Deleting reg Keys - getting user Sid

[glennda]

I'm trying to script something to delete printer connections which are stuck in the registry (through some third party software).

 

The problem is they are in HKEY_Users\\Printers\Connections\,,Printername,

 

I've looked at reg delete but can't seem to get it to work with wildcards!

 

I did start a thread a while back here but its sligtly different this time!

Edited July 18, 2012 by glennda

[glennda]

I think I can get the user sid by doing this wmic useraccount get name, sid | findstr %username% - just need to work out a way for doing that in a batch/vbs to then combine with the reg delete

[mac_shinobi]

What code have you got so far, what scripting language is this in ?

 

Is this only for specific users and you are trying to convert SID to username so you know which users to delete the registry keys from, also have you got the printer names or you doing it for any printer connections for a specific user or users ?

 

Link below ( obviously you have the wmic code already )

 

http://pcsupport.about.com/od/registry/ht/find-user-security-identifier.htm

Edited July 18, 2012 by mac_shinobi

[K.C.Leblanc]

If they're the currently logged on user HKEY_Users\ is the same as HKCU\. Could you just add reg delete line to their log on scripts or use GPP. Edited July 18, 2012 by K.C.Leblanc

[glennda]

If they're the currently logged on user HKEY_Users\ is the same as HKCU\

 

Thats what I thought - but if you look under HKCU\Printers\Connections there is none - if I look under HKU\\PRINTERS\connections there is the printers listed - remove these and it keys below and the printers are removed from printers and faxes.

 

So Far I know that

 

reg delete HKU\\Printer\Connections\,,servername,printername works

 

and

 

wmic useraccount get name, sid | findstr %username%

 

outputs

username

 

Just need a way to combine the two to do what i need!

[mac_shinobi]

VBS Getting SID for currently logged on user :

 

'find current user & domain
Set wshShell = CreateObject("WScript.Shell")
strUsername = wshShell.ExpandEnvironmentStrings("%USERNAME%")
strDomain = wshShell.ExpandEnvironmentStrings("%USERDOMAIN%")

'WScript.Echo "Username: " & strUsername
'WScript.Echo "Domain: " & strDomain

'use the user/domain information to retrieve the SID of the user and print it to the screen
WScript.Echo getSid()

Private Function getSid()
strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

Set objAccount = objWMIService.Get("Win32_UserAccount.Name='" & strUsername & "',Domain='" & strDomain & "'")
getSID = objAccount.SID
End Function

 

You able to post back a screen grab of registry window where the key(s) are so I can see the registry type ie reg_sz or whatever

 

Also are you deleting just one registry key or a registry key and all of its sub keys etc ??

 

Am looking at the below link regards to deletion of a registry key

 

Posteet: VBScript : How to delete a Windows' registry key and all its subkeys [delete] [registry] [remove] [vbscript] [windows]

 

Then just a case of using the getsid() as a variable in the registry key so

 

'DeleteRegKeyAndSubKeys "HKEY_USERS", "HKU\" & getsid() & "\Printer\Connections\,,servername,printer  name"

Am not sure if you need to get the servername and printer name via code as well ??

 

If it is just the deletion of one key then the code to delete it will be a lot shorter than the link above

Edited July 18, 2012 by mac_shinobi

[sted]

can you do it via group policy preferences?

[glennda]

@mac_shinobi

 

 

Basicly all of the keys under connections.

[glennda]

can you do it via group policy preferences?

 

Its not all users so just want to be able to do it ad-hock.

[AngryTechnician]

Thats what I thought - but if you look under HKCU\Printers\Connections there is none - if I look under HKU\\PRINTERS\connections there is the printers listed

This sounds very dodgy indeed. On my account, the printers are listed identically in both places, and HKCU is supposed be be nothing more than a pointer to the correct HKU\SID node.

[mac_shinobi]

Not thoroughly tested but something like :

 

Const HKEY_CLASSES_ROOT  = &H80000000
Const HKEY_CURRENT_USER  = &H80000001
Const HKEY_LOCAL_MACHINE  = &H80000002
Const HKEY_USERS   = &H80000003
Const HKEY_CURRENT_CONFIG  = &H80000005

Set wshShell = CreateObject("WScript.Shell")
strUsername = wshShell.ExpandEnvironmentStrings("%USERNAME%")
strDomain = wshShell.ExpandEnvironmentStrings("%USERDOMAIN%")

strComputer = "."
Set StdOut = WScript.StdOut

Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")

strKeyPath =  Trim(getSid()) & "\Printers\Connections\"

msgbox strKeyPath
oReg.EnumKey HKEY_USERS, strKeyPath, arrSubKeys

For Each subkey In arrSubKeys
   WshShell.RegDelete "HKEY_USERS\" & strKeyPath & subkey & "\"
Next

Private Function getSid()

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set objAccount = objWMIService.Get("Win32_UserAccount.Name='" & strUsername & "',Domain='" & strDomain & "'")
getSID = objAccount.SID
End Function

@glennda - might want to test this on a dummy machine or one that you are not too worried about just to make sure it is doing what it should do. Not done any error checking etc

Edited July 18, 2012 by mac_shinobi

[glennda]

Thanks that works brilliantly!

 

At the end end of the script it echo's the registy value - any idea what to remove?

 

I havn't got a clue with VB you see!

 

EDIT: - removed the obvious message box line!

Edited July 18, 2012 by glennda

[Steve21]

Thanks that works brilliantly!

 

At the end end of the script it echo's the registy value - any idea what to remove?

 

I havn't got a clue with VB you see!

 

msgbox strKeyPath

 

I'm assuming that bit you mean?

 

Steve

[glennda]

msgbox strKeyPath

 

I'm assuming that bit you mean?

 

Steve

 

yeah i noticed that after - edited line above!

[mac_shinobi]

sorry was in a bit of a rush - also there is the stdout line - I think ( not sure ) but you may be able to remove that as well.

 

 

Set StdOut = WScript.StdOut

[glennda]

sorry was in a bit of a rush - also there is the stdout line - I think ( not sure ) but you may be able to remove that as well.

 

 

Set StdOut = WScript.StdOut

 

Don't worry you have done me a massive favour!!

[mac_shinobi]

Don't worry you have done me a massive favour!!

 

Anytime, As per @sted mentioned, just curious if there is a more official and better method of doing this. I know you can use the rundll32 printui.dll command to delete / remove printers, not sure in regards to GPO / GPP etc as far as it removing printers ??

 

edit - @Steve21 is a lot better than myself at coding, think I've managed to leave illegal operators etc in previous code so still got a learning curve.

Edited July 18, 2012 by mac_shinobi

[glennda]

Anytime, As per @sted mentioned, just curious if there is a more official and better method of doing this. I know you can use the rundll32 printui.dll command to delete / remove printers, not sure in regards to GPO / GPP etc as far as it removing printers ??

 

edit - @Steve21 is a lot better than myself at coding, think I've managed to leave illegal operators etc in previous code so still got a learning curve.

 

I tried the rundll32 printui and it wouldn't delete the printers nor would the gui hence why i had to dig further and further!

[Steve21]

edit - @Steve21 is a lot better than myself at coding, think I've managed to leave illegal operators etc in previous code so still got a learning curve.

 

 

Pfft You do good. Was only because of the whole HTA bit that it wasn't working!

 

Steve

[mac_shinobi]

Still never managed to get the HTA working as I wanted - I still liked the way you formatted the html and combined that with WMI querries etc lol.

[mac_shinobi]

There isn't any other keys that need deleting from HKCU or the likes as a comment above states that something else points to the HKU keys ?

[glennda]

There isn't any other keys that need deleting from HKCU or the likes as a comment above states that something else points to the HKU keys ?

 

Not from what I can see and have read elsewhere - essentially after an old server was decommissioned the printers where lingering on the client machines (although they should have previously been removed). But windows tends to get funny when you try to delete printers on a machine which don't exist any more.

[mac_shinobi]

Just as an update ( may or may not find this helpful / handy etc ) but found this link :

 

Remove Printer Definition from the Registry

 

There is a problem with NT printer definitions that may cause you problems. You follow standard advice to uninstall and reinstall the printer driver. Sometimes this doesn't fix the problem and you have no choice but to remove a printer. When you use the Remove or Delete Printer options in Print Manager, the printer connection disappears immediately. However, the spooler simply marks the printer for deletion. NT doesn't actually delete the printer until you reboot the system. Sometimes NT will delete the definition if you stop and restart the spooler. Sometimes it doesn't. If this doesn't work, and you will find out when you try to redefine the printer. No issue for workstations. You can reboot. Unfortunately there are servers which can not be rebooted (or at least not for something like a printer definition). For servers which can not be rebooted, you can remove the printer definition from the registry by hand prior to the reinstall. If it is a local printer (My Computer), go to the following registry keys and delete the respective entries:

 

 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\ Windows NT x86\ Drivers\Version-2\

 

 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers\

 

 

If it is a network printer (network printer server or \\), go to the following registry keys and delete the respective and entries:

 

 

HKEY_CURRENT_USER\Printers\Connections\

 

 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Providers\ LanMan Print Services\Servers\\Printers\

 

 

After the registry edit, you need to stop and restart the spooler service. At this point, you'll be able to reinstall the printer driver correctly.