REG_SZ vs REG_EXPAND_SZ data types for %SystemRoot% in registry

FUBARinSFO

Hi folks:

In the course of tracking down the cause of external commands not
executing in command windows, I fixed the problem by changing the data
type of the PATH environment variable in HKEY_LOCAL_MACHINE\SYSTEM
\CurrentControlSet\Control\Session Manager\Environment from REG_SZ to
REG_EXPAND_SZ (thank you Bill Stewart at
and Wesley Vogel here)

However, it turns out on further inspection that there are some,
perhaps many (4 in one system, 637 in another) registry entries
containing the string '%SystemRoot%' or other expansion environment
variable in its with data type REG_SZ. I've inluded smoe of the data
below in this note.

1. Should all the entries with data type REG_SZ data be changed to
REG_EXPAND_SZ?

2. In the cases where therer are hundreds, is there any tool to do
this with?

3. Does anybody have any idea how this might have come about?

Thank you in advance for your help.

-- Roy Zider

working on systemroot problem
5:29 PM 6/21/2007 lsz

Key name

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID
\{540D8A8B-1C3F-4E32-8132-530F6A502090}
Name (Default)
Type REG_SZ
Data Lauguage bar

Name MenuTextPUI
Type REG_SZ
Data @%SystemRoot%\System32\msutb.dll,-325

Above key as exported (file K7NFULL1.TXT, ANSI now not Unicode)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID
\{540D8A8B-1C3F-4E32-8132-530F6A502090}
@="Language bar"
"MenuTextPUI"="@%SystemRoot%\\System32\\msutb. dll,-325"

Searching K7N registry....
Using exported file K7NFULL1.TXT

Search term: %;
Found 1 hit:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\1.x]
"EnforcedDirectories"="%WINDIR%;%ProgramFiles%\\Mo vie Maker"

Search term: %\\\
No hits

Search term: %\\
4 hits:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID
\{540D8A8B-1C3F-4E32-8132-530F6A502090
@="Language bar"
"MenuTextPUI"="@%SystemRoot%\\System32\\msutb. dll,-325"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rtsp\DefaultIc on]
@="%SystemRoot%\\system32\\url.dll,0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\1.x]
"EnforcedDirectories"="%WINDIR%;%ProgramFiles%\\Mo vie Maker"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Intelligent Search\RNL\1.0]
"LoggingWanted"=dword:00000000
"LoggingPath"="%TEMP%\\rnl_log.txt"

Check out the four keys for data type -- all are REG_SZ.


Now search current TOOT registry ...
Use file regfull.txt

Search term: %;

Found 1 hit:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\1.x]
"EnforcedDirectories"="%WINDIR%;%ProgramFiles%\\Mo vie Maker"

Search term: %\\\
No hits

Search term: %\\
637 hits:
Showing first ten only:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\W INWORD.EXE
\TaskbarExceptionsIcon

s\explorer.exe,16]
@="%ProgramFiles%\\Microsoft Office\\Office10\\OUTLOOK.EXE"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID
\{540D8A8B-1C3F-4E32-8132-530F6A502090}]
@="Language bar"
"MenuTextPUI"="@%SystemRoot%\\System32\\msutb. dll,-325"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rtsp\DefaultIc on]
@="%SystemRoot%\\system32\\url.dll,0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\1.x]
"EnforcedDirectories"="%WINDIR%;%ProgramFiles%\\Mo vie Maker"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet

Explorer\Extensions\{e2e2dd38-d088-4134-82b7-f2ba38496583}]
"CLSID"="{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"
"Exec"="%windir%\\Network Diagnostic\\xpnetdiag.exe"
"MenuText"="@xpsp3res.dll,-20001"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Control

Panel\Extended Properties\{305CA226-D286-468e-B848-2B2E8E697B74} 2]
"%SystemRoot%\\system32\\Firewall.cpl"="3,10"
"%SystemRoot%\\system32\\wscui.cpl"=dword:ffff ffff
"%SystemRoot%\\system32\\NetSetup.cpl"=dword:00000 003
"C:\\Program Files\\Common Files\\Microsoft

Shared\\Speech\\sapi.cpl"=dword:00000004
"%SystemRoot%\\System32\\wuaucpl.cpl"=dword:000000 0a
"%SystemRoot%\\system32\\appwiz.cpl"=dword:0000000 8
"%SystemRoot%\\system32\\access.cpl"=dword:0000000 7
"%SystemRoot%\\system32\\bthprops.cpl"="2,3"
"%SystemRoot%\\system32\\desk.cpl"=dword:00000 001
"%SystemRoot%\\system32\\hdwwiz.cpl"=dword:fffffff f
"%SystemRoot%\\system32\\inetcpl.cpl"="3,10"
"%SystemRoot%\\system32\\intl.cpl"=dword:00000 006
"%SystemRoot%\\system32\\irprops.cpl"=dword:000000 02
"%SystemRoot%\\system32\\joy.cpl"=dword:000000 02
"%SystemRoot%\\system32\\main.cpl"=dword:00000 002
"%SystemRoot%\\system32\\mmsys.cpl"=dword:0000 0004
"%SystemRoot%\\system32\\ncpa.cpl"=dword:00000 003
"%SystemRoot%\\system32\\nwc.cpl"=dword:000000 00
"%SystemRoot%\\system32\\nusrmgr.cpl"=dword:000000 09
"%SystemRoot%\\system32\\odbccp32.cpl"=dword:00000 000
"%SystemRoot%\\system32\\powercfg.cpl"=dword:00000 005
"%SystemRoot%\\system32\\sysdm.cpl"="5"
"%SystemRoot%\\system32\\telephon.cpl"=dword:00000 002
"%SystemRoot%\\system32\\timedate.cpl"=dword:00000 006

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer
\AutoplayHand

lers\Handlers\MSCDBurningOnArrival]
"DefaultIcon"=hex(2):25,00,53,00,79,00,73,00,74,00 ,65,00,6d,
00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00 ,6d,
00,33,00,32,00,5c,00,\
53,00,48,00,45,00,4c,00,4c,00,33,00,32,00,2e,00,64 ,00,6c,00,6c,00,2c,
00,2d,\
00,35,00,00,00
"Action"="@%SystemRoot%\\system32\\SHELL32.dll ,-17169"
"Provider"="@%SystemRoot%\\system32\\SHELL32.d ll,-17170"
"InvokeProgID"="Folder"
"InvokeVerb"="open"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer
\AutoplayHand

lers\Handlers\MSOpenFolder]
"DefaultIcon"=hex(2):25,00,53,00,79,00,73,00,74,00 ,65,00,6d,
00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00 ,6d,
00,33,00,32,00,5c,00,\
53,00,48,00,45,00,4c,00,4c,00,33,00,32,00,2e,00,64 ,00,6c,00,6c,00,2c,
00,2d,\
00,35,00,00,00
"Action"="@%SystemRoot%\\system32\\SHELL32.dll ,-17154"
"Provider"="@%SystemRoot%\\system32\\SHELL32.d ll,-17155"
"InvokeProgID"="Folder"
"InvokeVerb"="open"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer
\AutoplayHand

lers\Handlers\MSPrintPicturesOnArrival]
"DefaultIcon"=hex(2):25,00,53,00,79,00,73,00,74,00 ,65,00,6d,
00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00 ,6d,
00,33,00,32,00,5c,00,\
53,00,48,00,45,00,4c,00,4c,00,33,00,32,00,2e,00,64 ,00,6c,00,6c,00,2c,
00,2d,\
00,31,00,37,00,00,00
"Action"="@%SystemRoot%\\system32\\SHELL32.dll ,-17158"
"Provider"="@%SystemRoot%\\system32\\SHELL32.d ll,-17159"
"InvokeProgID"="Applications\\shimgvw.dll"
"InvokeVerb"="print"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer
\AutoplayHand

lers\Handlers\MSSHAudioDevHandler]
@=""
"Action"="@%SystemRoot%\\system32\\audiodev.dl l,-500"
"Provider"="@%SystemRoot%\\system32\\audiodev. dll,-501"
"DefaultIcon"=hex(2):25,00,53,00,79,00,73,00,74,00 ,65,00,6d,
00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00 ,6d,
00,33,00,32,00,5c,00,\
61,00,75,00,64,00,69,00,6f,00,64,00,65,00,76,00,2e ,00,64,00,6c,00,6c,
00,2c,\
00,2d,00,35,00,30,00,00,00
"ProgID"="Shell.HWEventHandlerShellExecute"
"InitCmdLine"="::{21EC2020-3AEA-1069-A2DD-08002B30309D}\\::
{640167b4-59b0-47a6-b335

-a6b3c0695aea}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer
\AutoplayHand

lers\Handlers\MSShowPicturesOnArrival]
"DefaultIcon"=hex(2):25,00,53,00,79,00,73,00,74,00 ,65,00,6d,
00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00 ,6d,
00,33,00,32,00,5c,00,\
53,00,48,00,45,00,4c,00,4c,00,33,00,32,00,2e,00,64 ,00,6c,00,6c,00,2c,
00,2d,\
00,32,00,34,00,39,00,00,00
"Action"="@%SystemRoot%\\system32\\SHELL32.dll ,-17156"
"Provider"="@%SystemRoot%\\system32\\SHELL32.d ll,-17157"
"InvokeProgID"="Shell.AutoplayForSlideShow.1"
"InvokeVerb"="open"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer
\AutoplayHand

lers\Handlers\MSTakeNoAction]
"DefaultIcon"=hex(2):25,00,53,00,79,00,73,00,74,00 ,65,00,6d,
00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00 ,6d,
00,33,00,32,00,5c,00,\
53,00,48,00,45,00,4c,00,4c,00,33,00,32,00,2e,00,64 ,00,6c,00,6c,00,2c,
00,2d,\
00,33,00,33,00,38,00,00,00
"Action"="@%SystemRoot%\\system32\\SHELL32.dll ,-17168"
"Provider"="<TakeNoAction>"
"ProgID"="Shell.AutoplaySpecial"

Holz

On Fri, 22 Jun 2007 01:29:33 +0000, FUBARinSFO wrote:

>
> 2. In the cases where therer are hundreds, is there any tool to do
> this with?

MRRC, Multi Remote Registry change

--
The next version of Windows? Windows piñata
Piñatas are made from easily breakable materials. a bright container
surrounded by blindfolded children breaking the
piñata in order to collect the candy inside of it.

Holz

On Fri, 22 Jun 2007 01:29:33 +0000, FUBARinSFO wrote:

>
> 2. In the cases where therer are hundreds, is there any tool to do
> this with?

MRRC, Multi Remote Registry change

--
The next version of Windows? Windows piñata
Piñatas are made from easily breakable materials. a bright container
surrounded by blindfolded children breaking the
piñata in order to collect the candy inside of it.

FUBARinSFO

Thanks, Holz, I'm looking into it.

-- Roy

FUBARinSFO

Thanks, Holz, I'm looking into it.

-- Roy

Ramesh, MS-MVP

Hi Roy,

That's a good point. What I was trying to say is that some of the system default "LocalizedString" and "MenuTextPUI" values are set as REG_SZ (but containing expandable strings!) in my systems as well. However, Windows is able to retrieve the string correctly irrespective of the value type assigned.

>> I'm rolling back to some earlier images to try to identify the source of these REG_SZ data types.

Good Luck! and keep us posted on the happenings.

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows Shell/User]
Windows® Troubleshooting


"FUBARinSFO" <> wrote in message news:1182529193.338627.83790@g37g2000prf.googlegro ups.com...
Ramesh:

I understand your observation, that you can leave the REG_SZ entries
as-is unlsess you find you have problems. Unfortunately, this is not
a good policy for system or user administration. In a company with
hundreds of users, each one of these "discoveries" of something not
working will generate hundreds of calls to tech support.

I'm rolling back to some earlier images to try to identify the source
of these REG_SZ data types. Maybe they are all harmless, as you say,
or expandable by their applications. That's what I'm trying to pin
down.

-- Roy Zider

Ramesh, MS-MVP

Hi Roy,

That's a good point. What I was trying to say is that some of the system default "LocalizedString" and "MenuTextPUI" values are set as REG_SZ (but containing expandable strings!) in my systems as well. However, Windows is able to retrieve the string correctly irrespective of the value type assigned.

>> I'm rolling back to some earlier images to try to identify the source of these REG_SZ data types.

Good Luck! and keep us posted on the happenings.

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows Shell/User]
Windows® Troubleshooting


"FUBARinSFO" <> wrote in message news:1182529193.338627.83790@g37g2000prf.googlegro ups.com...
Ramesh:

I understand your observation, that you can leave the REG_SZ entries
as-is unlsess you find you have problems. Unfortunately, this is not
a good policy for system or user administration. In a company with
hundreds of users, each one of these "discoveries" of something not
working will generate hundreds of calls to tech support.

I'm rolling back to some earlier images to try to identify the source
of these REG_SZ data types. Maybe they are all harmless, as you say,
or expandable by their applications. That's what I'm trying to pin
down.

-- Roy Zider

FUBARinSFO

On Jun 21, 11:54 pm, Holz <> wrote:
> On Fri, 22 Jun 2007 01:29:33 +0000, FUBARinSFO wrote:
>
> > 2. In the cases where therer are hundreds, is there any tool to do
> > this with?
>
> MRRC, Multi Remote Registry change
>

Holz:

I've spent some time today with MRRC, demo. Not workgroup-friendly,
really wants to work within in a domain. Greg has been helpful, but
still not able to log onto one of the Win XP computers in the group.
Also can't figure out how to wild-card search for certain keys, since
it requires filling out text boxes that you don't have the info for.
May be useful eventually.

-- Roy

FUBARinSFO

On Jun 21, 11:54 pm, Holz <> wrote:
> On Fri, 22 Jun 2007 01:29:33 +0000, FUBARinSFO wrote:
>
> > 2. In the cases where therer are hundreds, is there any tool to do
> > this with?
>
> MRRC, Multi Remote Registry change
>

Holz:

I've spent some time today with MRRC, demo. Not workgroup-friendly,
really wants to work within in a domain. Greg has been helpful, but
still not able to log onto one of the Win XP computers in the group.
Also can't figure out how to wild-card search for certain keys, since
it requires filling out text boxes that you don't have the info for.
May be useful eventually.

-- Roy

FUBARinSFO

Just confirmed -- no wildcard search in Edit Keys search.

So the only way at the moment is to work with the exported registry as
a text file.