_USER", "HKCU"
            $nHKEY = 0x80000001
        Case "HKEY_LOCAL_MACHINE", "HKLM"
            $nHKEY = 0x80000002
        Case "HKEY_USERS", "HKU"
            $nHKEY = 0x80000003
        Case "HKEY_CURRENT_CONFIG", "HKCC"
            $nHKEY = 0x80000005
;~      Case "HKEY_DYN_DATA", "HKDD" ;Windows 95/98 only
;~          $nHKEY = 0x80000006
        Case Else
            Return SetError(4, 0, "")
    EndSwitch
    Local $sRegKeyPath = StringRegExpReplace($sRegPath, "(?i)" & $sPrefix & "\\(.+)\\.*", "$1")
    If @error Or $sRegKeyPath = "" Then Return SetError(5, 0, "")
    Local $aSubKeys, $aTypes
    $objReg.EnumValues($nHKEY, $sRegKeyPath, $aSubKeys, $aTypes)
    If @error Or Not IsArray($aSubKeys) Then Return SetError(6, @error, "")
    Local Enum $iREG_SZ = 1, $iREG_EXPAND_SZ, $iREG_BINARY, $iREG_DWORD, $iREG_DWORD_BIG_ENDIAN, $iREG_LINK, $iREG_MULTI_SZ, $iREG_RESOURCE_LIST, $iREG_FULL_RESOURCE_DESCRIPTOR, $iREG_RESOURCE_REQUIREMENTS_LIST, $iREG_QWORD
    Local $i, $return, $sSearchValue = StringRegExpReplace($sRegPath, "(?i)" & $sPrefix & ".+\\(.+)", "$1")
    For $i = 0 To UBound($aSubKeys) - 1
        If $aSubKeys[$i] = $sSearchValue Then
            Switch $aTypes[$i]
                Case $iREG_SZ
                    $objReg.GetStringValue($nHKEY, $sRegKeyPath, $sSearchValue, $return)
                    Return $return
                Case $iREG_EXPAND_SZ
                    $objReg.GetExpandedStringValue($nHKEY, $sRegKeyPath, $sSearchValue, $return)
                    Return $return
                Case $iREG_BINARY
                    $objReg.GetBinaryValue($nHKEY, $sRegKeyPath, $sSearchValue, $return)
                    Return $return
                Case $iREG_DWORD
                    $objReg.GetDWORDValue($nHKEY, $sRegKeyPath, $sSearchValue, $return)
                    Return $return
                Case $iREG_MULTI_SZ
                    $objReg.GetMultiStringValue($nHKEY, $sRegKeyPath, $sSearchValue, $return)
                    Return $return
                Case $iREG_QWORD
                    $objReg.GetQWORDValue($nHKEY, $sRegKeyPath, $sSearchValue, $return)
                    Return $return
            EndSwitch
        EndIf
    Next
    Return SetError(7, 0, "")
EndFunc   ;==>WMI_GetRemoteRegVal



Func ObjErrorHandler()
    ConsoleWrite("A COM Error has occured!" & @CRLF & @CRLF & _
            "err.description is: " & @TAB & $oErrorHandler.description & @CRLF & _
            "err.windescription:" & @TAB & $oErrorHandler & @CRLF & _
            "err.number is: " & @TAB & Hex($oErrorHandler.number, 8) & @CRLF & _
            "err.lastdllerror is: " & @TAB & $oErrorHandler.lastdllerror & @CRLF & _
            "err.scriptline is: " & @TAB & $oErrorHandler.scriptline & @CRLF & _
            "err.source is: " & @TAB & $oErrorHandler.source & @CRLF & _
            "err.helpfile is: " & @TAB & $oErrorHandler.helpfile & @CRLF & _
            "err.helpcontext is: " & @TAB & $oErrorHandler.helpcontext & @CRLF _
            )
EndFunc   ;==>ObjErrorHandler

Br,

UEZ

Edited October 25, 2016 by UEZ
Fixed a bug

[Gianni]

Yes! Thanks a lot UEZ.

it works well, and it will be very useful to me in a script I'm writing to query registry values in a lot of remote clients.

many thanks again

[UEZ]

You are welcome.

I didn't test the remote functionality but glad to hear that it works.

Br,

UEZ

[Gianni]

You are welcome.

I didn't test the remote functionality but glad to hear that it works.

Br,

UEZ

 

(it gives this error in AutoiIt 3.3.8.1

D:AutoITWMIRemoteRegistry.au3 (12) : ==> The requested action with this object has failed.:

$objReg.Security_.ImpersonationLevel = "WbemImpersonationLevelImpersonate"

$objReg.Security_.ImpersonationLevel = "WbemImpersonationLevelImpersonate"^ ERROR)

while it works well without problems instead on AutoIt 3.3.10.2

Edited July 5, 2014 by Chimp

[UEZ]

Updated the code from post #2. Please check again.

Br,

UEZ

[Gianni]

Checked....

waw, now it also works on AutoIt 3.3.8.1

Super!

[Gianni]

while using this function, has arisen the need  for a new feature:

how could be also added the possibility to write to the remote registry as well ??

(always in the same way, with the possibility to specify username and password)

Thanks for the help

[UEZ]

It should be easy to modify the example appropriately to write to the registry. Checkout this web site: http://msdn.microsoft.com/en-us/library/aa393600(v=vs.85).aspx

The Set* methods should do it.

Br,

UEZ

[Gianni]

It should be easy to modify the example appropriately to write to the registry. Checkout this web site: http://msdn.microsoft.com/en-us/library/aa393600(v=vs.85).aspx

The Set* methods should do it.

Br,

UEZ

 

thanks for the link,

I will try to achieve some result ....

[yosvanyisel]

please could help me. I need to get the domain name of a remote computer using the principle of your example with user credentials. Similarly to this...

the problem is that the example I have returned empty string me when I enter the name of a network computer

Func DomainComputerBelongs($strComputer = "localhost")

    ; Generated by AutoIt Scriptomatic

    $Domain = ''

    $wbemFlagReturnImmediately = 0x10

    $wbemFlagForwardOnly = 0x20

 

    $objWMIService = ObjGet("winmgmts:" & $strComputer & "rootCIMV2")

    If Not IsObj($objWMIService) Then Return SetError(1, 0, '')

    $colItems = $objWMIService.ExecQuery("SELECT * FROM Win32_ComputerSystem", "WQL", _

                                            $wbemFlagReturnImmediately + $wbemFlagForwardOnly)

 

    If IsObj($colItems) then

        For $objItem In $colItems

            $Domain = $objItem.Domain

        Next

    Endif

    Return $Domain

EndFunc

[UEZ]

Try this:

 

Global $oErrorHandler = ObjEvent("AutoIt.Error", "ObjErrorHandler")

MsgBox(0, "Test", WMI_GetDomainName("."))

Func WMI_GetDomainName($sHost, $sUsr = "", $sPass = "")
    If $sHost = "." Then $sHost = @ComputerName
    Local $ping = Ping($sHost, 250)
    If @error Then Return SetError(1, 0, -1)
    Local $objWMILocator = ObjCreate("WbemScripting.SWbemLocator")
    Local $objWMIService = $objWMILocator.ConnectServer($sHost, "\root\cimv2", $sUsr, $sPass, "", "", 128)
    If @error Then Return SetError(2, 0, -1)
    Local $colItems = $objWMIService.ExecQuery("SELECT * FROM Win32_ComputerSystem", "WQL", 0x30)
    If IsObj($colItems) Then
        For $objItem In $colItems
            Return $objItem.Domain
        Next
    Else
        Return SetError(3, 0, -1)
    EndIf
    Return 0
EndFunc

Func ObjErrorHandler()
     ConsoleWrite(  "A COM Error has occured!" & @CRLF  & @CRLF & _
                                "err.description is: "    & @TAB & $oErrorHandler.description    & @CRLF & _
                                "err.windescription:"     & @TAB & $oErrorHandler & @CRLF & _
                                "err.number is: "         & @TAB & Hex($oErrorHandler.number, 8)  & @CRLF & _
                                "err.lastdllerror is: "   & @TAB & $oErrorHandler.lastdllerror   & @CRLF & _
                                "err.scriptline is: "     & @TAB & $oErrorHandler.scriptline     & @CRLF & _
                                "err.source is: "         & @TAB & $oErrorHandler.source         & @CRLF & _
                                "err.helpfile is: "       & @TAB & $oErrorHandler.helpfile       & @CRLF & _
                                "err.helpcontext is: "    & @TAB & $oErrorHandler.helpcontext & @CRLF _
                            )
EndFunc

If needed provide the credentials for the remote host.

Further please open next time a new topic for your issue.

Edited April 12, 2015 by UEZ