Batch file REG editing

Switch` · 6 Sep 2010 at 13:47

Right. So I've got to add a security package to the key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
Edit the entry called "Security Packages" and add the value "tspkg"

under normal circumstances

Code:

reg add reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa /v "Security Packages" /t REG_MULTI_SZ /d tspkg

Would make the specific key value be tspkg, but the requirement is to append the current value, rather than replace it.

For example the current value of HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa "Security Packages" is

kerberos
msv1_0
schannel
wdigest
pku2u

and it needs to read as

kerberos
msv1_0
schannel
wdigest
pku2u
tspkg

I would just specify the list of packages I want to allow, but there's possible circumstances where this list has already been changed

and thus specifying the entire list would be unhelpful as it would remove the other entries

so what I need is a way to meerly append the current value

thoughts or ideas?

Switch` · 6 Sep 2010 at 16:53

The idea is to be able to run these scripts over Group Policy, so the key is making the script dynamic enough to keep the already present value and just apend the last bit to what ever is already present.

Switch` · 7 Sep 2010 at 14:41

Powershell isn't an option as its going to be running in a XP environment

Switch` · 20 Sep 2010 at 15:29

So

so who knows how to make VB script tackle multi key values in the registry?

Switch` · 20 Sep 2010 at 18:42

Now you see this is where it gets interesting

If it was for any device on the domain, or even any device in a particular OU this wouldn't be an issue.

But its for specific Windows XP machines (not 7 like most of the machines on the domain) and it is for devices (mostly laptops) which staff take home need to be able to access our portal from home.

Windows Vista > has the security provider already listed.
So what we need is a script/exe we can dole out to the staff who have xp machines that will add the required value to the registry so that their machines can get onto our portal system from home.

So AD/GP is out for this, as its possible some machines in question won't even be connected to the domain at all.