How to iterate registry from the root?

Question

I would like to search all the registry (HKEY_CLASSES_ROOT, HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE, HKEY_USERS and all of the subkeys) for a specific value and if there is a match I would like to delete this entry. Is there a way to do this? I found a sample like below but it is not iterating all the registry.

Best Regards and thanks in advance.

Const HKCU = &H80000001
Const HKLM = &H80000002
Const HKU  = &H80000003

Const REG_SZ = 1
Const REG_EXPAND_SZ = 2
Const REG_BINARY = 3
Const REG_DWORD = 4
Const REG_MULTI_SZ = 7

valueToDelete = "Alex De Souza"

Set reg = GetObject("winmgmts://./root/default:StdRegProv")

Sub DeleteFromRegistry(hive, key, searchValue)
  'enumerate values and delete matching ones
  rc = reg.EnumValues(hive, key, values, types)


  If Not IsNull(values) Then

  For i = LBound(values) To UBound(values)
    strValueName = values(i)
    Select Case types(i)

      ' Show a REG_SZ value
      '
      Case REG_SZ          
        reg.GetStringValue hive, key, strValueName, strValue

        If InStr(strValue, searchValue) > 0 Then

            wscript.echo "Found  " & key & ": "& strValueName & " (REG_SZ) = " & strValue
            rc = reg.DeleteValue(hive, key, strValue)

        End If

      ' Show a REG_EXPAND_SZ value
      '
      Case REG_EXPAND_SZ
        reg.GetExpandedStringValue hive, key, strValueName, strValue

        If InStr(strValue, searchValue) > 0 Then

            wscript.echo "Found  "& key & ": " & strValueName & " REG_EXPAND_SZ) = " & strValue
            rc = reg.DeleteValue(hive, key, strValue)
        End If
      ' Show a REG_DWORD value
      '
      Case REG_DWORD
        reg.GetDWORDValue hive, key, strValueName, uValue

        If InStr(strValue, searchValue) > 0 Then

            wscript.echo "Found  "& key & ": " & strValueName & " (REG_DWORD) = " & strValue
            rc = reg.DeleteValue(hive, key, strValue)
        End If

    End Select
  Next

 End If

 'enumerate subkeys and recurse
  rc = reg.EnumKey(hive, key, subkeys)
  If Not IsNull(subkeys) Then
    For Each sk In subkeys
      If key = "" Then
        path = sk
      Else
        path = key & "\" & sk
      End If
      DeleteFromRegistry hive, path, searchValue
    Next
  End If

End Sub

'iterate over hives (HKCR can be ignored, because it's just a combining view
'on 2 subkeys of HKLM and HKCU)
For Each hive In Array(HKCU, HKLM, HKU)
  DeleteFromRegistry hive, "", valueToDelete
Next

Answer 1

You need a recursive procedure for this.

Const HKCU = &H80000001
Const HKLM = &H80000002
Const HKU  = &H80000003

valueToDelete = "..."

Set reg = GetObject("winmgmts://./root/default:StdRegProv")

Sub DeleteFromRegistry(hive, key, searchValue)
  'enumerate values and delete matching ones
  rc = reg.EnumValues(hive, key, values, types)
  If Not IsNull(values) Then
    For Each val In values
      If val = searchValue Then rc = reg.DeleteValue(hive, key, val)
    Next
  End If

  'enumerate subkeys and recurse
  rc = reg.EnumKey(hive, key, subkeys)
  If Not IsNull(subkeys) Then
    For Each sk In subkeys
      If key = "" Then
        path = sk
      Else
        path = key & "\" & sk
      End If
      DeleteFromRegistry hive, path, valueToDelete
    Next
  End If
End Sub

'iterate over hives (HKCR can be ignored, because it's just a combining view
'on 2 subkeys of HKLM and HKCU)
For Each hive In Array(HKCU, HKLM, HKU)
  DeleteFromRegistry hive, "", valueToDelete
Next