Reading Writing Remote RegistryItem

Targets Windows
1

Hello all,

I am working on a project where I am trying to read and write to remote registry keys and folders. I looked over the documentation for RegistryItem but I do not see any way to connect or authenticate with a remote computer/registry. Does anyone have any suggestions on how to do this?

Your time and help is much appreciated!

Thanks,
Mike

2

You may be able to use a shell to authenticate to the remote machine before attempting to update the registry on that machine.

Try

Dim sh As New Shell sh.Mote = 0 sh.Timeout = 10000 sh.execute("NET USE \\\\<ip address of remote machine> /user:<administrator user> <password>)

I use this technique to authenticate before using a unc path to shared folders on a remote server.

Don’t forget to use NET USE \\\\<ip address of remote machine> /delete when done.

HTH

3

[quote=370444:@Wayne Golding]You may be able to use a shell to authenticate to the remote machine before attempting to update the registry on that machine.

Try

Dim sh As New Shell sh.Mote = 0 sh.Timeout = 10000 sh.execute("NET USE \\\\<ip address of remote machine> /user:<administrator user> <password>)

I use this technique to authenticate before using a unc path to shared folders on a remote server.

Don’t forget to use NET USE \\\\<ip address of remote machine> /delete when done.

HTH[/quote]

i assume this is only for Windows only

4

Thanks for that suggestion Wayne! I gave that a try but I got a “RegistryAccessErrorException” when using the following code:

[code]Dim sh As New Shell
sh.Mote = 0
sh.Timeout = 10000
sh.execute("NET USE \\192.168.1.141 /user:admin changeme)

Dim regtest As New RegistryItem(“192.168.1.141\HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node”, False)[/code]

In addition, I also made sure the “Remote Registry” service was enabled on the target machine. However, I am not sure where to go at this point.

5

Can I suggest you try Dim regtest As New RegistryItem("192.168.1.141\\HKEY_LOCAL_MACHINE\\SOFTWARE", False).

On the local machine when running a 32bit application HKEY_LOCAL_MACHINE\SOFTWARE is mapped to HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SOFTWARE automatically so the entry you are looking for may not exist.

Just guessing here though.

6

[quote=370565:@Wayne Golding]Can I suggest you try Dim regtest As New RegistryItem("192.168.1.141\\HKEY_LOCAL_MACHINE\\SOFTWARE", False).

On the local machine when running a 32bit application HKEY_LOCAL_MACHINE\SOFTWARE is mapped to HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SOFTWARE automatically so the entry you are looking for may not exist.

Just guessing here though.[/quote]

Just gave that a try but no luck with that either - still getting the RegistryAccessErrorException

Also - I tried putting \\ in front of the IP address and same error by doing that as well

7

I thought to do anything with the registry your app has to be running with administrator privileges, even local machine key changes. (Not a Windows guy, so would love to be wrong).

8

Excellent point Tim! I just compiled my app and ran as admin and I am still getting the same RegistryAccessErrorException

9

How about using winapi directly?

10

I’m open to this idea Asis, but I am not really sure how to do that - do you have an example?

11

Ok, first connect to the remote machine registry by using RegConnectRegistry and then call RegOpenKeyEx.

LONG WINAPI RegConnectRegistry(
  _In_opt_ LPCTSTR lpMachineName,
  _In_     HKEY    hKey,
  _Out_    PHKEY   phkResult
);

Pass phkResult to RegOpenKeyEx as hKey

LONG WINAPI RegOpenKeyEx(
  _In_     HKEY    hKey,
  _In_opt_ LPCTSTR lpSubKey,
  _In_     DWORD   ulOptions,
  _In_     REGSAM  samDesired,
  _Out_    PHKEY   phkResult
);

https://msdn.microsoft.com/en-us/library/windows/desktop/ms724840(v=vs.85).aspx
https://msdn.microsoft.com/en-us/library/windows/desktop/ms724897(v=vs.85).aspx

12

Check this Visual BASIC code

https://support.microsoft.com/en-us/help/315586/how-to-access-the-registry-on-a-remote-computer-by-using-visual-basic