ZwDeleteKey

I want to delete a key from registry and the status is 0xC0000121
(CANNOT_DELETE).

(\Registry\Machine\System\CurrentControlSet\Services\YY\XX)

How can I delete a key with ZwDeleteKey.

Here is my code :

RtlInitUnicodeString(&ustrname,
L"\Registry\Machine\System\CurrentControlSet\Services\YY\XX");

InitializeObjectAttributes(&m_attributes,&ustrname,OBJ_CASE_INSENSITIVE,
NULL,NULL);

status = ZwOpenKey(&ParamHandle,KEY_ALL_ACCESS,&m_attributes);

// This key is always opened
if(!NT_SUCCESS(status)) {
KdPrint ((“ZwOpenKey failed with Status=%x\n”, status));
ZwClose(ParamHandle);
return status;
}
status = ZwDeleteKey(ParamHandle);
if(!NT_SUCCESS(status)) {
KdPrint ((“ZwDeleteKey failed with Status=%x\n”, status));

}

ZwClose(ParamHandle);

Best regards

Are there any subkeys under the key you are deleting? If so, you must
delete each subkey first, starting with the leaf keys and working your
way up.

D

This posting is provided “AS IS” with no warranties, and confers no
rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Christian Grenier
Sent: Monday, September 29, 2003 11:04 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] ZwDeleteKey

I want to delete a key from registry and the status is 0xC0000121
(CANNOT_DELETE).

(\Registry\Machine\System\CurrentControlSet\Services\YY\XX)

How can I delete a key with ZwDeleteKey.

Here is my code :

RtlInitUnicodeString(&ustrname,
L"\Registry\Machine\System\CurrentControlSet\Services\YY\XX");

InitializeObjectAttributes(&m_attributes,&ustrname,OBJ_CASE_INSENSITIVE,
NULL,NULL);

status = ZwOpenKey(&ParamHandle,KEY_ALL_ACCESS,&m_attributes);

// This key is always opened
if(!NT_SUCCESS(status)) {
KdPrint ((“ZwOpenKey failed with Status=%x\n”, status));
ZwClose(ParamHandle);
return status;
}
status = ZwDeleteKey(ParamHandle);
if(!NT_SUCCESS(status)) {
KdPrint ((“ZwDeleteKey failed with Status=%x\n”, status));

}

ZwClose(ParamHandle);

Best regards


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

I verified and I don’t have any subkeys. The keys has only 3 parameters
like that :

keyX\YY\Param 1 = Value 1
keyX\YY\Param 2 = Value 2
keyX\YY\Param 3 = Value 3

Do I have to delete each parameter before to delete the key YY?

C

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Monday, September 29, 2003 2:41 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] RE: ZwDeleteKey

Are there any subkeys under the key you are deleting? If so, you must
delete each subkey first, starting with the leaf keys and working your
way up.

D

This posting is provided “AS IS” with no warranties, and confers no
rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Christian Grenier
Sent: Monday, September 29, 2003 11:04 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] ZwDeleteKey

I want to delete a key from registry and the status is 0xC0000121
(CANNOT_DELETE).

(\Registry\Machine\System\CurrentControlSet\Services\YY\XX)

How can I delete a key with ZwDeleteKey.

Here is my code :

RtlInitUnicodeString(&ustrname,
L"\Registry\Machine\System\CurrentControlSet\Services\YY\XX");

InitializeObjectAttributes(&m_attributes,&ustrname,OBJ_CASE_INSENSITIVE,
NULL,NULL);

status = ZwOpenKey(&ParamHandle,KEY_ALL_ACCESS,&m_attributes);

// This key is always opened
if(!NT_SUCCESS(status)) {
KdPrint ((“ZwOpenKey failed with Status=%x\n”, status));
ZwClose(ParamHandle);
return status;
}
status = ZwDeleteKey(ParamHandle);
if(!NT_SUCCESS(status)) {
KdPrint ((“ZwDeleteKey failed with Status=%x\n”, status));

}

ZwClose(ParamHandle);

Best regards


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@mcdi.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

I think so, try deleting the values and see. I know ZwDeleteKey does
not recursively delete, I can’t remember if the key must be entirely
empty.

As side note, in your error path, you are closing a handle value which
you did not successfully open

status = ZwOpenKey(&ParamHandle,KEY_ALL_ACCESS,&m_attributes);

// This key is always opened
if(!NT_SUCCESS(status)) {
KdPrint ((“ZwOpenKey failed with Status=%x\n”, status));
ZwClose(ParamHandle); <== this should be removed
return status;
}

D

This posting is provided “AS IS” with no warranties, and confers no
rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Christian Grenier
Sent: Monday, September 29, 2003 12:59 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] RE: ZwDeleteKey

I verified and I don’t have any subkeys. The keys has only 3 parameters
like that :

keyX\YY\Param 1 = Value 1
keyX\YY\Param 2 = Value 2
keyX\YY\Param 3 = Value 3

Do I have to delete each parameter before to delete the key YY?

C

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Monday, September 29, 2003 2:41 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] RE: ZwDeleteKey

Are there any subkeys under the key you are deleting? If so, you must
delete each subkey first, starting with the leaf keys and working your
way up.

D

This posting is provided “AS IS” with no warranties, and confers no
rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Christian Grenier
Sent: Monday, September 29, 2003 11:04 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] ZwDeleteKey

I want to delete a key from registry and the status is 0xC0000121
(CANNOT_DELETE).

(\Registry\Machine\System\CurrentControlSet\Services\YY\XX)

How can I delete a key with ZwDeleteKey.

Here is my code :

RtlInitUnicodeString(&ustrname,
L"\Registry\Machine\System\CurrentControlSet\Services\YY\XX");

InitializeObjectAttributes(&m_attributes,&ustrname,OBJ_CASE_INSENSITIVE,
NULL,NULL);

status = ZwOpenKey(&ParamHandle,KEY_ALL_ACCESS,&m_attributes);

// This key is always opened
if(!NT_SUCCESS(status)) {
KdPrint ((“ZwOpenKey failed with Status=%x\n”, status));
ZwClose(ParamHandle);
return status;
}
status = ZwDeleteKey(ParamHandle);
if(!NT_SUCCESS(status)) {
KdPrint ((“ZwDeleteKey failed with Status=%x\n”, status));

}

ZwClose(ParamHandle);

Best regards


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@mcdi.com
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Thanks, it’s now working. The registry folder must be entirely empty in
order to delete it.

Regards

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Monday, September 29, 2003 4:23 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] RE: ZwDeleteKey

I think so, try deleting the values and see. I know ZwDeleteKey does
not recursively delete, I can’t remember if the key must be entirely
empty.

As side note, in your error path, you are closing a handle value which
you did not successfully open

status = ZwOpenKey(&ParamHandle,KEY_ALL_ACCESS,&m_attributes);

// This key is always opened
if(!NT_SUCCESS(status)) {
KdPrint ((“ZwOpenKey failed with Status=%x\n”, status));
ZwClose(ParamHandle); <== this should be removed
return status;
}

D

This posting is provided “AS IS” with no warranties, and confers no
rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Christian Grenier
Sent: Monday, September 29, 2003 12:59 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] RE: ZwDeleteKey

I verified and I don’t have any subkeys. The keys has only 3 parameters
like that :

keyX\YY\Param 1 = Value 1
keyX\YY\Param 2 = Value 2
keyX\YY\Param 3 = Value 3

Do I have to delete each parameter before to delete the key YY?

C

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Monday, September 29, 2003 2:41 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] RE: ZwDeleteKey

Are there any subkeys under the key you are deleting? If so, you must
delete each subkey first, starting with the leaf keys and working your
way up.

D

This posting is provided “AS IS” with no warranties, and confers no
rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Christian Grenier
Sent: Monday, September 29, 2003 11:04 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] ZwDeleteKey

I want to delete a key from registry and the status is 0xC0000121
(CANNOT_DELETE).

(\Registry\Machine\System\CurrentControlSet\Services\YY\XX)

How can I delete a key with ZwDeleteKey.

Here is my code :

RtlInitUnicodeString(&ustrname,
L"\Registry\Machine\System\CurrentControlSet\Services\YY\XX");

InitializeObjectAttributes(&m_attributes,&ustrname,OBJ_CASE_INSENSITIVE,
NULL,NULL);

status = ZwOpenKey(&ParamHandle,KEY_ALL_ACCESS,&m_attributes);

// This key is always opened
if(!NT_SUCCESS(status)) {
KdPrint ((“ZwOpenKey failed with Status=%x\n”, status));
ZwClose(ParamHandle);
return status;
}
status = ZwDeleteKey(ParamHandle);
if(!NT_SUCCESS(status)) {
KdPrint ((“ZwDeleteKey failed with Status=%x\n”, status));

}

ZwClose(ParamHandle);

Best regards


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@mcdi.com
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@mcdi.com
To unsubscribe send a blank email to xxxxx@lists.osr.com