Registry Objects

These are the keywords for dealing with the Windows registry. Particular attention is paid to registered applications and their associated file extensions.

registry

The <registry> objects are the Inspectors that expose the Windows registry.

Creation Methods

Declaration	Description	Platforms (?)
native registry	On 32 bit versions of windows, this returns the same as registry32 and registry. On 64 bit versions of windows, this returns the same as registry64.	Win, WM
registry	Returns a registry object. Note: On a Macintosh, this returns a <dummy type> object.	Win, Mac, WM
x32 registry	Returns a 32-bit registry object. This Inspector is equivalent to the ordinary registry Inspector.	Win, WM
x64 registry	Returns a 64-bit registry object. This Inspector is for 64-bit computers only; there is no 64-bit registry on a 32-bit computer. Note that "x64 registry" and "native registry" on 64-bit machines do NOT provide the same view as the 64-bit version of regedit (the "physical" view). If you try to access the physical location of the 32-bit view keys using a 64-bit view, it will be mapped back to the equivalent location in the 64-bit view.	Win, WM

Properties

Declaration	Return type	Description	Platforms (?)
current user key of <registry>	<registry key> Plural: current user keys	Returns the registry key of the current logged on user if present	Win:9.0
application <string> of <registry>	<application> Plural: applications	Returns an application object matching name provided. See application.	Win, WM
application folder <string> of <registry>	<folder> Plural: application folders	Returns the folder containing the matching name provided. See application. The application does not have to exist. The folder has to exist.	Win, WM
application of <registry>	<application> Plural: applications	Iterates through the properly installed applications. See application.	Win, WM
current user key <logged on user> of <registry>	<registry key> Plural: current user keys	On 2000/2003/XP/Vista, this Inspector returns RegOpenCurrentUser. Under NT4, it uses HKEY_USERS\<sid>. On these systems, the Inspector may fail if run in a non-privileged context. Under Windows 9x, it returns HKEY_USERS\<username> if it exists. Otherwise it uses HKEY_USERS\Default.	Win
device key <string> of <registry>	<registry key> Plural: device keys	Iterates through all the keys known to the configuration manager for active devices whose "DeviceDesc" matches the name provided. See registry key.	Win
device key of <registry>	<registry key> Plural: device keys	Iterates through all the keys known to the configuration manager for active devices. See registry key.	Win
file extension <string> of <registry>	<registry key> Plural: file extensions	Returns a key associated with the named extension. See registry key.	Win, WM
file type <string> of <registry>	<registry key> Plural: file types	Returns a key associated the named file type. See registry key.	Win, WM
key <string> of <registry>	<registry key> Plural: keys	Returns a key associated with the name provided. See registry key.	Win, WM

registry key

The <registry key> objects represent Windows registry keys whose existence and properties can be inspected. Keys can be identified by name. There are several Inspectors that return keys from parts of the registry that store file associations and active device drivers.

Creation Methods

Declaration	Description	Platforms (?)
current user key of <registry>	Returns the registry key of the current logged on user if present	Win:9.0
current user key <logged on user> of <registry>	On 2000/2003/XP/Vista, this Inspector returns RegOpenCurrentUser. Under NT4, it uses HKEY_USERS\<sid>. On these systems, the Inspector may fail if run in a non-privileged context. Under Windows 9x, it returns HKEY_USERS\<username> if it exists. Otherwise it uses HKEY_USERS\Default.	Win
device key <string> of <registry>	Iterates through all the keys known to the configuration manager for active devices whose "DeviceDesc" matches the name provided. See registry key.	Win
device key of <registry>	Iterates through all the keys known to the configuration manager for active devices. See registry key.	Win
file extension <string> of <registry>	Returns a key associated with the named extension. See registry key. Example: value of file extension "bmp" of registry = "Paint.Picture" - Returns TRUE if there is only one value of the key "HKEY_CLASSES_ROOT\.bmp" and it contains the string "Paint.Picture". Example: file extension ".txt" of the registry - Returns a key corresponding to the application designated to process files with this extension. The dot is optional in the name provided. Looks for the key under HKEY_CLASSES_ROOT.	Win, WM
file type <string> of <registry>	Returns a key associated the named file type. See registry key. Example: file type "txtfile" of the registry - Returns a key whose existence indicates that there is an application designated to process text files. Looks for the key under HKEY_CLASSES_ROOT.	Win, WM
key <string> of <registry>	Returns a key associated with the name provided. See registry key. Example: key "HKEY_CLASSES_ROOT\txtfile" of the registry - Returns a key whose existence indicates that there is an application designated to process text files. Looks for the key under HKEY_CLASSES_ROOT. Example: key "txtfile" of key "HKEY_CLASSES_ROOT" of the registry - Returns a key whose existence indicates that there is an application designated to process text files. Looks for the key under HKEY_CLASSES_ROOT.	Win, WM
parent key of <registry key>	Returns the parent (one level up) of the specified registry key	Win:9.0
driver key of <registry key>	Normally used as a property of a device key. Looks up the value of "Driver" of the key provided to indirectly return another key corresponding to HKEY_LOCAL_MACHINE\System\CurrentControlSet\ Services\Class\<value of Driver>.	Win
key <string> of <registry key>	Returns a key for the named sub-key.	Win, WM
key of <registry key>	Iterates through the sub-keys of the key. Example: names of keys of key "HKEY_CLASSES_ROOT\txtfile\shell" of the registry - Iterates through all the sub-keys of the key provided. In this case, returning all the shell commands available to process the given file type.	Win, WM
driver key of <active device>	The key identified by adding the value of 'driver key value name of active device' to HKLM\System\CurrentControlSet\Control\Class\.	Win
user key of <logged on user>	Returns the registry key of the specified logged on user	Win:9.0

Properties

Declaration	Return type	Description	Platforms (?)
<registry key> as string	<string>	Returns the registry key name as a string	Win:9.0
parent key of <registry key>	<registry key> Plural: parent keys	Returns the parent (one level up) of the specified registry key	Win:9.0
application <string> of <registry key>	<application> Plural: applications	Returns the application associated with the named command. Normally used with a sub-key of key HKEY_CLASSES_ROOT whose name is a file type.	Win, WM
application folder <string> of <registry key>	<folder> Plural: application folders	Returns the parent folder associated with the named application. Normally used with a sub-key of key HKEY_CLASSES_ROOT whose name is a file type.	Win, WM
application folder of <registry key>	<folder> Plural: application folders	Returns the parent folder associated with the named application. Normally used with a sub-key of key HKEY_CLASSES_ROOT whose name is a file type.	Win, WM
application of <registry key>	<application> Plural: applications	Returns the application associated with the "open" command. Normally used with a sub-key of key HKEY_CLASSES_ROOT whose name is a file extension.	Win, WM
default value of <registry key>	<registry key value> Plural: default values	Returns the unnamed value associated with a key as a string. It does not necessarily exist.	Win, WM
driver key of <registry key>	<registry key> Plural: driver keys	Normally used as a property of a device key. Looks up the value of "Driver" of the key provided to indirectly return another key corresponding to HKEY_LOCAL_MACHINE\System\CurrentControlSet\ Services\Class\<value of Driver>.	Win
key <string> of <registry key>	<registry key> Plural: keys	Returns a key for the named sub-key.	Win, WM
key of <registry key>	<registry key> Plural: keys	Iterates through the sub-keys of the key.	Win, WM
last write time of <registry key>	<time> Plural: last write times	Whenever a registry key is written (created or modified) Windows updates the last write time. This Inspector returns that time to you on all Windows agents.	Win:8.0
name of <registry key>	<string> Plural: names	Returns the name of the key as a string.	Win, WM
security descriptor of <registry key>	<security descriptor> Plural: security descriptors	Specifies the security descriptor associated with the specified registry key.	Win
value <string> of <registry key>	<registry key value> Plural: values	Returns the named value stored under the key. See registry key value.	Win, WM
value of <registry key>	<registry key value> Plural: values	Iterates through values stored under a key.	Win, WM

registry key value

The <registry key value> Inspectors are used to access values stored within a registry key. All values have sizes and types. All of the values of a registry key have names except one, and it is called the 'default value'. The type of the data stored in the value determines what casting operations are allowed. We have implemented several casting Inspectors that you can use to extract values from the registry.

Creation Methods

Declaration	Description	Platforms (?)
default value of <registry key>	Returns the unnamed value associated with a key as a string. It does not necessarily exist. Example: default value of key ".txt" of key "HKEY_CLASSES_ROOT" of the registry = "txtfile" - True when the file extension is of type txtfile.	Win, WM
value <string> of <registry key>	Returns the named value stored under the key. See registry key value. Example: type of value "ProfileFlags" of key "HKEY_CURRENT_CONFIG" of registry = "REG_BINARY" - Returns TRUE when a value named ProfileFlags under the key "HKEY_CURRENT_CONFIG" exists and contains binary data. Example: size of value whose (name of it = "ProfileFlags") of key "HKEY_CURRENT_CONFIG" of registry = 4 - Returns TRUE when a value named ProfileFlags exists as a child of the key "HKEY_CURRENT_CONFIG" and the size of it is 4. Example: value "AutoRewind" of key "HKEY_CURRENT_USER\Software\Microsoft \ActiveMovie\Control\Media Player" of registry = 1 - Returns TRUE if the Media Player is set to AutoRewind.	Win, WM
value of <registry key>	Iterates through values stored under a key.	Win, WM

Operators

Declaration	Return Type	Description	Platforms (?)
<string> {cmp} <registry key value>	<boolean>		Win:9.0
<registry key value> {cmp} <integer>	<boolean>	Returns a boolean TRUE/FALSE depending on the result of the comparison, where:{cmp} is one of: =, !=, <, <=, >, >= .	Win, WM
<registry key value> {cmp} <registry key value>	<boolean>	Returns a boolean TRUE/FALSE depending on the result of the comparison, where:{cmp} is one of: =, !=, <, <=, >, >= .	Win, WM
<registry key value> {cmp} <string>	<boolean>	Returns a boolean TRUE/FALSE depending on the result of the comparison, where:{cmp} is one of: =, !=, <, <=, >, >= .	Win, WM

Properties

Declaration	Return type	Description	Platforms (?)
<registry key value> as system x32 file	<file>	If the value contains a string and the string points to an file, a file object is returned. Relative paths are interpreted relative to the x32 system folder.	Win:9.0
<registry key value> as system x64 file	<file>	If the value contains a string and the string points to an file, a file object is returned. Relative paths are interpreted relative to the x64 system folder.	Win:9.0
<registry key value> as application	<application>	If the data stored in the value is a string and it is the full pathname of an application that exists on disk, the application object is returned.	Win, WM
<registry key value> as file	<file>	If the data stored in the value is a string and it is the full pathname of a file that exists on disk, the file object is returned.	Win, WM
<registry key value> as folder	<folder>	If the data stored in the value is a string and it is the full pathname of a folder that exists on disk, the folder object is returned.	Win, WM
<registry key value> as integer	<integer>	Returns the value stored in the registry entry provided it can be fully represented as an integer.	Win, WM
<registry key value> as string	<string>	Returns a string if the data of the value is of type REG_SZ.	Win, WM
<registry key value> as system file	<file>	If the data stored in the value is a string and it is a relative pathname from the system folder of a file that exists on disk, the corresponding file object is returned.	Win, WM
<registry key value> as time	<time>	If the data stored in the value is a string in MIME compliant date format, this property will return a time object. If the data stored is a binary value and is 16 or more bytes in length, its first 16 bytes are interpreted as a SYSTEMTIME and the corresponding time object is returned. See time.	Win, WM
name of <registry key value>	<string> Plural: names	Returns the name of the value as a string. (see escape of <string> for more information).	Win, WM
size of <registry key value>	<integer> Plural: sizes	Returns the size of the data as an integer.	Win, WM
type of <registry key value>	<registry key value type> Plural: types	Returns the type of the data of the value. See type of value of key or registry.	Win, WM

registry key value type

The type identifier of the data associated with a registry key value.

Creation Methods

Declaration	Description	Platforms (?)
type of <registry key value>	Returns the type of the data of the value. See type of value of key or registry.	Win, WM

Operators

Declaration	Return Type	Description	Platforms (?)
<registry key value type> {cmp} <integer>	<boolean>	Returns a boolean TRUE/FALSE depending on the result of the comparison, where:{cmp} is one of: =, !=, <, <=, >, >= .	Win, WM
<registry key value type> {cmp} <registry key value type>	<boolean>	Returns a boolean TRUE/FALSE depending on the result of the comparison, where:{cmp} is one of: =, !=, <, <=, >, >= .	Win, WM
<registry key value type> {cmp} <string>	<boolean>	Returns a boolean TRUE/FALSE depending on the result of the comparison, where:{cmp} is one of: =, !=, <, <=, >, >= .	Win, WM
<string> {cmp} <registry key value type>	<boolean>	Returns a boolean TRUE/FALSE depending on the result of the comparison, where:{cmp} is one of: =, !=, <, <=, >, >= .	Win, WM

Properties

Declaration	Return type	Description	Platforms (?)
<registry key value type> as string	<string>	Returns the type of value as a string. One of REG_SZ, REG_NONE, REG_DWORD, REG_LINK, REG_BINARY, REG_MULTI_SZ, REG_EXPAND_SZ, REG_RESOURCE_LIST, REG_DWORD_LITTLE_ENDIAN, REG_DWORD_BIG_ENDIAN, REG_FULL_RESOURCE_DESCRIPTOR, REG_RESOURCE_REQUIREMENTS_LIST.	Win, WM

Terminology

Platform

Contents