How to Find any value in Registry

[manoj]

Archived from groups: microsoft.public.windowsnt.registry (More info?)

hi
Please give a reply. I'm new with registry.
There is a file AppEvent.EVT in system32\config directory. Only Through
Control Panel I can delete its contents.Is it possible to delete its
contents through registry? if yes then tell me how?
Since for Internet Option i can clear forms and passwords through control
panel as well as through registry.
Basically i want to know about
"when i click(specially right click) on any file or directory, an exe is
called(through registry). I want to know how can i find this exe in registry
for any entry ?
since i'm new with registry so please tell about a complete book of registry
but please give the reply of AppEvent.Evt file. Where i can find its entry
in registry and how can clear its contents through registry?

 

[Guest]

Archived from groups: microsoft.public.windowsnt.registry (More info?)

AFAIK there is no normal file association for EVT; The application
%systemroot%\system32\eventvwr.exe
appears to be hardcoded to these file found in
%systemroot%\system32\config

You have three choices for emptying the log files.
1.) Through the application.
2.) By deleting the desired EVT file while the 'Event Log' service is
disabled.
3.) By deleting the desired EVT file while the operating system isn't
running.

If you post some details of what you're trying to accomplish there may be
another solution.


--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect


"manoj" wrote:
| hi
| Please give a reply. I'm new with registry.
| There is a file AppEvent.EVT in system32\config directory. Only Through
| Control Panel I can delete its contents.Is it possible to delete its
| contents through registry? if yes then tell me how?
| Since for Internet Option i can clear forms and passwords through control
| panel as well as through registry.
| Basically i want to know about
| "when i click(specially right click) on any file or directory, an exe is
| called(through registry). I want to know how can i find this exe in
registry
| for any entry ?
| since i'm new with registry so please tell about a complete book of
registry
| but please give the reply of AppEvent.Evt file. Where i can find its entry
| in registry and how can clear its contents through registry?
|
|
|
|

 

[manoj]

Archived from groups: microsoft.public.windowsnt.registry (More info?)

I have done it for steps 2 and 3(manually)
ok according to you, there is no value in registry for deleting its contents
But i want to do it by step1 i.e. through programming
Now i open "Computer Management" window through programming. Now i try to
send keys to this window but i fail because "Computer Management" window has
not focus. I focus on it(by
setfocus,setforegroundwindow,setwindowactive,appactivate) but fail.
If i open any application by Shell() then i sendkeys to this application
after avtivating it. but here i open "Computer Management" window by Run(of
shell) method.
Tell me how can i do it?
OR is there other way to do it?

 

[Guest]

Archived from groups: microsoft.public.windowsnt.registry (More info?)

Possibly use RegWrite method of VBScript to set the
Reg_Dword "Start" value to 0x4
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog

0x0 "Boot" Represents a part of the driver stack for the boot volume and
must therefore be loaded by the Boot Loader.
0x1 "System" Represents a driver to be loaded subsystem at Kernel
initialization.
0x2 "Automatic" To be loaded or started automatically for all startups
regardless of service type.
0x3 "Manual" Available, regardless of type, but will not be started until
the user starts it (for example, by using the Devices icon in Control
Panel).
0x4 "Disabled" NOT TO BE STARTED UNDER ANY CONDITIONS.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect


"manoj" wrote:
|I have done it for steps 2 and 3(manually)
| ok according to you, there is no value in registry for deleting its
contents
| But i want to do it by step1 i.e. through programming
| Now i open "Computer Management" window through programming. Now i try to
| send keys to this window but i fail because "Computer Management" window
has
| not focus. I focus on it(by
| setfocus,setforegroundwindow,setwindowactive,appactivate) but fail.
| If i open any application by Shell() then i sendkeys to this application
| after avtivating it. but here i open "Computer Management" window by
Run(of
| shell) method.
| Tell me how can i do it?
| OR is there other way to do it?
|
|

 

[manoj]

Archived from groups: microsoft.public.windowsnt.registry (More info?)

Thanks but this doesn't delete previous contents of AppEvent.Evt. Its
contents may be deleted by selecting EventViewer from Control
Panel(Administrative Tools) then select Application and clear all events.
This is the work we done in control panel. I want to ask can we do it by
registry?( as according to you we can disable EventLog service through
control panel as well as registry by selecting start and set 0x4) i.e. is
there any key in registry which holds contents of ApEvent.evt and if we
delete it then AppEvent contents also delete.
I think now u understood my query
So please reply
and Thanks for your + response

 

[Guest]

Archived from groups: microsoft.public.windowsnt.registry (More info?)

No not in any form. The only storage space for the application event log is
the file found in
%systemroot%\system32\config\AppEvent.Evt

The previous was meant as a means for you to programmatically stop the
'Event Log' service.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect


"manoj" wrote:

<snip>
is
| there any key in registry which holds contents of ApEvent.evt and if we
| delete it then AppEvent contents also delete.
<snip>

 

[manoj]

Archived from groups: microsoft.public.windowsnt.registry (More info?)

Sir, It's in any form because i have an exe which delete contents of
AppEvent and it doesn't open compmgmt.msc to clear its contents. I'm sure it
done through registry.

 

[manoj]

Archived from groups: microsoft.public.windowsnt.registry (More info?)

Sir, It's in any form because i have an exe which delete contents of
AppEvent and it doesn't open compmgmt.msc to clear its contents. I'm sure it
done through registry.

 

[Guest]

Archived from groups: microsoft.public.windowsnt.registry (More info?)

This VBScript may work for you.

------
strComputer = "."
Set oWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Security)}!\\" & _
strComputer & "\root\cimv2")
Set cLogFiles = oWMIService.ExecQuery _
("SELECT * FROM Win32_NTEventLogFile WHERE LogfileName='Application' ")
For Each oLogfile in cLogFiles
oLogFile.ClearEventLog()
Next
-------------

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

 

[manoj]

Archived from groups: microsoft.public.windowsnt.registry (More info?)

Thanks
Sir you solved my problem. Actually i was trying this by SendKeys(). I open
winmgmts.msc by mmc.exe through Shell function then i send keys to it. But
it success sometimes and fails sometimes.
But the code you sent run successfully.
Sir please tell me is there any book where i can found such topics or how
can i know about such topics.
At last thanks again

 

[Guest]

Archived from groups: microsoft.public.windowsnt.registry (More info?)

Glad to hear it. Take a look around here.

http://www.microsoft.com/technet/community/scriptcenter/default.mspx

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect


"manoj" wrote:
| Thanks
| Sir you solved my problem. Actually i was trying this by SendKeys(). I
open
| winmgmts.msc by mmc.exe through Shell function then i send keys to it. But
| it success sometimes and fails sometimes.
| But the code you sent run successfully.
| Sir please tell me is there any book where i can found such topics or how
| can i know about such topics.
| At last thanks again
|
|

 

[manoj]

Archived from groups: microsoft.public.windowsnt.registry (More info?)

Sir
Like Win32_NTEventLogFile, is there any class for InternetExplorer?

 

[Guest]

Archived from groups: microsoft.public.windowsnt.registry (More info?)

Ask them in .scripting.vbscript

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect


"manoj" wrote:
| Sir
| Like Win32_NTEventLogFile, is there any class for InternetExplorer?
|
|

 

[manoj]

Archived from groups: microsoft.public.windowsnt.registry (More info?)

Sir
you use GetObject() in which you pass class id for eventlogfile.
Please tell me where can i find these class IDs
say i want to find class ID for paging file
should i find in registry? if yes then where?

 

[manoj]

Archived from groups: microsoft.public.windowsnt.registry (More info?)

Hi
Sir i have searched Win32 services
I'm using Win32_PageFileSetting to change its size.
my code is

strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery("Select * from
Win32_PageFileSetting",,48)
For Each objItem in colItems
objItem.InitialSize=50
objItem.MaximumSize=300
Next

But it doesn't chanmge its size.why?
Please tell me. Either how can i change its size or delete its contents?

 

[Guest]

Archived from groups: microsoft.public.windowsnt.registry (More info?)

Ask them in win32.programmer.wmi

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect


"manoj" wrote:
| Hi
| Sir i have searched Win32 services
| I'm using Win32_PageFileSetting to change its size.
| my code is
|
| strComputer = "."
| Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
| Set colItems = objWMIService.ExecQuery("Select * from
| Win32_PageFileSetting",,48)
| For Each objItem in colItems
| objItem.InitialSize=50
| objItem.MaximumSize=300
| Next
|
| But it doesn't chanmge its size.why?
| Please tell me. Either how can i change its size or delete its contents?
|
|
|
|