How to Get Data from the HKEY_CURRENT_USER (HKCU) registry root?

One of the most powerful features of the LANDesk inventory scan is the ability to read data from custom-defined registry keys. This can provide for means on importing data into inventory that would not normally be gathered otherwise.

However, some of the more interesting data cannot be gathered directly by LANDesk. This problem arises for several reasons:

• Windows stores some information on a per-user basis under the HKEY_CURRENT_USER (HKCU) registry root
• Windows does not allow users to read each other's HKCU roots
• Our agent's scheduled inventory scans run as LocalSystem, so it does not have access to the per-user configuration in HKCU

This doesn't mean that this data is completely unavailable. Instead, a two-pronged approach is necessary:

• Create and deploy a script or batch file to write the data somewhere under HKEY_LOCAL_MACHINE (HKLM)
• Configure LANDesk to gather the HKLM registry key and add it to inventory

One of the easiest ways to automate registry manipulation is by use of VBScript (VBS). Windows provides a built-in VBS interpreter and LANDesk supports VBS software packages. This article can be used as an example of implementation; while it deals specifically with gathering a user's printers the concepts should be easily applied to other tasks.

WARNING! This script file reads and modifies machines' registries. It is completely unsupported by LANDesk, so please make sure you understand what it does before deploying.

1. Determine the source of the data you're looking for. In this example, we're going to read printer addresses from HKCU\Printers\Settings
2. Write a script to read data from the source in HKCU and write it to a location in HKLM. A good spot, used in this example, is HKLM\SOFTWARE\LANDesk\CustomData

' Constants (taken from WinReg.h)
Const HKEY_CURRENT_USER   = &H80000001
Const HKEY_LOCAL_MACHINE  = &H80000002

' Choose computer name
strComputer = "." ' Use . for current machine
Set StdOut = WScript.StdOut

' Connect to registry provider on target machine with current user
Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")

' Define the registry key to read values from
strKeySource = "Printers\Settings"
strKeyDest = "SOFTWARE\LANDesk\CustomData"

' Create the destination key
oReg.CreateKey HKEY_LOCAL_MACHINE,strKeyDest

' Enum the subkeys of the key path we've chosen
oReg.EnumValues HKEY_CURRENT_USER, strKeySource, arrValueNames, arrValueTypes

For i = LBound(arrValueNames) To UBound(arrValueNames)

           oReg.SetStringValue HKEY_LOCAL_MACHINE,strKeyDest,"Printer" & i,arrValueNames(i)

Next

3. Create a distribution package in the LDMS console that deploys the script
   1. The package needs to be a 'Windows Script Host' package
   2. In the 'Accounts' section of the package properties, make sure to select 'Current user's account' to get access to the HKCU registry root
4. Deploy the new package to targeted devices
   • Target devices must have a user logged in, otherwise the task will fail
5. Configure the LANDesk agent to read the new registry keys
   • LANDesk Management Suite 9.0
   • LANDesk Management Suite 9.5
6. Manually run an inventory scan on the devices, or wait for the next scheduled inventory scan to complete
   • If the custom data fails to show up, ensure that it's not blocked

Although LANDesk can't directly read HKCU keys, there are a variety of ways to work around this. The above is just one example; other options include batch files or other scripting languages to get the data moved.