Delete RegKey From Current Users

Content Authoring
1

Hello All,

I’m trying to delete the regkey value which are under Current User Hive … But My Bigfix is running on system account… I have tried all the possibilities below is my action script.

Action Script:

action uses wow64 redirection false
delete __createfile
delete wizardedit.reg
createfile until @end_create_reg_file
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
“ProxyEnable”=-
“AutoconfigURL”=-
@end_create_reg_file
move __createfile wizardedit.reg

prefetch RunAsCurrentUser.exe sha1:ee47505ebfb2790b9da8a20ed70e67158e9753d0 size:342528 http://software.bigfix.com/download/bes/util/RunAsCurrentUser-2.0.3.1.exe sha256:1a9b518c775e2a85a7c47801e9b8221df338a65ad8df326485e4cd2aea22fe52
utility __Download\RunAsCurrentUser.exe

waithidden “__Download\RunAsCurrentUser.exe” regedit /s wizardedit.reg
waithidden “__Download\RunAsCurrentUser.exe” --w regedit /s "wizardedit.reg"
waithidden “__Download\RunAsCurrentUser.exe” --w cmd.exe /c “reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings /V AutoconfigURL /f” waithidden “__Download\RunAsCurrentUser.exe” --w cmd.exe /c “reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings /V ProxyEnable /f” waithidden “__Download\RunAsCurrentUser.exe” --w cmd.exe /c reg delete “HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings” /V AutoconfigURL /f waithidden “__Download\RunAsCurrentUser.exe” --w cmd.exe /c reg delete “HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings” /V ProxyEnable /f waithidden “__Download\RunAsCurrentUser.exe” call "reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings /V AutoconfigURL /f"
waithidden “__Download\RunAsCurrentUser.exe” call “reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings /V ProxyEnable /f”

Please Help Me… to get out from this situation…

Thanks in Advance…

2

I do this by setting a parameter to the current SID:

parameter “sid” = “{component string of sid of security account(SID of logged on user as string)}”

and then calling that:

[HKEY_USERS\{parameter “sid”}\Software\Microsoft\Windows\CurrentVersion" etc etc

1 Like
3

There are 2 inspectors, “Logged on user” and “current user” that are helpful here that return the “HKEY_USERS\SID value”. You can use them with native action script instead of writing a .BAT file if desired, or just insert them in your reg command:

regdelete “[{user key of logged on user}\Software\Microsoft\Windows\CurrentVersion\etc.]”

reg.exe delete {user key of logged on user}\Software\Microsoft\Windows\CurrentVersion\etc.

or

regdelete “[{user key of current user}\Software\Microsoft\Windows\CurrentVersion\etc.]”

reg.exe delete {user key of current user}\Software\Microsoft\Windows\CurrentVersion\etc.

However, bear in mind that there is a difference between “Logged on user” and “Current user”. “Current user” is the one logged in locally, sitting in front of the PC, “Logged on user” can be either locally or RDP.

3 Likes
4

Thanks For the reply DaveG…
I will try and get back to You…!

5

Thanks JkJ1962,

When I open Fixlet deburger and tried below relevance. It shows below error.

Q: user key of current user
E: Singular Expression refers to non existing object.

6

Change to local client evaluator under Debug / Evalutate using.

8

Tried using local client evaluator Only…

9

Weird, worked for me. Not sure

10

Hello DaveG,

When I tried in Fixlet Debugger in Local Evaluator
parameter “sid” = “{component string of sid of security account(SID of logged on user as string)}”

It shows "relevance clauses must be surrounded by { and } guards"
I think we cannot evaluate in fixlet debugger is that true ?

11

you can’t really set a parameter in the debugger, that’s the action script.

Just use component string of sid of security account(SID of logged on user as string) in the debugger to get the result.

What jkj1862 posted would probably be the better way to do it, although both get the same results.

12

Hello DaveG,

When I tried in Fixlet Debugger in Local Evaluator
parameter “sid” = “{component string of sid of security account(SID of logged on user as string)}”

It shows “relevance clauses must be surrounded by { and } guards”
I think we cannot evaluate in fixlet debugger is that true ?

If I pare that back to

q: component string of sid of security account(SID of logged on user as string)

in a QnA tab in the debugger I get a Windows error 0x522

Changing it to

(component string of sid of security account (names of logged on users))

gives me my SID

Substituting that back into your action script gives

parameter "sid" = "{component string of sid of security account (names of logged on users)}"

which works - but it is plural (because you can have multiple logged on users.

For the singular locally logged on user use

parameter "sid" = "{component string of sid of security account (names of current user)}"

1 Like
13

My QnA Shows SID Perfectly …

image
image649×534 22.2 KB

My Action Script. always shows this error. Even it worked in QNA

image
image654×548 19.8 KB

14

You’re retrieving sid of logged on user but then switch to name of current user.

Is sid of current user a property you could try instead (I don’t have a console handy)?

1 Like
15

Thanks @JasonWalker , @trn , @DaveG & @jkj1962

For Responding…
The issue got fixed with the old code. The reason is workstation doesn’t have permission to that folder.

Thanks A Lot…