Tag: registry

Identify all user keys in HKEY_USERS

January 5, 2018 /

This example shows how to enumerate the user keys in HKEY_USERS

Public Sub OutputRegKey(Key As RegistryKey)
Imports Microsoft.Win32

Public Class Form1
  Public arrUsers(100) As String, arrUsersMax As Integer = 0

  Private Sub Form1_Load(sender As System.Object, e As System.EventArgs) Handles MyBase.Load
    Dim i As Integer
    Dim txt As String = ""

    '-------------------------------------------------------------------
    ' identify the HKEY_Users
    '-------------------------------------------------------------------
    arrUsers(0) = ".DEFAULT"

    Dim regkey As RegistryKey = Registry.Users.OpenSubKey("")
    EnumerateHkeyUsers(regkey)
    regkey.Close()

    For i = 0 To arrUsersMax
      txt += arrUsers(i) & vbCrLf
    Next

    MsgBox(txt)
    End
  End Sub

  Sub EnumerateHkeyUsers(ByVal rkey As RegistryKey)
    Dim names As String() = rkey.GetSubKeyNames()
    Dim txt As String = ""

    For Each subkey In names
      txt = subkey.ToString

      If Len(txt) > 10 And InStr(LCase(txt), "_classes") = 0 Then
        arrUsersMax = arrUsersMax + 1
        arrUsers(arrUsersMax) = txt
      End If
    Next
  End Sub

End Class

Remotely Enable Remote Desktop

November 15, 2013 /

Remote Desktop (aka Terminal Service) is disabled by default in Windows 7.  If you have administrator access to the computers on your domain, you can remotely enable it by doing the following:

Step 1: Open ports in the Windows firewall

There is no native way to change the settings of a remote Windows firewall. However, you can use PsExec from SysInternals to disable it or change some rules.

If you download the app and drop it into your c:\ drive, you can run this command and get command line access for that remote box.

c:\psexec \\remote_machine_name cmd

Once you have that command line open, you can run this command to disable the firewall:

netsh advfirewall set currentprofile state off

Alternatively you can run this command to allow only Remote Desktop while still leaving the rest of the firewall as is:

netsh advfirewall firewall set rule group=”remote desktop” new enable=Yes

Step 2: Start the Remote Registry service

Load up the Services MMC (Control Panel > Administrative Tools > Services), right click on “Services (Local)” and choose “Connect to another computer”. Enter the name of your remote machine and connect to it. You should now be able to find the “Remote Registry” service and start it.

Depending on your environment, this may already be running, but I have found it generally isn’t on fresh computers.

Step 3: Change a registry setting to enable Remote Desktop

It’s time to make use of the Remote Registry and actually enable RDP. Load up regedit and go toFile > Connect Network Registry. Enter the name of your remote computer and connect to it. Navigate to HKEY_LOCAL_MACHINE > System > CurrentControlSet > Control > Terminal Server. Change the value of “fDenyTSConnections” to “0″.

Step 4: Start the Remote Desktop service

Go back to the Services MMC you used in Step 2. Find the service “Remote Desktop Services” and start it (or restart if it is already running).