CODEWITHSUNDEEP
windowsbatch-fileremote-registry
J. Davalos
J. Davalos

Reputation: 95

Discrepancy REG QUERY local vs remote computer batch script

I'm writing a batch script to update a software package (uninstall old version/ install new one). This needs to be done over the network as there are 500 PCs to update. One of the first steps before uninstalling is checking wether that software is installed or not. In order to check that I query the registry:

reg query "HKLM\SOFTWARE\A.E.T Europe B.V."

This query gives adecuate results when running in local (for testing purposes), but when I run it remotely (they way it will be ran) returns wrong results.

reg query "\\I301\HKLM\SOFTWARE\A.E.T Europe B.V."

returns 0 if i run that line locally. But if I log into I301 and run the query locally returns 1, being the truth that A.E.T Europe B.V. shows up under the Wow6432Node branch in the windows registry.

Why is that???

Thanks in advance!

Upvotes: 1

Views: 710

Answers (3)

Mofi
Mofi

Reputation: 49146

If there is on 64-bit Windows just the key

HKLM\SOFTWARE\Wow6432Node\A.E.T Europe B.V.

but no key

HKLM\SOFTWARE\A.E.T Europe B.V.

the reason for the different result is caused most likely by which version of reg.exe is executed from batch file or command line.

The key is not found if 64-bit %SystemRoot%\System32\reg.exe is executed on processing the batch file or running the command by 64-bit %SystemRoot%\System32\cmd.exe on using the line

reg query "\\I301\HKLM\SOFTWARE\A.E.T Europe B.V."

But the key is found if 32-bit %SystemRoot%\SysWOW64\reg.exe is executed on processing the batch file or running the command by 32-bit %SystemRoot%\SysWOW64\cmd.exe on using the line

reg query "HKLM\SOFTWARE\A.E.T Europe B.V."

because for the 32-bit applications the registry access to HKLM\SOFTWARE is redirected to HKLM\SOFTWARE\Wow6432Node by registry redirector.

Check both possible key locations:

@echo off
%SystemRoot%\System32\ping.exe -n 1 I301 >nul
if errorlevel 1 (
    echo Computer with name I301 is not available in network.
    goto :EOF
)

%SystemRoot%\System32\reg.exe query "\\I301\HKLM\SOFTWARE\A.E.T Europe B.V." >nul 2>&1
if not errorlevel 1 goto Installed
%SystemRoot%\System32\reg.exe query "\\I301\HKLM\SOFTWARE\Wow6432Node\A.E.T Europe B.V." >nul 2>&1
if not errorlevel 1 goto Installed

echo A.E.T Europe B.V. is not installed.
goto :EOF

:Installed
echo A.E.T Europe B.V. is installed already.

See also the Microsoft documentation pages:

Upvotes: 3

J. Davalos
J. Davalos

Reputation: 95

Thanks Mofi and RGuggisberg,

Found out about everything Mofi said (and RGuggisberg complemented) later on the day. Since I couldn't make it work I tried checking for the Uninstall entry in the registry, thinking it would be there and only there. After getting again similar results I did a bit more googling and found out about Windows having two trees in the registry: one for 32 bits applications and another for 64 bits. The hint was given by:

At the end it shows up the two options that RGuggisber mentions /reg:32 & /reg:64. Looked them up and found about the existence of both registries.

Tried same query (for uninstalled) BUT using /reg:64 and found the key I was looking for. Tried with /reg:32 and indeed could not find it. The machine I was running the script from runs Windows 7 32-bits. The remote machine Windows 8.1 64 bits.

Upvotes: 0

RGuggisberg
RGuggisberg

Reputation: 4750

Good answer by Mofi. On 64 bit systems you might also consider using

/reg:32 & /reg:64 See REG QUERY /?

You can sometimes get into trouble if you are launching CMD.exe from another app. If that app is a 32 bit app it will launch the 32 bit version of CMD.exe

Upvotes: 1

Related Questions