Skip to main content

1E 23.11 (SaaS)

NativeServices.RegistryDeleteUserValues

Method

RegistryDeleteUserValues

Module

NativeServices

Library

Core

Action

Deletes a given value for every user under HKU.

Parameters

Subkey (string): The registry key to look for.

Name (string): The name of the registry value that requires deletion.

Return values

For each user:

Status (string): The deletion status of the value. "Deleted value" if it has been deleted, else "Key does not exist" if there is no such containing key.

Sid (string): SID the value was found under.

Username (string): Domain\Username of the aforementioned SID.

No result is returned for users that did not have the value (so it could not be deleted) but did have the parent key.

Note

Prior to v4.2 the "Key does not exist" status was "Value does not exist" which was true but not as accurate.

Example

 NativeServices.RegistryDeleteUserValues(Subkey:"somethingSpecific", Name:"value12");

Platforms

  • Windows

Notes

This will delete the value for every user. Use with caution!

Unlike most registry methods, the 8192 limit is not imposed because doing so would leave the system in an inconsistent state (some users would have the value deleted, others not), and in practice it is highly unlikely that any system would have that many users.

If information is retrieved from the .DEFAULT key or a _Classes key, the Username will be reported as "Unknown". It is possible to determine the owner of a _Classes key from the SID that precedes it (which will have a correct Username).

Warning

This method may attempt to call AD to translate a SID to a username.

No output is returned for users for whom the value does not exist, i.e. only values that were actually deleted are reported.