How to read REG_SG value from Registry?

NTDEV
1

This is kinda wacky, but it seems that there’s some hidden REG_SG type
in the Registry. However, I’ve found no documentation about it and only
a few references to it.

This started when (on my Win2003 machine) I typed the command:
netsh routing ip nat delete ftp
And RegMon reported that it changed the key

HKLM\Software\Microsoft\ALG\ISV{6E590D61-F6BC-4DAD-AC21-7DC40D304059}
to “Disable”.

So, I pull up RegEdit, and while I find that key (and various values in
it), there’s nothing that I see with the value “Disable”.

A Microsoft support person mentioned that the key value is of type
REG_SG, but I’ve found nothing useful about that. I considered if it
was a typo for REG_SZ, but given the hidden nature of the key and what I
see in RegMon, I don’t think so.

Does anyone have any knowledge about that or know how I would read/write
such an REG_SG value outside of RegMon?

Or maybe I’m just being completely stupid and missing something?

Thanks in advance for any information!

2

How to read REG_SG value from Registry?There is no such thing as a REG_SG
value type. Registry values types are stored by a 32bits value and values
with types outside the range of the enumeration of registry value types will
also be displayed by RegEdit. When you mention that the key changed to
“Disable” you probably mean that the data of some value is being changed but
you did not mention the name of the value.

/Daniel

“Taed Wynnell” wrote in message news:xxxxx@ntdev…
This is kinda wacky, but it seems that there’s some hidden REG_SG type in
the Registry. However, I’ve found no documentation about it and only a few
references to it.
This started when (on my Win2003 machine) I typed the command:
netsh routing ip nat delete ftp
And RegMon reported that it changed the key
HKLM\Software\Microsoft\ALG\ISV{6E590D61-F6BC-4DAD-AC21-7DC40D304059}
to “Disable”.

3

> So, I pull up RegEdit, and while I find that key (and various values in

it), there’s nothing that I see with the value “Disable”.

I agree; there is a key by that name and no values in it that would
obviously correspond to being set to “Disable”.

There is a value by that same name though, which is REG_SZ and appears
to be set to “Enable” or “Disable”. In .REG syntax, we’re talking
about the difference between:

[HKEY_LOCAL_MAHCINE\Software\Microsoft\ALG\ISV]
“{6E590D61-F6BC-4DAD-AC21-7DC40D304059}”=“Disable”

and:

[HKEY_LOCAL_MAHCINE\Software\Microsoft\ALG\ISV{6E590D61-F6BC-4DAD-AC21-7DC40D304059}]
“Version”=“1.0”
“Publisher”=“Microsoft Corp.”
…

“Taed Wynnell” wrote:

> This is kinda wacky, but it seems that there’s some hidden REG_SG type
> in the Registry. However, I’ve found no documentation about it and only
> a few references to it.
>
> This started when (on my Win2003 machine) I typed the command:
> netsh routing ip nat delete ftp
> And RegMon reported that it changed the key
>
> HKLM\Software\Microsoft\ALG\ISV{6E590D61-F6BC-4DAD-AC21-7DC40D304059}
> to “Disable”.
>
> So, I pull up RegEdit, and while I find that key (and various values in
> it), there’s nothing that I see with the value “Disable”.
>
> A Microsoft support person mentioned that the key value is of type
> REG_SG, but I’ve found nothing useful about that. I considered if it
> was a typo for REG_SZ, but given the hidden nature of the key and what I
> see in RegMon, I don’t think so.
>
> Does anyone have any knowledge about that or know how I would read/write
> such an REG_SG value outside of RegMon?
>
> Or maybe I’m just being completely stupid and missing something?
>
> Thanks in advance for any information!

Alan Adams

4

“Alan Adams” wrote in message news:xxxxx@ntdev…
> > So, I pull up RegEdit, and while I find that key (and various values in
> > it), there’s nothing that I see with the value “Disable”.
>
> I agree; there is a key by that name and no values in it that would
> obviously correspond to being set to “Disable”.
>
> There is a value by that same name though, which is REG_SZ and appears
> to be set to “Enable” or “Disable”.

Drat! You’re right!

That explains why I didn’t see it in RegEdit – it was a value that was up a
level, not the key itself.

And REG QUERY apparently queries keys before it queries values, so that’s
why I didn’t get it that way either.

And in summary, I was just being stupid. I should have thought of that.

And so all of the notes from my Microsoft contact were just typos for
REG_SZ, which is funny since they made the same typo about 3 times.

Thanks!