Why/how are Registry Entries Hidden in Regedit but visible in PowerShell? - windows

I'm working with a new property schema, and have been in the habit of checking the registry when I register or unregister a new version. One of the primary places to check this is HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\PROPERTYSYSTEM\PROPERTYSCHEMA.
Interestingly, I occasionally lose access to this registry location in Regedit. I see see this (note the absence of PropertySchema):
I know the schemas are still registered, because I can use the prop.exe tool and propschema SDK sample application to describe them. The properties are available in Windows Explorer and in Search.
Also, I can use PowerShell to list the contents of this hive:
C:\Users\carlton> cd hklm:
HKLM:\>
C:\Users\carlton> cd hklm:
HKLM:\> cd SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\PROPERTYSYSTEM\PROPERTYSCHEMA
HKLM:\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\PROPERTYSYSTEM\PROPERTYSCHEMA> dir
Hive: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\PROPERTYSYSTEM\PROPERTYSCHEMA
Name Property
---- --------
0000 (default) : C:\Program Files\Internet Explorer\ie9props.propdesc
SchemaId : {D9B5ABA1-5E8A-4902-B6A1-50B3C0311C2E}
URI : ie9props.propdesc
CompactURI : 5376bae4b39f43768806afcb6b8ff5464bf9c989d1a819c6e6d99ba1e8ce2512
0001 (default) : C:\Program Files\Microsoft Office\Office14\Custom.propdesc
SchemaId : {537AAAB1-1D85-48DC-A99E-16EB8C309FE5}
URI : custom.propdesc
CompactURI : 2e3be58e5cbbc0da093956b46a3905f11cf0f5bbf11987a8619e25f7261ee8be
0002 (default) : C:\apps\MSOffice\Office14\VisioCustom.propdesc
SchemaId : {18503526-0466-4942-AC6E-41C1D380EABA}
URI : visiocustom.propdesc
...
Anyway, I don't understand how this happens, and whether I should be worried about it. Exporting this key from a colleague's machine and re-importing it can temporarily help, as it will show keys in Regedit that were hidden/missing (even if they weren't on my colleague's machine).
I'm in the Administrators group, running Windows 7 SP1.

The 32bit program data on 64bit systems available in 'Wow6432Node' folder of the registry (in above case 'SOFTWARE\Wow6432Node\MICROSOFT\WINDOWS...'). This is transparent to the applications, hence you can read data from applications but you don't see that in Regedit.

Harry Johnston's intuition was correct. I re-ran regedit from a command line with the path c:\windows\regedit, and I once again see what I expected under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\PropertySchema. I could've sworn it wasn't showing it either, but it's working now, apparently.
I confirmed as much by exporting the parent key (PropertySystem) from the 64-bit and 32-bit regedit's and running Beyond Compare. The propdesc files are verily not there in the 32-bit version.
See 32-bit and 64-bit Application Data in the Registry (MSDN)

Related

PowerShell CmdLet "Export-WindowsImage" - Why is the parameter "DestinationName" not working at all?

System: Windows 10 20H2 Enterprise SAC
PowerShell: 5.1.19041.1320
Windows ADK: 10.1.19041.1
If i run the PowerShell CmdLet "Export-WindowsImage", everything works as expected, except that the name for the image is not changed in the new image file if i use the parameter "-DestinationName".
Example:
Export-WindowsImage -SourceImagePath install.wim -SourceName "Windows 11 Enterprise N" -DestinationImagePath export.wim -DestinationName "Windows 11"
Get-WindowsImage -ImagePath export.wim
ImageIndex : 1
ImageName : Windows 11 Enterprise N
ImageDescription : Windows 11 Enterprise N
ImageSize : 15.721.845.834 bytes
Logfile doesn't help either, all this CmdLet logs in the dism logfile is this, no matter what loglevel i use:
Initializing wimgapi.
Shutting down wimgapi.
When i export the image via DISM & "/DestinationName", it works as expected, and the image is saved with it's new name in the new file.
I think i ran into this issue before and that's why i ended up dropping PowerShell for my WIM shenanigans. I just tried again and this still appears to be a thing, must have been at least 3 years now.
This issue has been reported to Microsoft, but didn't really net any fruitful help:
https://github.com/MicrosoftDocs/windows-powershell-docs/issues/1194
Sadly i can't find any other information relating to this problem.
Assuming that this is a bug, where would be the correct place to report this to Microsoft, if such a place even exists?
Or is there anything obvious i am missing here?

How to install tnsping?

How do I have to install tnsping?
I tried to install oracle-instantclient12.1-basic-12.1.0.2.0-1.x86_64.rpm and I'm able to use some client commands but nog tnsping.
Oracle Instance Client does not include tsnping application. You must run "Oracle Universal Installer" and enable the option for it.
I don't' remember exactly which option you have to set, either it was "Oracle Database Utilities" or "Oracle Net"
Also see McTnsping [link broken] "a Windows stand-alone program which requires no Oracle client". It's portable and doesn't need to be installed.
Usage 1: McTnsping.exe { <tns entry> | <host>:<port> } [<count>]
<tns entry> the net service name in the tnsnames.ora file.
<host>:<port> server name or IP and port (mandatory)
<count> number of times to check target, default is 1.
If whoever will reach the place like me... This is what worked for me:
Instant client Version 12.2.0.1 + sqlplus + tnsping (copied from another server of the same version)
Directory structure and env (as in bash profile):
export ORACLE_BASE=/opt/oracle
export ORACLE_HOME=${ORACLE_BASE}/instant_client122
export PATH=$ORACLE_HOME:$PATH
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$ORACLE_HOME #since all binaries are in $ORACLE_HOME - no bin or lib are present
export TNS_ADMIN=$ORACLE_HOME/network/admin
copy from another server to target:
'tnsping' to $ORACLE_HOME
'$ORACLE_HOME/network/mesg/tnsus.msb' to $ORACLE_HOME/network/mesg
Then put proper values to $TNS_ADMIN/tnsnames.ora and load env variables. After this it should be able to perform 'tnsping' and show proper message as a response.
Here's what I did to copy tnsping over to another machine. In my case, the oracle client is installed at C:\Oracle\product\12.1.0\client_1.
This assumes there's already an Instant Client or similar installed on the destination machine; and that the oracle path and registry keys are set.
(1) Copy tnsping.exe from the source to the destination machine, into client_1\bin.
(2) Copy the following files from client_1\bin to client_1\bin:
oraasmclnt12.dll
oracell12.dll
oraclient12.dll
oraclsce12.dll
oracommon12.dll
oracore12.dll
orageneric12.dll
orahasgen12.dll
oraldapclnt12.dll
oran12.dll
orancds12.dll
orancrypt12.dll
oranhost12.dll
oranl12.dll
oranldap12.dll
oranls12.dll
oranro12.dll
orantcp12.dll
orantns12.dll
oraocr12.dll
oraocrb12.dll
oraocrutl12.dll
oraplp12.dll
orapls12.dll
ORASLAX12.DLL
orasnls12.dll
oraunls12.dll
orauts.dll
oravsn12.dll
oraxml12.dll
orazt12.dll
oraztkg12.dll
This should be about 84.6 MB.
(3) In the client_1 on the destination machine, make a backup of the following files:
oci.dll
orannzsbb12.dll
oraons.dll
orasql12.dll
orawsec12.dll
Now on the source machine, find those files in client_1\bin and copy them to client_1\ (no bin) on the destination machine, overwriting the existing files. (Note: oci.dll is ~330 kb smaller, orasql12.dll is ~300 kb smaller. I'm not sure what's lost, hence the backup).
(4) On the destination machine, create the directory mesg in client_1\Network. Now copy the following file from the source to the destination:
client_1\Network\mesg\tnsus.msb
(5) Open up regedit. Create the following key:
HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\KEY_OraClient12Home1_32bit
(From another machine, it looks like the x64 version is named HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\KEY_OraClient12Home1, but the tnsping program I'm using says it's 64 bit, so ...)
Under the key, create a string named ORACLE_HOME with the value C:\Oracle\product\12.1.0\client_1.
You should be done now ($$$ = redacted):
C:\Users\$$$>tnsping $$$
TNS Ping Utility for 64-bit Windows: Version 12.1.0.2.0 - Production on 03-APR-2
019 08:47:37
Copyright (c) 1997, 2014, Oracle. All rights reserved.
Used parameter files:
C:\Oracle\product\12.1.0\client_1\network\admin\sqlnet.ora
Used TNSNAMES adapter to resolve the alias
Attempting to contact (DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = TCP)
(HOST = $$$)(PORT = $$$))) (CONNECT_DATA = (SERVICE_NAME = $$$
$$$) (SERVER = DEDICATED)))
OK (30 msec)
Troubleshooting
Here's the process I followed, sharing for when these steps invariably fail to work on a later version.
First off, I just copied the tnsping.exe over.
I didn't haphazardly pick the above dlls, as far as I can tell everyone is required. I ran the exe, and it would popup an error, I would copy the dll over and try again:
After a few dlls, you'll run into a different kind of error:
If that happens, fire up process monitor and put a filter in for the ProcessName to contain tnsping and try to run the program again. You should see something like the following. The main thing to notice is that it tries to load (in this example) orawsec12.dll, which succeeds, but then it continues to try to load the dll looking in different paths, and then at the end it triggers werfault and the program ends. I guess it realizes there's some kind of version mismatch and keeps looking for the right version.
The missing registry key will show up like the following in process monitor (operation RegOpenKey, result NAME NOT FOUND):
If the tnsus.msb file is missing, you should see something like the following in process monitor (operation CreateFile, result NAME NOT FOUND):

What's special about "c:\windows\system32" in the %PATH%? [duplicate]

My VBA code can't access to my DLL in the C:\Windows\System32 folder on Windows 7 64bit and Word 2010 32bit.
Private Declare Function my_func Lib "mydll.dll" (ByVal param As String) As Long
Public Sub MyFuncTest
n = my_func("a")
End
I copied mydll.dll into C:\Windows\System32 and called MyFuncTest but got an error message like "Error 53: 'mydll.dll' not found".
However, I changed the declaration in code to:
Private Declare Function my_func Lib "C:\Users\myname\Documents\mydll.dll" (ByVal param As String) As Long
then I copied mydll.dll into C:\Users\myname\Documents, my account's Documents folder, and MyFuncTest successfully executed.
Changing "mydll.dll" to "C:\Windows\System32\mydll.dll" in the declaration did not work. And I tried accessing C:\Windows\System32\mydll.dll with FileSystemObject#FileExists method on the same VBA environment, but it returned False (not found).
There was no problem on Windows XP and Word 2003.
Can anyone help?
This is a 32 bit DLL and a 32 bit process running in the WOW64 emulator on 64 bit Windows. File redirection is in play and so when a 32 bit process looks in system32 it is actually redirected to the 32 bit system directory SysWOW64.
The simple and quick solution is to move the DLL to C:\Windows\SysWOW64. However, as Cody Gray points out in a comment, it is not recommended for you to place application DLLs in the system directory. Normal practice is to place the DLLs in your application folder in the program files directory and make sure that folder is in the DLL search path when the DLL needs to be loaded.
Seems like UAC is the problem. Try running the VBA script as Administrator. It may help you.
A recent developer suggested the following fix which allowed a 32bit .dll to be registered on a 64 bit machine
1) Open a DOS command window.
2) Navigate to C:\Windows\Microsoft.NET\Framework64\v2.0.50727
3) Enter the following and press enter.
regasm /codebase "C:\Users\myname\Documents\mydll.dll"
I have had exactly the same problem yesterday. The program run on my machine, but not on others.
In fact, the message fron Excel is wrong. He obviously find lhe dll file, but this dll is calling orher dll, missing in the system : MSVCR100D.dll and NTDLL.dll.
I found that by using Dependency Walker free software, able to examine which dll are call by a dll.

File Replace during upgrade

We use Inno Setup(version 5.4.2) as the packaging tool to generate our installer. While upgrading our software from older version to current version,
we try to overwrite existing binaries/drivers. This is often leading to issues as some monitoring software like 'HP ArcSight Logger/Connector', 'SplunkUniversalForwarder' etc. are holding file handles on our binaries and casuing overwrite to fail. Our installer shows beolow popup message on encountering this issue each time.
"C:\Windows\System32\drivers\xxx.sys
An error occurred while trying to replace the existing file:
DeleteFile failed; code 5.
Access is denied.
Click Retry to try again, Ignore to skip this file(not recommended), or Abort to cancel installation"
Interestingly, even after above getting above pop-up, we were able to rename xxx.sys to xxx.sys.old manully. We used to suggest cusotmers to rename
xxx.sys to xxx.sys.old and 'Retry' the installation. After renaming, upgrade used to complete without any issues.
Questions
1) Is it possible to rename xxx.sys through program always, when we hit this issue.
2) Any process to reproduce the DeleteFile failed; code 5 issue?
Using the installer you can rename the existing file and install the new file using the correct file name with help from the windows registry.Remember to ask the user to reboot their computer to complete the install.Another option would be to either use the installer to rename the file and again using the window's registry to delete the unneeded file.
Window's registry allows you to delete or rename files on reboot as part of an install.
Reference to use of PendingFileRenameOperations:
http://support.microsoft.com/kb/181345
Example to rename from microsoft support:
The syntax used is (without quotes):
"\??\source file !\??\target file"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
Value name: PendingFileRenameOperations Data type : REG_MULTI_SZ
Value data: \??\c:\temp\win32k.sys !\??\c:\winnt\system32\win32k.s
The same command can be used to delete a file as well although requires the use of nulls.
http://www.pcreview.co.uk/forums/pendingfilerenameoperations-delete-file-t1715654.html
Same example used to delete a file:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
Value name: PendingFileRenameOperations Data type : REG_MULTI_SZ
Value data: \??\c:\temp\win32k.sys\0\0\0
I hope this helps you!

Windows 8 driver install and catalog/signature validation

I can't get windows 8 (release preview) to accept either the inf2cat or makecat approach described as solutions to the question at
What changed in the driver signature requirements for Windows 8?
unless I disable validation.
I am not signing these with any certificates at this point, just trying to get past the errors preventing the drivers from installing at all.
Windows 8 gives me a very nondescript error:
"A problem was encountered while attempting to add the driver to the store."
Looking in the event logs, there is nothing of use; only an informational entry from "Windows Error Reporting" indicating a PnPdriverimporterror.
When i use my original files with the cab files that don't match the inf, I get the error everyone else is listing:
The hash for the file is not present in the specified catalog file.
I have one .inf file that i need to generate a .cat for.
Perhaps I am doing something wrong. Ideas??
INF2CAT Approach
c:\win_xp_vista32_64>inf2cat /driver:"." /os:XP_X86,XP_x64,Vista_X86,Vista_x64,7_X86,7_X64,8_X86,8_X64
.......................
Signability test complete.
Errors:
None
Warnings:
22.9.10: usbser.sys in [drivercopyfiles.nt] is missing from [SourceDisksFiles] s
ection in \mchpcdc.inf; ok if file source is provided via LayoutFile in [Version
].
22.9.10: %driverfilename%.sys in [drivercopyfiles.ntamd64] is missing from [Sour
ceDisksFiles] section in \mchpcdc.inf; ok if file source is provided via LayoutF
ile in [Version].
Catalog generation complete.
c:\win_xp_vista32_64\mchpcdc.cat
MAKECAT approach
--- start of catalog.cdf file---
[CatalogHeader]
Name=mchpcdc.cat
ResultDir=.\
[CatalogFiles]
<hash>mchpcdc=.\mchpcdc.inf
---end of .cdf file ---
c:\win_xp_vista32_64>makecat catalog.cdf
These same files, w/ the cat from either approach install just fine in Windows 7.
I think this problem is to do with "windows driver signing enforcement". You can resolve this by disabling this option. Go through with below link:
http://tivadj-tech.blogspot.in/2012/09/certificate-check-error-when-installing.html
I just tested this on Windows 10 and 8 PRO now, to get this right, follow these steps:
1) From your Start menu, locate your DDK's "x64 Checked Build Environment" i.e. the custom DOS build screen. Right-click, run-as administrator...
2) Compile your source with the Build tools etc.
3) Go into your compiled code, and then create your test-certificate (you don't need to purchase one just yet, use your self-signed one created with the line below):
makecert -r -pe -ss PrivateCertStore -n CN=newhex.com(Test) NewhexTest.cer
The above means your certificate is called "newhex.com(Test)" and the generated file is "NewhexTest.cer"
4) Create / Edit your .CDF file which contains items about what your CAT file's contents.
5) Create your CAT file by executing:
makecat -v MyCDF.CDF
This should generate an un-signed CAT file that includes all files specified by your CDF.
6) Sign your CAT file as follows:
Signtool sign /v /s PrivateCertStore /n newhex.com(test) /t http://timestamp.verisign.com/scripts/timestamp.dll MyDriverWhatever.cat
This should result in a CAT file that is signed, but don't just install it, because your Windows can't trust Newhex's cert since it's not in the keystore, to fix this do:
7) Add your certificate to your private Key Store, remember this step MUST be done by an administrators access, otherwise you will get an error about (Keystore not found etc):
certmgr.exe -add NewhexTest.cer -s -r localMachine root
This should add into your keystore, Once done, you can then:
8) Go into your device manager, and add your new driver, you would get a warning but will be accepted and installed without the need to reboot with a forced (Don't check cert type account).
I tried this already and it works on Windows 10 and Windows 8 pro versions.
Kind Regards
Heider Sati
You are supposed to use inf2cat, not makecat, because you have an INF file.
You should work on addressing those warnings from inf2cat by fixing your INF file. Here is my INF file that uses usbser.sys and doesn't cause any warnings: https://gist.github.com/3647208
I was able to fix my INF file thanks to the advice from chinzei in the first post of this thread: http://www.microchip.com/forums/m488342-print.aspx
If you continue to have trouble, please edit your question to include the source of your INF file, or at least a link to the source.
I encounter the same problem and was able to install my driver with a TEST certificate using the instructions provided here:
http://msdn.microsoft.com/en-us/windows/hardware/gg487328.aspx

Resources