RegWriteAllUsers / RegDeleteAllUsers

seanhart · August 1, 2007

I needed to do this for work recently and thought I'd share it. Here is a UDF which allows you to write a user specific registry key to ever user profile on the system (whether logged on or off). Includes the "default user" registry, so changes apply to any new users that log on as well.

Examples:

; Give everyone a new IE home page (note you don't need HKCU)

RegWriteAllUsers("Software\Microsoft\Internet Explorer\Main", "Start Page", "REG_SZ", "http://www.google.com")

; Delete everyone's custom wallpaper (note it you can use HKCU if you want)

RegDeleteAllUsers("HKEY_CURRENT_USER\Control Panel\Desktop", "WallPaper")

Code uses RegLoadHive functions by Larry.

#cs ----------------------------------------------------------------------------

 AutoIt Version: 3.2.2.0
 Author:         Sean Hart

 Script Function:
    UDFs to write or delete registry keys from all user profiles on the system.
    
    Uses RegLoadHive functions provided by Larry

#ce ----------------------------------------------------------------------------


; === RegWriteAllUsers ===
; Writes "current user" registry data to every user profile on the system.
; Requires RegLoadHive and RegUnLoadHive functions.
;
; Inputs:   $key    - see RegWrite function for details (no HKU\HKCU\HKLM required)
;           $value  - see RegWrite function for details
;           $type   - see RegWrite function for details
;           $data   - see RegWrite function for details
;
; Returns:  nothing
Func RegWriteAllUsers($key, $value, $type, $data)
    Dim $i, $curkey, $ExpandEnvStrings, $profiledir, $curdir, $search
    
    ; init variables
    $i = 1
    $error = 0
    $ExpandEnvStrings = Opt("ExpandEnvStrings",1)
    $profiledir = RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList", "ProfilesDirectory")
    
    ; change directory to profile directory
    $curdir = @WorkingDir
    FileChangeDir($profiledir)
    
    ; replace HKU / HKCU / HKLM in key if require
    Select
    Case StringLeft($key, 4) = "HKU\"
        $key = StringRight($key, StringLen($key) - 4)
    Case StringLeft($key, 5) = "HKCU\"
        $key = StringRight($key, StringLen($key) - 5)
    Case StringLeft($key, 5) = "HKLM\"
        $key = StringRight($key, StringLen($key) - 5)
    Case StringLeft($key, 11) = "HKEY_USERS\"
        $key = StringRight($key, StringLen($key) - 11)
    Case StringLeft($key, 18) = "HKEY_CURRENT_USER\"
        $key = StringRight($key, StringLen($key) - 18)
    Case StringLeft($key, 19) = "HKEY_LOCAL_MACHINE\"
        $key = StringRight($key, StringLen($key) - 19)
    EndSelect
    
    ; Go through all directories where ntuser.dat is accessible
    $search = FileFindFirstFile("*.*")
    $dir = FileFindNextFile($search)
    While @error = 0
        ; Process directories
        If StringInStr(FileGetAttrib($profiledir & "\" & $dir), "D") Then
            ; Check for ntuser.dat
            If FileExists($profiledir & "\" & $dir & "\ntuser.dat") Then
                ; Try and load hive
                If RegLoadHive("TempUser", $profiledir & "\" & $dir & "\ntuser.dat") Then
                    ; Apply new registry data
                    RegWrite("HKEY_USERS\TempUser\" & $key, $value, $type, $data)
                    
                    ; Unload hive
                    RegUnloadHive("TempUser")
                EndIf
            EndIf
        EndIf
        $dir = FileFindNextFile($search)
    WEnd
    
    ; Start by going through all currently logged on user keys (exclude system accounts and classes)
    $curkey = RegEnumKey("HKEY_USERS", $i)
    While @error = 0
        If (StringLen($curkey) > 8) And (Not StringInStr($curkey, "_Classes")) Then
            RegWrite("HKEY_USERS\" & $curkey & "\" & $key, $value, $type, $data)
        EndIf
        $i = $i + 1
        $curkey = RegEnumKey("HKEY_USERS", $i)
    WEnd
    
    ; Put settings back and change back to previous directory
    Opt("ExpandEnvStrings",$ExpandEnvStrings)
    FileChangeDir($curdir)
    
EndFunc
; === END RegWriteAllUsers ===


; === RegDeleteAllUsers ===
; Deletes "current user" registry data from every user profile on the system.
; Requires RegLoadHive and RegUnLoadHive functions.
;
; Inputs:   $key    - see RegDelete function for details (no HKU\HKCU\HKLM required)
;           $value  - (optional) see RegDelete function for details
;
; Returns:  nothing
Func RegDeleteAllUsers($key, $value = "ÿ")
    Dim $i, $curkey, $ExpandEnvStrings, $profiledir, $curdir, $search
    
    ; init variables
    $i = 1
    $error = 0
    $ExpandEnvStrings = Opt("ExpandEnvStrings",1)
    $profiledir = RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList", "ProfilesDirectory")
    
    ; change directory to profile directory
    $curdir = @WorkingDir
    FileChangeDir($profiledir)
    
    ; replace HKU / HKCU / HKLM in key if require
    Select
    Case StringLeft($key, 4) = "HKU\"
        $key = StringRight($key, StringLen($key) - 4)
    Case StringLeft($key, 5) = "HKCU\"
        $key = StringRight($key, StringLen($key) - 5)
    Case StringLeft($key, 5) = "HKLM\"
        $key = StringRight($key, StringLen($key) - 5)
    Case StringLeft($key, 11) = "HKEY_USERS\"
        $key = StringRight($key, StringLen($key) - 11)
    Case StringLeft($key, 18) = "HKEY_CURRENT_USER\"
        $key = StringRight($key, StringLen($key) - 18)
    Case StringLeft($key, 19) = "HKEY_LOCAL_MACHINE\"
        $key = StringRight($key, StringLen($key) - 19)
    EndSelect

    ; Go through all directories where ntuser.dat is accessible
    $search = FileFindFirstFile("*.*")
    $dir = FileFindNextFile($search)
    While @error = 0
        ; Process directories
        If StringInStr(FileGetAttrib($profiledir & "\" & $dir), "D") Then
            ; Check for ntuser.dat
            If FileExists($profiledir & "\" & $dir & "\ntuser.dat") Then
                ; Try and load hive
                If RegLoadHive("TempUser", $profiledir & "\" & $dir & "\ntuser.dat") Then
                    ; Delete registry data
                    If $value = "ÿ" Then
                        RegDelete("HKEY_USERS\TempUser\" & $key)
                    Else
                        RegDelete("HKEY_USERS\TempUser\" & $key, $value)
                    EndIf
                    
                    ; Unload hive
                    RegUnloadHive("TempUser")
                EndIf
            EndIf
        EndIf
        $dir = FileFindNextFile($search)
    WEnd
    
    ; Start by going through all currently logged on user keys (exclude system accounts and classes)
    $curkey = RegEnumKey("HKEY_USERS", $i)
    While @error = 0
        If (StringLen($curkey) > 8) And (Not StringInStr($curkey, "_Classes")) Then
            ; Delete registry data
            If $value = "ÿ" Then
                RegDelete("HKEY_USERS\" & $curkey & "\" & $key)
            Else
                RegDelete("HKEY_USERS\" & $curkey & "\" & $key, $value)
            EndIf
        EndIf
        $i = $i + 1
        $curkey = RegEnumKey("HKEY_USERS", $i)
    WEnd
    
EndFunc
; === END RegDeleteAllUsers ===


; === RegLoadHive ===
; Loads a ntuser.dat file as a registry hive
; Requires SetPrivilege function.
;
; Inputs:   $hiveName       - name for the hive
;           $NTUSER_datFile - full path to ntuser.dat file to load
;           $RLH_key        - (optional) root for hive (defaults to HKU)
;
; Returns:  1 - Successful
;           0 - Error (sets @error)
Func RegLoadHive($hiveName, $NTUSER_datFile, $RLH_key = "HKU")
    If Not (@OSTYPE=="WIN32_NT") Then
        SetError(-1)
        Return 0
    EndIf
    Const $HKEY_LOCAL_MACHINE = 0x80000002
    Const $HKEY_USERS = 0x80000003
    Const $SE_RESTORE_NAME = "SeRestorePrivilege"
    Const $SE_BACKUP_NAME = "SeBackupPrivilege"
    Local $RLH_ret
    Local $aPriv[2]
    If $RLH_key = "HKLM" Then
        $RLH_key = $HKEY_LOCAL_MACHINE
    ElseIf $RLH_key = "HKU" Then
        $RLH_key = $HKEY_USERS
    Else
        SetError(-2)
        Return 0
    EndIf
    $aPriv[0] = $SE_RESTORE_NAME
    $aPriv[1] = $SE_BACKUP_NAME
    SetPrivilege($aPriv,1)
    $RLH_ret = DllCall("Advapi32.dll","int","RegLoadKey","int",$RLH_key,"str",$hiveName,"str",$NTUSER_datFile)
    SetError($RLH_ret[0])
    Return Not $RLH_ret[0]
EndFunc
; === END RegLoadHive ===


; === RegUnloadHive ===
; Unloads a registry hive
; Requires SetPrivilege function.
;
; Inputs:   $hiveName       - name for the hive
;           $RLH_key        - (optional) root for hive (defaults to HKU)
;
; Returns:  1 - Successful
;           0 - Error (sets @error)
Func RegUnloadHive($hiveName, $RUH_key = "HKU")
    If Not (@OSTYPE=="WIN32_NT") Then
        SetError(-1)
        Return 0
    EndIf
    Const $HKEY_LOCAL_MACHINE = 0x80000002
    Const $HKEY_USERS = 0x80000003
    Local $RUH_ret
    If $RUH_key = "HKLM" Then
        $RUH_key = $HKEY_LOCAL_MACHINE
    ElseIf $RUH_key = "HKU" Then
        $RUH_key = $HKEY_USERS
    Else
        SetError(-2)
        Return 0
    EndIf
    $RUH_ret = DllCall("Advapi32.dll","int","RegUnLoadKey","int",$RUH_key,"Str",$hiveName)
    Return Not $RUH_ret[0]
EndFunc
; === RegUnloadHive ===


; === SetPrivilege ===
; Special function for use with registry hive functions
Func SetPrivilege( $privilege, $bEnable )
    Const $TOKEN_ADJUST_PRIVILEGES = 0x0020
    Const $TOKEN_QUERY = 0x0008
    Const $SE_PRIVILEGE_ENABLED = 0x0002
    Local $hToken, $SP_auxret, $SP_ret, $hCurrProcess, $nTokens, $nTokenIndex, $priv
    $nTokens = 1
    $LUID = DLLStructCreate("dword;int")
    If IsArray($privilege) Then    $nTokens = UBound($privilege)
    $TOKEN_PRIVILEGES = DLLStructCreate("dword;dword[" & (3 * $nTokens) & "]")
    $NEWTOKEN_PRIVILEGES = DLLStructCreate("dword;dword[" & (3 * $nTokens) & "]")
    $hCurrProcess = DLLCall("kernel32.dll","hwnd","GetCurrentProcess")
    $SP_auxret = DLLCall("advapi32.dll","int","OpenProcessToken","hwnd",$hCurrProcess[0], _
                "int",BitOR($TOKEN_ADJUST_PRIVILEGES,$TOKEN_QUERY),"int_ptr",0)
    If $SP_auxret[0] Then
        $hToken = $SP_auxret[3]
        DLLStructSetData($TOKEN_PRIVILEGES,1,1)
        $nTokenIndex = 1
        While $nTokenIndex <= $nTokens
            If IsArray($privilege) Then
                $priv = $privilege[$nTokenIndex-1]
            Else
                $priv = $privilege
            EndIf
            $ret = DLLCall("advapi32.dll","int","LookupPrivilegeValue","str","","str",$priv, _
                        "ptr",DLLStructGetPtr($LUID))
            If $ret[0] Then
                If $bEnable Then
                    DLLStructSetData($TOKEN_PRIVILEGES,2,$SE_PRIVILEGE_ENABLED,(3 * $nTokenIndex))
                Else
                    DLLStructSetData($TOKEN_PRIVILEGES,2,0,(3 * $nTokenIndex))
                EndIf
                DLLStructSetData($TOKEN_PRIVILEGES,2,DllStructGetData($LUID,1),(3 * ($nTokenIndex-1)) + 1)
                DLLStructSetData($TOKEN_PRIVILEGES,2,DllStructGetData($LUID,2),(3 * ($nTokenIndex-1)) + 2)
                DLLStructSetData($LUID,1,0)
                DLLStructSetData($LUID,2,0)
            EndIf
            $nTokenIndex += 1
        WEnd
        $ret = DLLCall("advapi32.dll","int","AdjustTokenPrivileges","hwnd",$hToken,"int",0, _
            "ptr",DllStructGetPtr($TOKEN_PRIVILEGES),"int",DllStructGetSize($NEWTOKEN_PRIVILEGES), _
            "ptr",DllStructGetPtr($NEWTOKEN_PRIVILEGES),"int_ptr",0)
        $f = DLLCall("kernel32.dll","int","GetLastError")
    EndIf
    $NEWTOKEN_PRIVILEGES = 0
    $TOKEN_PRIVILEGES = 0
    $LUID = 0
    If $SP_auxret[0] = 0 Then Return 0
    $SP_auxret = DLLCall("kernel32.dll","int","CloseHandle","hwnd",$hToken)
    If Not $ret[0] And Not $SP_auxret[0] Then Return 0
    return $ret[0]
EndFunc
; === END SetPrivilege ===

RegAllUsers.au3

Edited August 1, 2007 by seanhart

WeMartiansAreFriendly · August 1, 2007

I havent tested it yet, but that sounds awesome.

Gif · August 1, 2007

thats nice, keep up the good work!

Jazkal · August 2, 2007

Can I ask what systems you have tested this on?

Such as WinXP, Win2k3 and if it is x86 or x64.

Thanks

microsoft · August 2, 2007

it's a Good Script .

seanhart · August 7, 2007

Can I ask what systems you have tested this on?
Such as WinXP, Win2k3 and if it is x86 or x64.
Thanks

I've tested on Win 2K, XP, and Vista (UAC turned off).

Can't speak for 2003 (though it should work) or 64bit.

Thanks to everyone else for the comments.

cryn · August 8, 2007

First thing good job.

I written reg all script in vb, kix, Autoit. So am very familiar with the concept.

I see 2 problems.

1. Getting Profile Directory value is ok but then you have to enumerate the files which will take longer. It's best to go enumerate the profilelist for each S-1-5-21-XXXX is a user profile within each one you will see string "ProfileImagepath" that has a value exp.("%systemdrive%\Documents and Settings\JoeSmith") then all you need to add is \ntdat.dat". There is another reason why you want to do this. That would be in #2

2. Another issue is if the hive is already loaded it will fail. It is not uncommon for having two or more hives loaded at the same time it is only because when enduser logs off it doesn't unload for some reason. So how to resolve of it is easy you need to verify first if it's loaded. if you enumerate each profilelist it has a unique S-1-5-21-XXXXX then verify under the HKEY_USERS you will find the Unique Profile ID if its there then its loaded. Then you will just need to write the keys there. If you dont find it then use the value for "profileImagePath" while adding "\ntdat.at" then write to it.

If you do it this way it should run faster and wont skip any profiles.

Ignore S-1-5-18,S-1-5-19, and S-1-5-20 are for your local admin accounts exp(network,system accounts)

seanhart · August 8, 2007

First thing good job.
I written reg all script in vb, kix, Autoit. So am very familiar with the concept.
I see 2 problems.
1. Getting Profile Directory value is ok but then you have to enumerate the files which will take longer. It's best to go enumerate the profilelist for each S-1-5-21-XXXX is a user profile within each one you will see string "ProfileImagepath" that has a value exp.("%systemdrive%\Documents and Settings\JoeSmith") then all you need to add is \ntdat.dat". There is another reason why you want to do this. That would be in #2
2. Another issue is if the hive is already loaded it will fail. It is not uncommon for having two or more hives loaded at the same time it is only because when enduser logs off it doesn't unload for some reason. So how to resolve of it is easy you need to verify first if it's loaded. if you enumerate each profilelist it has a unique S-1-5-21-XXXXX then verify under the HKEY_USERS you will find the Unique Profile ID if its there then its loaded. Then you will just need to write the keys there. If you dont find it then use the value for "profileImagePath" while adding "\ntdat.at" then write to it.
If you do it this way it should run faster and wont skip any profiles.
Ignore S-1-5-18,S-1-5-19, and S-1-5-20 are for your local admin accounts exp(network,system accounts)

Thanks cryn for the feedback. I agree with you for point 1, it probably is faster to load files based on enumerating the profilelist in the registry. I've used that key in the past but didn't think about it for this use, good idea.

Your second point isn't quite right though. I've written the script to try every ntuser.dat file in the profile folder, and you are correct that any profiles in use will fail. However the second part of the code then enumerates all loaded profile keys under HKU which will catch the ones that failed earlier. So it's not quite as clean as it can be but it does work for all profiles. I have excluded local system accounts by ignoring SIDs with 8 or less characters.

I might re-write with some of your recommendations if I have time, thanks for them.

Sean

cryn · August 8, 2007

np i guess it's just coding preference then either way good job on the script.

Edited August 8, 2007 by cryn

DJ VenGenCe · September 18, 2007

Anyone still have the original RegLoadHive? I cannot locate it using search.

ResNullius · September 19, 2007

Anyone still have the original RegLoadHive? I cannot locate it using search.

All functions from the original RegLoadHive by Larry are included in seanhart's 1st post above.

They are:

Func RegLoadHive
Func RegUnloadHive
Func SetPrivilege

Also, note that DllStructDelete has been removed from AutoIt3.

From the Help file:

To release allocated memory just reset the returned variable to 0

Sadly, the original post of Larry's code got deleted when he left the forum

Edited September 19, 2007 by ResNullius

ToddMurray · November 13, 2007

I just want to say thank you for the script you wrote. I also added 2 additional functions to Copy and Delete files and made sure all the variables were defined as I always force variables to be declared out of habit.

AllUsers.au3

CODE

#include-once

#cs ----------------------------------------------------------------------------

AutoIt Version: 3.2.8.1

Author: Todd Murray

Credit: Based on code written by Sean Hart and Larry from the AutoIT Forums

http://www.autoitscript.com/forum/index.ph...egWriteAllUsers

Script Function:

UDFs to write or delete files and registry keys from all user profiles on the system.

Uses RegLoadHive functions provided by Larry

#ce ----------------------------------------------------------------------------

; === FileCopyAllUsers ===

; Writes files to every user profile on the system (Do not include path to profile)

; Requires RegLoadHive and RegUnLoadHive functions.

;

; Inputs: $source - see FileCopy function for details

; $dest - see FileCopy function for details.

; $flag - see FileCopy function for details.

; $attrib - Numberal value indicating what profiles to apply the change to.

; 1 - user

; 2 - default

; 4 - all users

; 8 - system

;

; Enter the numeric value for which profiles you want to affect. To handle

; multiple types add the value's together. 1-15 are appropriate input with

; 15 meaning all profiles.

;

; Returns: nothing

Func FileCopyAllUsers($source, $dest, $flag, $attrib)

Dim $error, $ExpandEnvStrings, $AllUsersProfile, $DefaultUserProfile, $ProfilesDirectory, $curdir, $search, $profile, $SystemDirectoryAttribute

; init variables

$error = 0

$ExpandEnvStrings = Opt("ExpandEnvStrings",1)

$AllUsersProfile = RegRead("HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList", "AllUsersProfile")

$DefaultUserProfile = RegRead("HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList", "DefaultUserProfile")

$ProfilesDirectory = RegRead("HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList", "ProfilesDirectory")

$source = @ScriptDir & "\" & $source

; change directory to profile directory

$curdir = @WorkingDir

FileChangeDir($ProfilesDirectory)

; Go through all directories

$search = FileFindFirstFile("*.*")

$profile = FileFindNextFile($search)

While @error = 0

; Checks to ensure the target is a directory

If StringRegExp(FileGetAttrib($profile), "D", 0) <> 0 Then

$SystemDirectoryAttribute = StringRegExp(FileGetAttrib($profile), "SHD", 0)

Switch $attrib

Case 1; User Profiles

If $profile <> $AllUsersProfile And $profile <> $DefaultUserProfile And $SystemDirectoryAttribute = False Then