Powershell Registry Entry

Discussion in 'Scripting' started by infringer, Feb 12, 2015.

  1. infringer

    infringer MDL Novice

    Dec 30, 2010
    24
    5
    0
    #1 infringer, Feb 12, 2015
    Last edited by a moderator: Apr 20, 2017
    Ok I would like to enter this registry information using powershell need to be sure it is correct:

    Code:
    Windows Registry Editor Version 5.00
     
    [HKEY_CLASSES_ROOT\Applications\powershell.exe\shell\open\command]
    @="\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" \"& \\\"%1\\\"\""
    
    
    
    HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1
    (Default): REG_SZ – “PowerShell Script File”
    EditFlags: REG_DOWRD – Hex: 20000
    FriendlyTypeName: REG_EXPAND_SZ – @”%systemroot%\system32\windowspowershell\v1.0\powershell.exe”,-103
    
    HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1\DefaultIcon
    (Default): REG_SZ – “C:\WINDOWS\Installer\{48664066-BB69-408E-BD48-C21F6D347888}\ext.exe,0″
    
    HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1\Shell
    MUIVerb: REG_EXPAND_SZ – “@”%systemroot%\system32\windowspowershell\v1.0\powershell.exe “,-108″
    
    HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1\Shell\Command
    (Default): REG_SZ – “C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe” “-Command” “if((Get-ExecutionPolicy ) -ne ‘AllSigned’) { Set-ExecutionPolicy -Scope Process Bypass }; & ‘%1′”
    
    HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1\Shell\Edit
    (Default): REG_SZ – “C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe” “%1″
    Kinda learning a bit here so bear with me on syntax issues...

    This is what I have:


    Well any help on this is appreciated.

    Code:
     
    [HKEY_CLASSES_ROOT\Applications\powershell.exe\shell\open\command]
    @="\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" \"& \\\"%1\\\"\""
    
    Set-ItemProperty -Path "Registry::HKEY_CLASSES_ROOT\Applications\powershell.exe\shell\open\command" -Name "SpacesAllowedInScriptNames" -Value "@="\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" \"& \\\"%1\\\"\"""
    
    
    
    HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1
    (Default): REG_SZ – “PowerShell Script File”
    EditFlags: REG_DOWRD – Hex: 20000
    FriendlyTypeName: REG_EXPAND_SZ – @”%systemroot%\system32\windowspowershell\v1.0\powershell.exe”,-103
    
    Set-ItemProperty -Path "Registry::HKEY_CLASSES_ROOT\Microsoft.PowerShellscript.1" -Name "(Default)" -Value "Powershell Script File"
    Set-ItemProperty -Path "Registry::HKEY_CLASSES_ROOT\Microsoft.PowerShellscript.1" -Name "Editflags" -Type "DWORD" -Value "0x00020000"
    Set-ItemProperty -Path "Registry::HKEY_CLASSES_ROOT\Microsoft.PowerShellscript.1" -Name "FriendlyTypeName" -Value "@”%systemroot%\system32\windowspowershell\v1.0\powershell.exe”,-103"
    
    
    HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1\DefaultIcon
    (Default): REG_SZ – “C:\WINDOWS\Installer\{48664066-BB69-408E-BD48-C21F6D347888}\ext.exe,0″  
    Set-ItemProperty -Path "Registry::HKEY_CLASSES_ROOT\Microsoft.PowerShellscript.1\DefaultIcon" -Name "(Default)" -Value "C:\WINDOWS\Installer\{48664066-BB69-408E-BD48-C21F6D347888}\ext.exe,0"
    
    
    HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1\Shell
    MUIVerb: REG_EXPAND_SZ – “@”%systemroot%\system32\windowspowershell\v1.0\powershell.exe “,-108″
    
    Set-ItemProperty -Path "Registry::HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1\Shell" -Name "MUIVerb -Value “@”%systemroot%\system32\windowspowershell\v1.0\powershell.exe “,-108"
    
    HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1\Shell\Command
    (Default): REG_SZ – “C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe” “-Command” “if((Get-ExecutionPolicy ) -ne ‘AllSigned’) { Set-ExecutionPolicy -Scope Process Bypass }; & ‘%1′”
    
    
    Set-ItemProperty -Path "Registry::HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1\Shell\Command" -Name "(Default)" -Value “C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe” “-Command” “if((Get-ExecutionPolicy ) -ne ‘AllSigned’) { Set-ExecutionPolicy -Scope Process Bypass }; & ‘%1′”
    
    
    HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1\Shell\Edit
    (Default): REG_SZ – “C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe” “%1″
    
    Set-ItemProperty -Path "Registry::HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1\Shell\Edit -Name "(Default)" -Value “C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe” “%1"
    
    
    
    Thanks in advance !

    Edited I just uploaded the file I am trying to convert to a .ps1 registry change.


    -infringer-
     

    Attached Files:

    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  2. Compo

    Compo MDL Member

    Mar 29, 2011
    137
    103
    10
    #2 Compo, Feb 12, 2015
    Last edited by a moderator: Apr 20, 2017
    I know it's not the answer you're hoping for but why can you not just run the command REGEDIT /S FILENAME.REG from powershell?

    FILENAME.REG
    Code:
    Windows Registry Editor Version 5.00
     
    [HKEY_CLASSES_ROOT\Applications\powershell.exe\shell\open\command]
    @="\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" \"& \\\"%1\\\"\""
    
    [HKEY_CLASSES_ROOT\Microsoft.PowershellScript.1]
    @="PowerShell Script File"
    "EditFlags"=dword:00020000
    "FriendlyTypeName"=hex(2):40,00,22,00,25,00,73,00,79,00,73,00,74,00,65,00,6d,\
      00,72,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,\
      33,00,32,00,5c,00,77,00,69,00,6e,00,64,00,6f,00,77,00,73,00,70,00,6f,00,77,\
      00,65,00,72,00,73,00,68,00,65,00,6c,00,6c,00,5c,00,76,00,31,00,2e,00,30,00,\
      5c,00,70,00,6f,00,77,00,65,00,72,00,73,00,68,00,65,00,6c,00,6c,00,2e,00,65,\
      00,78,00,65,00,22,00,2c,00,2d,00,31,00,30,00,33,00,00,00
    
    [HKEY_CLASSES_ROOT\Microsoft.PowershellScript.1\DefaultIcon]
    @="\"C:\\Windows\\Installer\\{48664066-BB69-408E-BD48-C21F6D347888}\\ext.exe\",0"
    
    [HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1\Shell]
    "MUIVerb"=hex(2):40,00,22,00,25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,\
      6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,\
      00,5c,00,77,00,69,00,6e,00,64,00,6f,00,77,00,73,00,70,00,6f,00,77,00,65,00,\
      72,00,73,00,68,00,65,00,6c,00,6c,00,5c,00,76,00,31,00,2e,00,30,00,5c,00,70,\
      00,6f,00,77,00,65,00,72,00,73,00,68,00,65,00,6c,00,6c,00,2e,00,65,00,78,00,\
      65,00,20,00,22,00,2c,00,2d,00,31,00,30,00,38,00,00,00
    
    [HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1\Shell\Command]
    @="\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" \"-Command\" \"if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & '%1'\""
    
    [HKEY_CLASSES_ROOT\Microsoft.PowershellScript.1\Shell\Edit]
    
    [HKEY_CLASSES_ROOT\Microsoft.PowershellScript.1\Shell\Edit\Command]
    @="\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe\" \"%1\""
    
     
  3. infringer

    infringer MDL Novice

    Dec 30, 2010
    24
    5
    0
    It would defeat the purpose of what I am trying to accomplish a better understanding of powershell itself and the easiest way for me to learn is by example. To me powershell has an ability to accomplish everything in automation providing you give it the proper data. Elimination of prompts is nice while any automation can be used for bad reasons we should not let that take automation away from the user if that is what they prefer. There are a million and one reasons for automation the largest of them is to eliminate menial tasks. Let us be honest here if one would realize how much time they could save in their life by not having to use a light switch they would likely do it in an automated fashion. We are far to used to doing menial tasks and wasting our valued time doing it. Powershell for me is a way to overcome such wastes of time. Lets say you spend 5 minutes out of your day flipping light switches by the time you have reached 70 you would have wasted 89 days of your life flipping light switches.... Hrmmm I don't know about you but when I think of this If I could have 89 more days to live by not touching another light switch it certainly lends a bit more credibility to automation. I feel there are similar things in computing while the computer makes it possible to automate there are latent protocols that eat into our productivity as well. I think powershell is a tool that has an ability to fix this.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  4. Compo

    Compo MDL Member

    Mar 29, 2011
    137
    103
    10
    #4 Compo, Feb 13, 2015
    Last edited by a moderator: Apr 20, 2017
    Taking your light switch analogy; Why waste 89 life days creating a light switch which will only turn on the the same light as that which I provided in my last response.
    I hope you did note that I actually provided you with a fully working light switch to your specification.

    I understand you're wanting to learn powershell, the best way to do that is to keep trying to do it yourself, not ask others and then try to understand exactly the process they decided on and if it suits you. The problem with asking others is that there are so many ways of doing things in powershell and it is inevitable that there will be clashes.

    To start you off however, I'll give you some information.
    In powershell by default only the HKLM and HKCU branches are open to you by default, so you have to decide if you want to open up the HKCR branch
    Code:
    New-PSDrive -PSProvider registry -Root HKEY_CLASSES_ROOT -Name HKCR
    or be aware that the HKCR branch is mirrored in HKEY_LOCAL_MACHINE\SOFTWARE\Classes and work directly in the HKLM branch.
    Code:
    New-item HKLM:\SOFTWARE\Classes\Microsoft.PowershellScript.1\Shell\Edit -force
    Good luck!
     
  5. infringer

    infringer MDL Novice

    Dec 30, 2010
    24
    5
    0
    #5 infringer, Feb 21, 2015
    Last edited by a moderator: Apr 20, 2017
    (OP)
    Could we start this over and make things more simple for the question to be answered?


    Maybe this is more about syntax confusion for me so using this instance:

    (Note: It may be possible that this is incorrect as well I suppose for syntax for regedit)

    Code:
    [HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1]
    EditFlags: REG_DOWRD – Hex: 20000
    You are saying the above is incorrect and below is correct for regedit right?


    Code:
    [HKEY_CLASSES_ROOT\Microsoft.PowershellScript.1]
    "EditFlags"=dword:00020000
    Or possibly both will work will they?

    But lets use this instance to clear the air for me as this will help me be sure I am doing things correctly as there are two elements that both require data using specific patterns or syntax.

    My thoughts on how it would be done in powershell

    Code:
    Set-ItemProperty -Path "Registry::HKEY_CLASSES_ROOT\Microsoft.PowerShellscript.1" -Name "Editflags" -Type "DWORD" -Value "0x00020000" 
    How would you accomplish this same thing via powershell to set this single method show me?


    Would it be like this?:

    Code:
    New-PSDrive -PSProvider registry -Root HKEY_CLASSES_ROOT -Name HKCR
    Set-ItemProperty -Path "Registry::HKCR\Microsoft.PowerShellscript.1" -Name "Editflags" -Type "DWORD" -Value "0x00020000" 
    If So,
    Could we just keep HKEY_CLASSES_ROOT as it is dunno why we have to use HKCR I know it is shorter but it almost seems as if we are giving it a short name HKCR in the above example unless the name is something that already exists ?

    for instance:
    Code:
    New-PSDrive -PSProvider registry -Root HKEY_CLASSES_ROOT -Name HKEY_CLASSES_ROOT
    Set-ItemProperty -Path "Registry::HKEY_CLASSES_ROOT\Microsoft.PowerShellscript.1" -Name "Editflags" -Type "DWORD" -Value "0x00020000" 
    
    Finally The below bit of info you gave me.

    Code:
    New-item HKLM:\SOFTWARE\Classes\Microsoft.PowershellScript.1\Shell\Edit -force
    I see you are using the -force switch here are you using it like a group policy edit

    So does it copy from HKLM upon restart if so then this would work I am thinking:

    Code:
    Set-ItemProperty -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellscript.1" -Name "Editflags" -Type "DWORD" -Value "0x00020000" -force
    

    If not I am confused so just bare with me as I try to grasp some understanding out of these simple examples.

    Are you telling me it is mirrored because I can use it in this fashion?

    Or are you telling me it is mirrored because I need to copy it to both?

    Or it is possible you are telling me that it is mirrored so that I can use either and having access to the one already it is potentially easier to accomplish the task which still leaves the -force switch in question to me.

    It is possible that I have to use New-Item for registry keys that do not exist would be nice to know this too I suppose. I realize I must do some more reading I have created some successful scripts to automate quite a bit for me already but either way I want to get this stuff learned to automate registry entries with powershell this is the goal If you can no longer help for whatever reason even if you are annoyed just say so I will not take offense to it!

    Note: this has been edited many times for simplicity of your understanding and my own understanding.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  6. Compo

    Compo MDL Member

    Mar 29, 2011
    137
    103
    10
    The value data type was defined as REG_EXPAND_SZ, the HEX format I used is correct for REGEDIT input for that data type.

    You are of course correct in assuming that when viewed in the registry editor the data will look like the intended ASCII notation.
     
  7. infringer

    infringer MDL Novice

    Dec 30, 2010
    24
    5
    0
    The edits were many but the question no longer exists about hex to me it was pretty evident what was being done ...

    Must have caught me mid stream when asking the question but I figured why not dumb my question down a bit and come to the same conclusion that I am trying to arrive at.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  8. Compo

    Compo MDL Member

    Mar 29, 2011
    137
    103
    10
    #8 Compo, Feb 22, 2015
    Last edited by a moderator: Apr 20, 2017
    Here's something to get your teeth into.

    FILENAME.PS1
    Code:
    If (-Not (Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\powershell.exe\shell\open\command")){
    New-Item -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\powershell.exe\shell\open\command" -ItemType RegistryKey -Force
    }
    Set-ItemProperty -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\powershell.exe\shell\open\command" -Name "(Default)" -Type "String" -Value "`"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe`" `"& \`"%1\`"`""
    If (-Not (Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowershellScript.1")){
    New-Item -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowershellScript.1" -ItemType RegistryKey -Force
    }
    Set-ItemProperty -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowershellScript.1" -Name "(Default)" -Type "String" -Value "PowerShell Script File"
    Set-ItemProperty -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowershellScript.1" -Name "EditFlags" -Type "DWord" -Value "0x00020000"
    Set-ItemProperty -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowershellScript.1" -Name "FriendlyTypeName" -Type "ExpandString" -Value "@`"%systemroot%\system32\windowspowershell\v1.0\powershell.exe`",-103"
    If (-Not (Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowershellScript.1\DefaultIcon")){
    New-Item -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowershellScript.1\DefaultIcon" -ItemType RegistryKey -Force
    }
    Set-ItemProperty -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowershellScript.1\DefaultIcon" -Name "(Default)" -Type "String" -Value "`"C:\Windows\Installer\{48664066-BB69-408E-BD48-C21F6D347888}\ext.exe`",0"
    If (-Not (Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\Shell")){
    New-Item -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\Shell" -ItemType RegistryKey -Force
    }
    Set-ItemProperty -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\Shell" -Name "MUIVerb" -Type "ExpandString" -Value "@`"%systemroot%\system32\windowspowershell\v1.0\powershell.exe `",-108"
    If (-Not (Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\Shell\Command")){
    New-Item -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\Shell\Command" -ItemType RegistryKey -Force
    }
    Set-ItemProperty -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\Shell\Command" -Name "(Default)" -Type "String" -Value "`"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe`" `"-Command`" `"if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & '%1'`""
    If (-Not (Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowershellScript.1\Shell\Edit")){
    New-Item -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowershellScript.1\Shell\Edit" -ItemType RegistryKey -Force
    }
    If (-Not (Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowershellScript.1\Shell\Edit\Command")){
    New-Item -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowershellScript.1\Shell\Edit\Command" -ItemType RegistryKey -Force
    }
    Set-ItemProperty -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowershellScript.1\Shell\Edit\Command" -Name "(Default)" -Type "String" -Value "`"C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe`" `"%1`""
    
     
  9. infringer

    infringer MDL Novice

    Dec 30, 2010
    24
    5
    0
    #9 infringer, Feb 23, 2015
    Last edited by a moderator: Apr 20, 2017
    (OP)
    The most interesting thing is you are able to not only address the info of syntax but you can also address the info of what I am trying to do and correct some of my missing ' marks as well very elaborate I can tell you worked with this stuff a bit

    For instance:
    Code:
    Set-ItemProperty -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\powershell.exe\shell\open\command" -Name "(Default)" -Type "String" -Value "`"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe`" `"& \`"%1\`"`""
    
    I had this as:

    Code:
    Set-ItemProperty -Path "Registry::HKEY_CLASSES_ROOT\Applications\powershell.exe\shell\open\command" -Name "SpacesAllowedInScriptNames" -Value "@="\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" \"& \\\"%1\\\"\"""
    
    This was due to copying from notepad so I assume you are correct by adding the ' Marks where needed. I assume this is like C markup where a string starts is like 'string of information here' indicating a string?
    Or is it indicating that there is multiple values or strings?
    I guess I will have to look more into when and why to use the ' mark for powershell I assume you would need that same info for regedit as well?

    Excellent now that is something that I can dig using the " if "- statements to check if they are already there!

    I suppose if one wanted to be safer they could export the keys with powershell as well before changing them to a directory as well ;)
    Like so:

    Code:
    If (-Not (Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\powershell.exe\shell\open\command")){
    New-Item -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\powershell.exe\shell\open\command" -ItemType RegistryKey -Force
    }
    Reg Export "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\powershell.exe\shell\open\command" C:\Powershell Open Command.reg
    Set-ItemProperty -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\powershell.exe\shell\open\command" -Name "(Default)" -Type "String" -Value "`"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe`" `"& \`"%1\`"`""
    
    I must admit this was every bit as good as a fresh baked chocolate chip cookie! :p
    Getting the syntax right holds a great deal of importance one wrong markup could put you in an interesting spot you don't want to be in so the export is rather nice before making changes.


    Registry Hive Structure and syntax Information for any of those wondering:

    The Windows Registry is a hierarchical database that contains all of the configurations and settings used by components, services, applications, and pretty much everything in Windows.

    The interesting thing that most people don’t know is that three of the five items on the root level aren’t actually there… they are just linked to items further down in one of the other keys.
    HKEY_CLASSES_ROOT

    Windows uses this section to manage file type associations, and it is usually abbreviated HKCR when being referenced in documentation. This key is actually just a link to HKLM\Software\Classes.

    You can also use this section if you want to tweak the context menu for a particular file type.
    HKEY_CURRENT_USER

    Holds the user settings for the currently logged in user, and is usually abbreviated HKCU This is actually just a link to HKEY_USERS\<SID-FOR-CURRENT-USER>. The most important sub-key in here is HKCU\Software, which contains user-level settings for most of your software.
    HKEY_LOCAL_MACHINE

    All of the system-wide settings are stored here, and it is usually abbreviated as HKLM. You’ll mostly use the HKLM\Software key to check machine-wide settings.
    HKEY_USERS

    Stores all of the settings for all users on the system. You’ll typically use HKCU instead, but if you need to check settings for another user on your computer, you can use this one.
    HKEY_CURRENT_CONFIG

    Stores all of the information about the current hardware configuration. This one isn’t used very often, and it just a link to HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\Current.

    This should sum up the structure for those still wondering or reading ;) While I have made many different registry keys base off of just looking and modifying or importing or exporting and editing I would say I guess I never fully understood the structure good to know for all out there ....

    Of course the syntax was another question for the most part I used other keys as reference to cheat more or less...

    Code:
    RegistryEditorVersion
    Blank line
    [RegistryPath1] 
    "DataItemName1"="DataType1:DataValue1"
    DataItemName2"="DataType2:DataValue2" <----- Hrmm this is what it says on M$ website shouldn't it be MISSING QUOTE HERE> "DataItemName2"="DataType2:DataValue2" Quite possibly a typo  if I recall correct it is indeed missing a quote!
    Blank line
    [RegistryPath2] 
    "DataItemName3"="DataType3:DataValue3"
    
    Maybe you can clear this up for me is it missing a " mark at the beginning of DataItemName2" or is this how it is supposed to be?

    Take a look for yourself Microsoft made this post about syntax and if they got it wrong http://support.microsoft.com/kb/310516/ double facepalm on that one!


    Also the data types are as follows:


    String Value (REG_SZ) – This contains anything that will fit into a regular string. The vast majority of the time, you can edit human-readable strings without breaking everything.
    Binary Value (REG_BINARY) – This value contains arbitrary binary data, and you will almost never want to attempt to edit one of these keys.
    DWORD (32-bit) Value (REG_DWORD) – These are almost always used for a regular integer value, whether just 0 or 1, or a number from 0 to 4,294,967,295.
    QWORD (64-bit) Value (REG_QWORD) – These are not used very often for registry hacking purposes, but it’s basically a 64-bit integer value.
    Multi-String Value (REG_MULTI_SZ) – These values are fairly uncommon, but it works basically like a notepad window. You can type multi-line textual information into a field like this.
    Expandable String Value (REG_EXPAND_SZ) – These variables have a string that can contain environment variables and is often used for system paths. So a string might be %SystemDrive%\Windows and would expand to C:\Windows. This means that when you find a value in the Registry that is set to this type, you can change or insert environment variables and they will be “expanded” before the string is used.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...