HKCU Registry Settings

The Toolkit General Discussion
1

I’m kinda banging my head against my keyboard here…and I admit I am a noob when using this particular feature. I know it can be used to create/modify keys but I am trying to delete a string using this function.

Here is my code:
[scriptblock]$HKCURegistrySettings =
{
#Remove-Item -Path ‘HKCU:Software\Microsoft\Windows\CurrentVersion\Uninstall\Data Loader’
Remove-RegistryKey ‘HKCU:Software\Microsoft\Windows\CurrentVersion\Uninstall\Data Loader’
}

Neither of them are working correctly except when I am logged into the machine with an admin account and running ISE with said account. If I run “Remove-Item -Path ‘HKCU:Software\Microsoft\Windows\CurrentVersion\Uninstall\Data Loader’”, it works just fine from a PS standpoint but not in PSADT.

Anyone know what I am doing wrong? Is it even possible to remove a key value using this function? The issue here is that this contains uninstall information (trust me, this software has really stupid tendencies and CAN install under the user’s profile, hence this issue) and we need it removed from ARP.

The logs show that it is trying to delete the key but it says it does not exist so maybe it can’t do strings?

Thank you very much!

2
3

It’ is still not working.

4
5

Are you using “Invoke-HKCURegistrySettingsForAllUsers -RegistrySettings $HKCURegistrySettings”
just like below?

[scriptblock]$HKCURegistrySettings = {
Remove-RegistryKey ‘HKCU:Software\Microsoft\Windows\CurrentVersion\Uninstall\Data Loader’ -SID $UserProfile.SID
}
Invoke-HKCURegistrySettingsForAllUsers -RegistrySettings $HKCURegistrySettings

6

Yeah, I didn’t have the -SID $UserProfile.SID at the end. I had to have a colleague look at it again as my brain was fried on it.

Thanks for replying.