[soporific]

I'm stumped ... the only way to reliably confirm if someone has certain hotfixes applied is to see if the registry contains the key that every hotfix writes when it is installed. There's 5 or 6 giving me problems and it will be so much easier if I can just somehow ask the registry if a certain key is there. I am hoping to do this programatically, not by hand ... I just have no idea if this can be done or how to do it so I'm throwing it out there ... can it be done? should it be done? Should it be well-done, or medium-rare? All these questions and more, I have ... t'anks in advance, you'rall wunderful people ...

[eidenk]

Yes, it can be done with a batch file.

I have done a batch file for toggling "View file extensions", In my case I wanted to know by checking the registry if "View file extensions" was on or off and then if it's on set it to off and vice-versa. I have additionally used Tfind.com for doing so. You can get Tfind here : http://home.mnet-onl....muc/index.html

That's my batch file :

@echo off
regedit /e Get.txt "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"
TFIND /e "HideFileExt" "dword:00000001" GET.txt > RESULT.TXT
IF ERRORLEVEL   1 GOTO :ERROR1
IF ERRORLEVEL   0 GOTO :ERROR0
:ERROR1
Regedit /s Show.reg
GOTO :END
:ERROR0
Regedit /s Hide.reg
GOTO :END
:END
Del *.txt
@echo off
cls

Probably there are other more elegant ways to do it but if you mess around with the (probably poorly written) above code as an example, surely you'll be able to do what you want.

This post has been edited by eidenk: 16 October 2005 - 09:22 AM

[soporific]

great info. you must be one of those wunderful people I was talkin 'bout

[eidenk]

Thank you.

[soporific]

OK, now I've got another problem ... the registry key to disable the DCOM security vunerability has these objects:

[HKEY_LOCAL_MACHINE\Software\Microsoft\OLE]
"EnableDCOM"="Y"
"EnableRemoteConnect"="N"

The method I'm using the check the registry doesn't actually use TFIND, I use a combination of regedit, type and find as follows (this is the check for Internet Explorer 6 sp1:)

@echo off
SET TITLE=Internet Explorer 6 sp1
echo. Now searching to see if %TITLE% is already installed ... 
regedit /e get.txt "HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\{0fde1f56-0d59-4fd7-9624-e3df6b419d0f}"
::					a short delay is needed to avoid sharing conflicts
rem|choice>nul /c:d /n /t:d,2
::					we want to find the correct version number of IE
TYPE Get.txt | FIND /i "6,0,2800,1106" >nul

:: if we can't find the text, app is not installed
IF ERRORLEVEL 1 GOTO NOcode
goto YEScode

:NOcode
echo. No it's not installed
GOTO END

:YEScode
echo. Yes it is installed 
GOTO END

:END
PAUSE
del *.txt
cls

SO I have a problem with quotes trying to apply this method to the DCOM vunerability. The only difference between a computer with the vunerability and one without is one of the objects of the [HKEY_LOCAL_MACHINE\Software\Microsoft\OLE] key has "EnableDCOM"="Y" and the other "EnableDCOM"="N" ... how am I going to be able to check for that? There's two problems: the quotes themselves separate the one paramater into two, and then the equal sign does the same thing if somehow you manage to do something tricky with the quotes ... what is one to do? Anyone, anyone?

This post has been edited by soporific: 18 October 2005 - 10:01 PM

[eidenk]

I would use Tfind to search for ""EnableDCOM" and "Y" after having cleaned the exported file from other lines

You could use yank.exe to clean up the exported registry file from unwanted lines

http://ww2.netnitco....h/download.html

Edit : It's not the good solution as there could be lines under the OLE key containing also Y that you are possibly not aware of on other systems.

The absolute solution would appear to me to be able to remove all double quotes from the exported registry file before processing it with the find command.

I'll be looking around for something that does this as I am interested as well.

Double quotes are pretty much the plague in some circumstances.

This post has been edited by eidenk: 19 October 2005 - 02:41 AM

[eidenk]

http://www.chebucto....af380/v5n19.zip

CHANGE get.txt 34 ""

Get.txt is stripped from double quotes. Everything is possible by using ASCII codes :

34 for double quote
39 for simple quote
61 for equal sign

http://www.coolwinto...rs/mapofche.zip

This post has been edited by eidenk: 19 October 2005 - 03:51 AM

[nil]

Hi Soporific. If you're willing to use a third-party command for the job try Horst Schaffer's excellent 'nset' command.

With regedit:

regedit /e get.tmp "HKEY_LOCAL_MACHINE\Software\Microsoft\OLE"
nset<get.tmp /L4 dcom=$2
for %%! in (%dcom%) do set dcom=%%! :: <- strip the variable of quotes
if %dcom%==n ...

With reg.com (resource kit):

reg query "HKLM\Software\Microsoft\OLE\EnableDCOM"|nset /P22 dcom=$1

Cheers.

[soporific]

wow, more good info ... don't stop now guys !! I have another for you ...

for the above-mentioned check for IE6 sp1 you'll notice that I've had to add a delay after REGEDIT writes to the text file. If you don't include it, the next line of code tries to find the text file that REGEDIT is still writing to ... either you get a false result about a missing file (if it was supposed to be true) or the system reports a sharing violation and things go to poo.

Before I added all these 'checks' into the project, the menu system was able to search for all possible extras in about 5 seconds flat. Now that I'm adding the checks like the one above, all these delays have to be sat thru ... and so the process is not as fun ... or more precisely, the 'progress meter' runs much more slowly because of all the two second delays. I've tried one second but that's too short, and even two seconds might not be long enough for some systems - which means a 3 second wait for everything and now we're running into trouble.

My question: is there a way to confirm the text file that REGEDIT is writing (or may not be writing) without using the delay method?

I thought that maybe all these new apps that have been suggested might be able to help but the problem lies with the extraction from the registry and so they won't solve the problem. Or so it appears. Please tell me I'm wrong.

[EDIT] - actually, reg.com looks promising - but where do you get it?

This post has been edited by soporific: 20 October 2005 - 08:21 AM

[jaclaz]

Sorry, deleted, I gave some ideas, taken from Rob Van der Woude's site but they are for NT/2k/XP only.

jaclaz

P.S.: Actually there is a way to read values in win95/98, through some peculiar "side effects" of some commands, see here:
http://www.robvanderwoude.com/
http://www.robvander...om/regedit.html
Skip to the Win95/98 section there are links to :
http://www.robvanderwoude.com/amb_cdrom.ht...dromDriveLetter
and CHOICE usage:
http://www.robvander...com/choice.html

This post has been edited by jaclaz: 20 October 2005 - 01:06 PM

[soporific]

re: avoiding using the delay: guys, guys (or gals, gals), you've missed the opportunity to add more gloss to that shiny halo that sits a few cm above your heads ...

you just gotta use START /W REGEDIT blah blah

it was the link that jaclaz gave that helped the penny drop for me. So kudos (which is the currency of the future, BTW) to him (her).

This post has been edited by soporific: 20 October 2005 - 11:46 PM

[nil]

Quote

soporific wrote: actually, reg.com looks promising - but where do you get it?

My mistake soporific, the example used reg.exe (v1.03) from 98 Resource kit. I'm baffled as to why it was never made a standard Win98 component - sure it has it's limitations (SAVE, for example, returns "This function is only valid in Win32 mode.") but it's well worth having around if only for the DELETE function.

Quote

guys, guys (or gals, gals), you've missed the opportunity to add more gloss to that shiny halo that sits a few cm above your heads ...

"How dare thee mortal!"
But /W, the halo around hir neck crumbles...
Sir Vix feels whole again.

This post has been edited by nil: 22 October 2005 - 01:48 PM