Read Registry while machine not running using winpe

December 9th, 2008

While I was developing a winpe 2.0 cd which automatically boots up a hta that creates a full backup of a machine using imagex, i wanted to give the image file a unique name.

Like MyComputerName_UserName.wim

If you query WMI the only unique thing you get back is the computers serialnumber. Which in most cases doesn’t say much, or is hard to assign to someone.

Instead of using the machines serial number i gave it a shoot finding out the machines hostname and the last logged on user.

The trick is to load the registry file hiv first, do your query and then unload the hiv.

You’ll find the hive files in C:\Windows\system32\config\

Here some vbscript examples how I did it.

'Declaration
Const HKEY_LOCAL_MACHINE=&H80000002

MsgBox GetComputerName
MsgBox GetUserName

'Set AutoLogon on the Offline Machine :-)
SetAutoLogon User, Password, Domain, Count

Function GetComputerName()
Dim WSHShell
Set WSHShell = CreateObject("WScript.Shell")
WSHShell.run "reg load HKLM\TempHive C:\WINDOWS\system32\config\system", 0, True
tempComputerName = RegRead(HKEY_LOCAL_MACHINE,"TempHive\ControlSet001\Control\ComputerName\ComputerName","ComputerName")
If isNull(tempComputerName) Then
GetComputerName = "Coudn't load local hive"
Else
GetComputerName = tempComputerName
End If
WSHShell.run "reg unload HKLM\TempHive", 0, True
Set WSHShell = Nothing
End Function

Function GetUserName()
Dim WSHShell
Set WSHShell = CreateObject("WScript.Shell")
WSHShell.run "reg load HKLM\TempHive C:\WINDOWS\system32\config\software", 0, True
tempUserName = RegRead(HKEY_LOCAL_MACHINE,"TempHive\Microsoft\Windows NT\CurrentVersion\Winlogon","DefaultUserName")
If isNull(tempComputerName) Then
GetUserName = "Coudn't load local hive"
Else
GetUserName = tempUserName
End If
WSHShell.run "reg unload HKLM\TempHive", 0, True
Set WSHShell = Nothing
End Function

Sub SetAutoLogon(User, Password, Domain)
Dim WSHShell
Set WSHShell = CreateObject("WScript.Shell")
WSHShell.run "reg load HKLM\TempHive C:\WINDOWS\system32\config\software", 0, True
RegWrite HKEY_LOCAL_MACHINE,"TempHive\Microsoft\Windows NT\CurrentVersion\Winlogon","DefaultUserName", User
RegWrite HKEY_LOCAL_MACHINE,"TempHive\Microsoft\Windows NT\CurrentVersion\Winlogon","DefaultPassword", Password
RegWrite HKEY_LOCAL_MACHINE,"TempHive\Microsoft\Windows NT\CurrentVersion\Winlogon","DefaultDomainName", Domain
RegWrite HKEY_LOCAL_MACHINE,"TempHive\Microsoft\Windows NT\CurrentVersion\Winlogon","AutoAdminLogon", "1"
RegWriteDword HKEY_LOCAL_MACHINE,"TempHive\Microsoft\Windows NT\CurrentVersion\Winlogon","AutoLogonCount", Count
'If isNull(tempComputerName) Then
' SetAutoLogon = "Coudn't load local hive"
'Else
' SetAutoLogon = tempUserName
'End If
WSHShell.run "reg unload HKLM\TempHive", 0, True
Set WSHShell = Nothing
End Sub

Function RegRead(strRootKey, strKeyPath, strValueName)
RegRead = ""
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")
oReg.GetStringValue strRootKey, strKeyPath, strValueName, value
RegRead = value
End Function

Sub RegWrite(strRootKey, strKeyPath, strValueName, value)
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")
oReg.SetStringValue strRootKey, strKeyPath, strValueName, value
End Sub

Sub RegWriteDword(strRootKey, strKeyPath, strValueName, value)
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")
oReg.SetDwordValue strRootKey, strKeyPath, strValueName, value
End Sub

Posted in VBScripting | No Comments »

WindowsXP power management settings set via script

June 18th, 2007

With WindowsXP SP2 Microsoft has introduced a nice tool called powercfg which allows you to configure your powermanagement settings on you machine.

Before you even start trying to set any powermanagment settings make sure you’re administrator or simply add user permissions to the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CurrentVersion\Controls Folder\PowerCfg

Therefore you could use this batch script:
Make sure you have subinacl.exe

REM Powermanagement user permissions
subinacl.exe" /noverbose /subkeyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Controls FolderPowerCfg" /grant=users

That’s because some operations need administrative rights.

So let’s assume you want to create a master profile and deploy that to all your machines.

Define a master profile
Start->Run->”powercfg.cpl”->OK
PowerManagmentConfig
Change your settings to your needs and save it with a propriate name using Save As. So this will be your master profile. Now, we want that exported. Well, that’s quite easy…

Export the master profile

powercfg /export MyProfil /file YourFileName.pow

This will export all your power settings to a file which is located under the directory you where in at the time of the execution of it.

Import the master profile
importing the file is as easy as it was to export it. 

powercfg /IMPORT MyProfil /file "%~dp0YourFileName.pow"

Activate the profile
once it’s imported you’ve got to activate it by simply run the next command.

powercfg /SETACTIVE MyProfile

btw: %~dp0 stands for the current directory as you might know from linux/unix pwd (print working directory). It even works with a UNC path

Further informations

Posted in Software Deployment | No Comments »

How to disable ALT+F4 in a HTA file using VBScript

June 16th, 2007

Hey.. this is going to be my first blog… :-) yeahh…

If you ever wanted to block closing a hta file then you’re right here. I spend almost a day googling. Therefore I’d like to share my discovery to you all.

Instructions:
In your body tag add following

<body onkeydown="CheckKeys()">

With that it will call the function CheckKeys() every time you hit any key or key combination.

next, add this code to the HEAD tag in your hta file

<script language="VBscript">
Function CheckKeys() 
	If window.event.altKey And window.event.keyCode = 115
	Call alert("please do not close this window")
	document.parentWindow.event.keyCode = 0
	document.parentWindow.event.cancelBubble = true
	document.parentWindow.event.returnvalue = false
End If
</script>

Here we go with the CheckKey function which basically just is checking for certain keys or key combos. In this case alt + f4. Once it’s in the if statement it will reset the KeyCode and cancel the event. And set the events return value to false. I don’t know what is that for if you do feel free to let me know with a comment.

Posted in VBScripting | 2 Comments »