Help -HKEY_CURRENT_USER - analysis

1

value “TxAllowed” of key “HKEY_CURRENT_USER\SvaTransmit\Params” of native registry

2

I do not know what you are asking, but in order to inspect the HKCU registry key, you need to use the following code

keys of current user key of native registry

I hope this helps.

3

Remember the client is running as LOCAL SYSTEM and not as the user logged in :slight_smile:

4

First of all thank you , I know it and usually I use a program " RUNASCURRENTUSER "
But now I need to extract value in register appears Registry path that I mentioned

5

Would you please help me with the syntax based on the registry it notes

6

Try the following:

value "TxAllowed" of key "SvaTransmit\Params" of current user key of registry
1 Like
7

Immediately checks , thanks

8

Now I get undefined instead of error

9

you can also try to evaluate it using the Local Client Evaluator *Debug > Evaluate Using > Local Client evaluator"

One of the other things you could do is try to run the Fixlet Debugger as SYSTEM using psexec.

10

You have to also have a “current user” logged in for this to work (not remoted etc but someone using the console)

You can do this with a “logged on user” by changing it to

value "TxAllowed" of key "SvaTransmit\Params" of current user key(logged on user) of registry
11

Many times happens that there is any logged on user , in that case and if you have a generic user and a generic password for your endpoints, you could follow the following approach:

1.- Create a script with AutoIt tool, I’ve this example:

$sUser = "user" 
$sPass = "Password" 
$sDomain = "yourDomain" 
 
$sCMD = "REG ADD HKEY_CURRENT_USER\YourKey" 
RunAs ($sUser, $sDomain, $sPass, 0, "cmd /c " & $sCMD)

2.- Compile the code
3.- Create a fixlet to run this code and send the output to a file.
4.- Create an analyses to pull the data from the file.

12

Thank you very much , you helped me a lot

13

Thank you very much , you helped me a lot!

14

Although fared
I would be happy if you can explain in more detail