I think you mean "UIHost"="%WINDIR%\\Resources\\LogonUI\\custom.exe". But the problem is that the reg-files don't have a simple syntax for REG_EXPAND_SZ values. The above example would be ... "UIHost"=hex(2):25,00,41,00,4c,00,4c,00,55,00,53,00,45,00,52,00,53,00,50,00,52,\ 00,4f,00,46,00,49,00,4c,00,45,00,25,00,5c,00,44,00,6f,00,6b,00,75,00,6d,00,\ 65,00,6e,00,74,00,65,00,5c,00,45,00,69,00,67,00,65,00,6e,00,65,00,20,00,42,\ 00,69,00,6c,00,64,00,65,00,72,00,5c,00,4c,00,6f,00,67,00,6f,00,6e,00,20,00,\ 53,00,63,00,72,00,65,00,65,00,6e,00,73,00,5c,00,64,00,65,00,5c,00,53,00,75,\ 00,6e,00,73,00,65,00,74,00,20,00,43,00,61,00,76,00,65,00,73,00,2e,00,65,00,\ 78,00,65,00,00,00 Let me quote the Platform SDK: