Relevance for current user registry value dword setting

Good morning!

I’m trying to create relevance based on the current user registry setting and it comes up false, even when it’s true. What am I missing here? thanks!

exists keys whose(exists key “Microsoft\Office\16.0\Outlook\Resiliency\DoNotDisableAddinList” of it AND exists value “SuspiciousEmailReportAddin” whose(it != 1) of it) of key “HKEY_USERS” of registry

If I set it to 0, it says “false” if I set it to 1, it says false. The actual setting of the dword is in hex “00000001” (which I also tried), but translates to “1” when you select “decimal” in the registry editor.

Firstly, I think you are missing “Software” from the registry path but also its looking for the value SuspiciousEmailReportAddin in the same parent key as “Microsoft\Office\16.0\Outlook\Resiliency\DoNotDisableAddinList”, not in the “Microsoft\Office\16.0\Outlook\Resiliency\DoNotDisableAddinList” key (because in both instances, “it” refers to the same parent).

Checking for keys in the keys of key HKU should work.

Q: exists keys "Software\Microsoft\Office\16.0\Outlook\Resiliency\DoNotDisableAddinList" whose (exists values "SuspiciousEmailReportAddin" whose (it = 1) of it) of keys of key "HKU" of registry
A: True
T: 0.328 ms
1 Like

Good catch!
Also consider whether using 32-bit or 64-bit registries. Differences between registry, x32 registry, x64 registry, and native registry

Good point @JasonWalker. I believe HKU & HKCU “Software” keys have less wow64 redirection than HKLM\Software

That works great, thanks!!!
Next silly question, what’s the best way of going about setting the dword value to 0 for current user?

I figured out the action and it works:

override run
hidden=true
runas=currentuser
run powershell.exe -ExecutionPolicy Bypass -command Set-ItemProperty -Path HKCU:\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\DoNotDisableAddinList -Name “SuspiciousEmailReportAddin” -Value 0

1 Like