Delete reg key based on value

Question

5.00/5 (1 vote)

See more:

Hello,

I've been researching on how to delete a registry key based on data and not the value in a batch file.

I can find the reg key based on the /f data parameter (reg query "KEY" /f "data"). That command finds the key and also the random value. I'm trying to find a way to delete the random value as the REG DELETE doesn't have the capability to delete the registry key on the data, only the value. I hope that makes sense.

What I have tried:

Here's what I have complete so far.

set NAME=\\remote machine\KEYPATH /f "data"
reg query %NAME%
if %errorlevel%==0 (
reg delete %NAME% /f
)

Its stopping at reg delete because it's an invalid syntax and it's because of the /f in the "set NAME" variable.

If I had the capability to run something in powershell, i'd do that however, my work's network isn't allowing to touch remote machines.

Posted 18-Dec-20 4:36am

paulazizeh

Updated 18-Dec-20 6:44am

Add a Solution

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Dave Kreskowiak · Accepted Answer · 2020-12-18T06:44:00

Solution 1

Look at the value of NAME: \\remote machine\KEYPATH /f "data"

Is that a valid registry key? I seriously doubt your registry key name ends with "/f "data"".

Your script should look more like

set NAME=\\remoteMachine\KEYPATH
REG QUERY %NAME% /f DATA
IF %ERRORLEVEL%==0 (
    REG DELETE %NAME% /f
)

Posted 18-Dec-20 6:44am

Dave Kreskowiak

Comments

paulazizeh 18-Dec-20 13:20pm

Hey Dave, thanks for replying, and I appreciate you assisting.

No, I was labeling \\remote machine\KEYPATH /f "data" as a variable so sorry I didn't specify that.

I backed up the registry and tried to run the script you proposed and it deleted all of the reg keys in the registry. No worries though, I imported the registry key and all is good.

Here's the script I'm running with the real key paths. When the script searches for the specified data, it comes with a random value, I'm trying to delete the specified value that it comes back with.

set NAME=\\remotemachine\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist\
REG QUERY %NAME% /f "gofohnjbcabckdcbamaelhmppjoegikd"
IF %ERRORLEVEL%==0 (
REG DELETE %NAME% /f
)

I'll include screenshots.

https://ibb.co/gj0gKpR

Dave Kreskowiak 18-Dec-20 16:32pm

No, it's removing the key and all the values under it, just like your script told it to.

This will do the trick, but it much be in a .BAT file, not .CMD.

@ECHO OFF
SET NAME=\\REMOTEMACHINE\HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist
SET VALUETOFIND=gofohnjbcabckdcbamaelhmppjoegikd
SET VALUENAME=

REG QUERY "%NAME%" /f "%VALUETOFIND%"

IF %ERRORLEVEL% NEQ 0 GOTO END

FOR /f "tokens=1" %%a in ('REG QUERY %NAME% /f %VALUETOFIND% ^| FINDSTR REG_SZ') DO SET VALUENAME=%%a
REG DELETE "%NAME%" /v "%VALUENAME%" /f

:END

paulazizeh 21-Dec-20 9:49am

Hey Dave,

You are awesome. This solution worked. Thank you, much appreciated.