CODEWITHSUNDEEP
registrylogparser
Sagar
Sagar

Reputation: 1

LogParser: Windows Registry

I'm trying to list the things in the Windows registry path. I'm unable to query on a specific key but the rest are working?

Query:

LogParser.exe -i:REG "Select * From HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData"

Error:

Task aborted.
Cannot open <from-entity>: Error opening files: Error searching for files in
folder C:\Windows\Installer\HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion:
The system cannot find the path specified.

What is working:

LogParser is working when I remove the "UserData" from the above query?

Query:

LogParser -i:REG "select Path from hklm\software\microsoft\windows\currentversion\Installer"

Output:

Path
----------------------------------------------
HKLM\software\microsoft\windows\currentversion\Installer

Upvotes: 0

Views: 366

Answers (1)

Gabriele Giuseppini
Gabriele Giuseppini

Reputation: 1581

It seems LogParser is trying to enumerate the 32-bit "mirror" of HKLM rather than the 64-bit node, probably because LogParser itself is a 32-bit process and that is subject to Windows' 64-bit redirection.

The only workaround I may think of is to create a 64-bit executable stub which starts the LogParser.exe executable after turning off the 64-bit redirection.

Upvotes: 0

Related Questions