Deleting reg Keys - getting user Sid

[glennda]

I'm trying to script something to delete printer connections which are stuck in the registry (through some third party software).

The problem is they are in HKEY_Users\<USER-SID>\Printers\Connections\,,Printername,

I've looked at reg delete but can't seem to get it to work with wildcards!

I did start a thread a while back here but its sligtly different this time!

[glennda]

I think I can get the user sid by doing this wmic useraccount get name, sid | findstr %username% - just need to work out a way for doing that in a batch/vbs to then combine with the reg delete

[mac_shinobi]

What code have you got so far, what scripting language is this in ?

Is this only for specific users and you are trying to convert SID to username so you know which users to delete the registry keys from, also have you got the printer names or you doing it for any printer connections for a specific user or users ?

Link below ( obviously you have the wmic code already )

http://pcsupport.about.com/od/regist...identifier.htm

[K.C.Leblanc]

If they're the currently logged on user HKEY_Users\<USER-SID> is the same as HKCU\. Could you just add reg delete line to their log on scripts or use GPP.

[glennda]

If they're the currently logged on user HKEY_Users\<USER-SID> is the same as HKCU\

Thats what I thought - but if you look under HKCU\Printers\Connections there is none - if I look under HKU\<SID>\PRINTERS\connections there is the printers listed - remove these and it keys below and the printers are removed from printers and faxes.

So Far I know that

reg delete HKU\<sid>\Printer\Connections\,,servername,printer name works

and

wmic useraccount get name, sid | findstr %username%

outputs
username <sid>

Just need a way to combine the two to do what i need!

[mac_shinobi]

VBS Getting SID for currently logged on user :

'find current user & domain
Set wshShell = CreateObject("WScript.Shell")
strUsername = wshShell.ExpandEnvironmentStrings("%USERNAME%")
strDomain = wshShell.ExpandEnvironmentStrings("%USERDOMAIN%")

'WScript.Echo "Username: " & strUsername
'WScript.Echo "Domain: " & strDomain

'use the user/domain information to retrieve the SID of the user and print it to the screen
WScript.Echo getSid()

Private Function getSid()
strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

Set objAccount = objWMIService.Get("Win32_UserAccount.Name='" & strUsername & "',Domain='" & strDomain & "'")
getSID = objAccount.SID
End Function

You able to post back a screen grab of registry window where the key(s) are so I can see the registry type ie reg_sz or whatever

Also are you deleting just one registry key or a registry key and all of its sub keys etc ??

Am looking at the below link regards to deletion of a registry key

Posteet: VBScript : How to delete a Windows' registry key and all its subkeys [delete] [registry] [remove] [vbscript] [windows]

Then just a case of using the getsid() as a variable in the registry key so

'DeleteRegKeyAndSubKeys "HKEY_USERS", "HKU\" & getsid() & "\Printer\Connections\,,servername,printer  name"

Am not sure if you need to get the servername and printer name via code as well ??

If it is just the deletion of one key then the code to delete it will be a lot shorter than the link above

[sted]

can you do it via group policy preferences?

[glennda]

@mac_shinobi

SHW reg keys.png

Basicly all of the keys under connections.

[glennda]

can you do it via group policy preferences?

Its not all users so just want to be able to do it ad-hock.

[AngryTechnician]

Thats what I thought - but if you look under HKCU\Printers\Connections there is none - if I look under HKU\<SID>\PRINTERS\connections there is the printers listed

This sounds very dodgy indeed. On my account, the printers are listed identically in both places, and HKCU is supposed be be nothing more than a pointer to the correct HKU\SID node.

[mac_shinobi]

Not thoroughly tested but something like :

Const HKEY_CLASSES_ROOT  = &H80000000
Const HKEY_CURRENT_USER  = &H80000001
Const HKEY_LOCAL_MACHINE  = &H80000002
Const HKEY_USERS   = &H80000003
Const HKEY_CURRENT_CONFIG  = &H80000005

Set wshShell = CreateObject("WScript.Shell")
strUsername = wshShell.ExpandEnvironmentStrings("%USERNAME%")
strDomain = wshShell.ExpandEnvironmentStrings("%USERDOMAIN%")

strComputer = "."
Set StdOut = WScript.StdOut
 
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")
 
strKeyPath =  Trim(getSid()) & "\Printers\Connections\"

msgbox strKeyPath
oReg.EnumKey HKEY_USERS, strKeyPath, arrSubKeys
 
For Each subkey In arrSubKeys
    WshShell.RegDelete "HKEY_USERS\" & strKeyPath & subkey & "\"
Next

Private Function getSid()

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set objAccount = objWMIService.Get("Win32_UserAccount.Name='" & strUsername & "',Domain='" & strDomain & "'")
getSID = objAccount.SID
End Function

@glennda - might want to test this on a dummy machine or one that you are not too worried about just to make sure it is doing what it should do. Not done any error checking etc

[glennda]

Thanks that works brilliantly!

At the end end of the script it echo's the registy value - any idea what to remove?

I havn't got a clue with VB you see!

EDIT: - removed the obvious message box line!

[Steve21]

Thanks that works brilliantly!

At the end end of the script it echo's the registy value - any idea what to remove?

I havn't got a clue with VB you see!

msgbox strKeyPath

I'm assuming that bit you mean?

Steve

[glennda]

msgbox strKeyPath

I'm assuming that bit you mean?

Steve

yeah i noticed that after - edited line above!

[mac_shinobi]

sorry was in a bit of a rush - also there is the stdout line - I think ( not sure ) but you may be able to remove that as well.


Set StdOut = WScript.StdOut