Results 1 to 7 of 7
  1. #1
    2 Star Lounger
    Join Date
    Aug 2014
    Posts
    123
    Thanks
    19
    Thanked 0 Times in 0 Posts

    Registry commands produce no output

    I have modified an Intrusion Detection System (uses a baseline).
    The registry commands for Run Once and Run pass their info to a file defined in a variable %tmplog% which I use to "type" after the info is gathered. The RunOnceEx line:
    Reg export HKCU\Software\Microsoft\Windows\CurrentVersion\Run OnceEx %tmplog%
    does not output for either HKCU or HKLM. Any ideas why? The lines come from a publish article.
    Thanks!

  2. #2
    jwoods
    Guest
    You might check out this article on RunOnceEx...

    http://support.microsoft.com/en-us/kb/310593

  3. #3
    WS Lounge VIP
    Join Date
    Dec 2009
    Location
    Earth
    Posts
    8,191
    Thanks
    48
    Thanked 985 Times in 915 Posts
    On my W8.1 box, as expected, I get output from RunOnce but an error from RunOnceEx. (Did you leave the space in?)

    cheers, Paul

  4. #4
    2 Star Lounger
    Join Date
    Aug 2014
    Posts
    123
    Thanks
    19
    Thanked 0 Times in 0 Posts
    @Paul T: had no space.
    @jwoods: Tnx 4 the ref. Couldn't tell from reading what/why I get no output. Possibly the original article used 32 bit whereas I am 64.
    Keys didn't seem to indicate how to get a registry status or contents listing. Any ideas?

  5. #5
    jwoods
    Guest
    The article does have references to 64-bit...

    Also, it mentions "In Windows Vista, Windows Server 2008, Windows 7 and Windows Server 2008 R2. the RunOnceEx registry key does not exist by default:"

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\RunOnceEx key

    Have you checked to see if the key exists? If it does, check the permissions on it in regedit.
    Last edited by jwoods; 2015-04-03 at 23:23.

  6. #6
    2 Star Lounger
    Join Date
    Aug 2014
    Posts
    123
    Thanks
    19
    Thanked 0 Times in 0 Posts
    Noticed the does not exist but was not sure which key, since the article I have did not use a key. Are you saying that that applies to 64 bit?
    Don't know or where to find "keys". Suggestions? Thx again

  7. #7
    jwoods
    Guest
    Quote Originally Posted by spark55 View Post
    Noticed the does not exist but was not sure which key, since the article I have did not use a key. Are you saying that that applies to 64 bit?
    Don't know or where to find "keys". Suggestions? Thx again
    Take a look at the Microsoft article again.

    Open regedit, navigate to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion and look at the "folders" under that hive. You will see one for "Run", and "RunOnce", but likely not one for "RunOnceEx".

    It only exists by default in Windows 2000, Windows XP and Windows Server 2003, not in Vista and above.

    So if you are using the key in your routine, it needs to exist (meaning you need to create it) and you have to have permissions to access it.
    Last edited by jwoods; 2015-04-04 at 01:19.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •