Edited the registry with C# but cannot find the change with regedit

2.1k views Asked by At


I changed my registry via C# with the following code:

RegistryKey regKey = RegistryKey.OpenBaseKey(RegistryHive.LocalMachine, RegistryView.Registry32);
RegistryKey openSubKey = regKey.OpenSubKey(@"SOFTWARE\ASA\Suite", true);
openSubKey?.SetValue("Password", encryptedString, RegistryValueKind.String);
openSubKey?.SetValue("UserName", UserNameTextBox.Text, RegistryValueKind.String);
openSubKey?.SetValue("DomainName", DomainNameTextBox.Text, RegistryValueKind.String);
openSubKey?.Close();
regKey.Close();

These entries did already exist and were only replaced. When I use the same kind of code to read the settings I get the correct settings back, BUT when I open the registry with regedit.exe and search for it manually I find only the old values. In the regedit.exe it is this path: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\ASA\Suite I already looked into the path without WOW6432Node (and even in the HKCU) but there is no ASA entry at all.
Has someone an idea what that could be? Why don't I see the changes I made? I am completly puzzled here...

EDIT: I changed my project from anyCPU to x86 and no change, but as soon as I changed it to x64 the keys read were the ones that regedit.exe shows. But I open the 32bit variant of the registry hive, and when I write something here the question persists... why can't I see the changes made? A x86 app under x64 Windows should automatically write to the WOW6432Node, shouldn't it?

EDIT2: I tested the x86 version on an x86 Windows. I change the registry and can read it, but with regedit I cannot see the changes... wtf is this?

EDIT3: I found the changed keys under HKCR\VirtualStore\MACHINE\SOFTWARE\ASA\Suite I don't know why yet, but I search for an answer and post it here.

2

There are 2 answers

0
Marcel Grüger On BEST ANSWER

Ok, I have the answer. I didn't wanted to use a manifest so I removed it and thus didn't got asked if the app had to be elevated. So, because a normal user (even if the logged in user had admin rights) can't write to the HKLM, it wrote a key to HKCU\VirtualStore... that way my app could also read the keys but in the regedit.exe it was not where it was expected. To get around this I implemented a manifest and changed the line with the requestedExecutionLevel:

<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />

Now I don't even have to build an x64 and an x86 version but can use Any CPU instead and let my app do the work (i.e.: to look if to use the RegistryView.Registry32 or RegistryView.Registry64)

1
Bojan On

May be somebody else is overwriting it, this can help!

The Wow6432Node registry entry indicates that you are running a 64-bit Windows version.

The operating system uses this key to display a separate view of HKEY_LOCAL_MACHINE\SOFTWARE for 32-bit applications that run on 64-bit Windows versions. When a 32-bit application writes or reads a value under the HKEY_LOCAL_MACHINE\SOFTWARE\<company>\<product> subkey, the application reads from the HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\<company>\<product> subkey.

A registry reflector copies certain values between the 32-bit and 64-bit registry views (mainly for COM registration) and resolves any conflicts using a "last-writer-wins" approach.