SOLVED

Win32 App Powershell 64bit registry access issue

%3CLINGO-SUB%20id%3D%22lingo-sub-2291280%22%20slang%3D%22en-US%22%3EWin32%20App%20Powershell%2064bit%20registry%20access%20issue%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2291280%22%20slang%3D%22en-US%22%3E%3CP%3EHello%20to%20all.%3C%2FP%3E%3CP%3EComing%20from%20SCCM%20to%20Intunes%20i%20started%20to%20recreate%20Application%20packages%2C%20with%20installers%20based%20on%20MSI%2C%20Batch%2C%20EXE%20and%20PowerShell.%20However%20i%20found%20an%20issue%20with%20PowerShell%20installations%2C%20that%20i%20am%20not%20able%20to%20overcome.%3CBR%20%2F%3EPowershell%20is%20not%20accessing%2064%20bit%20registry%2C%20due%20to%20Intune%20agent%20running%20the%20script%20in%2032%20bit%20mode.%3C%2FP%3E%3CP%3EFor%20example%20when%20i%20try%20to%20write%20a%20key%20(or%20value)%20to%20HKEY_LOCAL_MACHINE%5CSOFTWARE%5CTest%2C%20it%20stores%20the%20key%20in%20HKEY_LOCAL_MACHINE%5CSOFTWARE%5CWOW6432Node%5CTest%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20am%20partially%20able%20to%20go%20around%20the%20issue%20by%20importing%20.reg%20files%20or%20adding%20keys%2Fvalues%20in%20batch%20or%20PS%20using%20reg.exe%20with%20operator%20%2Freg%3A64%26nbsp%3B%20For%20example%3A%3C%2FP%3E%3CP%3Ereg%20import%20%22%25~dp0import.reg%22%20%2Freg%3A64%20%2Ff%3C%2FP%3E%3CP%3Ereg%20add%20%22HKLM%5CSOFTWARE%5CTest%22%20%2Freg%3A64%20%2Ff%3C%2FP%3E%3CP%3EThis%20is%20OK%20when%20i%20want%20to%20just%20write%20keys%20and%20values.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHowever%20when%20trying%20to%20read%20current%20registry%20and%20create%20new%2C%20or%20modify%20existing%20values%20i%20am%20not%20able%20to%20read%2Fwrite%20the%20registry%20due%20to%20powershell%20running%20in%2032bit%20mode%20and%20redirected%20to%20HKEY_LOCAL_MACHINE%5CSOFTWARE%5CWOW6432Node%3C%2FP%3E%3CP%3EFor%20Example%20installing%20draftsight%20that%20uses%20the%20same%26nbsp%3B%20license%20manager%20client%20as%20solidworks.%26nbsp%3B%3C%2FP%3E%3CP%3EIf%20solidworks%20is%20installed%2C%20license%20server%20registry%20entry%20is%20added%2C%20if%20not%20present.%20If%20solidworks%20is%20not%20installed%26nbsp%3B%20key%20and%20value%20is%20created%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%20class%3D%22lia-code-sample%20language-powershell%22%3E%3CCODE%3E%24flexreg%20%3D%20(Get-ItemProperty%20%22HKLM%3A%5CSoftware%5CFLEXlm%20License%20Manager%22).SW_D_LICENSE_FILE%0AStart-Process%20-Wait%20-NoNewWindow%20%22msiexec%22%20-ArgumentList%20%22%2Fi%22%2C%22%24pwd%5CDraftSight.msi%22%2C%22%2Fqb%22%2C%22LICENSETYPE%3D3%22%0Aif%20(!%24flexreg)%20%7B%0A%20%20%20%20New-Item%20-Path%20%22HKLM%3A%5CSoftware%22%20-Name%20%22FLEXlm%20License%20Manager%22%20-Force%0A%20%20%20%20New-ItemProperty%20%22HKLM%3A%5CSoftware%5CFLEXlm%20License%20Manager%22%20-Name%20%22SW_D_LICENSE_FILE%22%20-Value%20'portnr%40servername'%20-PropertyType%20STRING%20-Force%0A%7D%20elseif%20(%24flexreg%20-like%20'*portnr%40servername*')%20%7B%0AExit%0A%7D%20else%20%20%7B%0A%20%20%20%20New-ItemProperty%20%22HKLM%3A%5CSoftware%5CFLEXlm%20License%20Manager%22%20-Name%20%22SW_D_LICENSE_FILE%22%20-Value%20%24flexreg'%3Bportnr%40servername'%20-PropertyType%20STRING%20-Force%0A%7D%3C%2FCODE%3E%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20was%20searching%20the%20web%20for%20few%20days%20now%20and%20i%20am%20not%20able%20to%20find%20a%20solution.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20found%20few%20articles%20for%20using%20%3CSPAN%20class%3D%22pl-s%22%3ESysNative%2C%20but%20that%20is%20not%20present%20in%20Windows%2010%20anymore%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22pl-s%22%3EI%20tried%20to%20use%2064bit%20powershell%20to%20start%20the%20program%3A%3C%2FSPAN%3E%3CSPAN%20class%3D%22pl-s%22%3E%20%25SystemRoot%25%5Csystem32%5CWindowsPowerShell%5Cv1.0%5Cpowershell.exe%20-ExecutionPolicy%20Bypass%20-File%20registry.ps1%20%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22pl-s%22%3ESame%20outcome%20%2C%20powershell%20is%20forced%20to%2032%20bit%20mode.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22pl-s%22%3EI%20tried%20to%20force%20the%20path%3A%3CBR%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%20class%3D%22lia-code-sample%20language-powershell%22%3E%3CCODE%3ENew-Item%20-Path%20Registry%3A%3AHKEY_LOCAL_MACHINE%5CSOFTWARE%5C%20-Name%20%22Test%22%20-Force%0ANew-ItemProperty%20Registry%3A%3AHKEY_LOCAL_MACHINE%5CSOFTWARE%5CTest%5C%20%20-Name%20%22testproperty%22%20-Value%20'testvalue0000'%20-PropertyType%20STRING%20-Force%3C%2FCODE%3E%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22pl-s%22%3EWhich%20does%20not%20even%20write%20to%26nbsp%3B%3C%2FSPAN%3EHKEY_LOCAL_MACHINE%5CSOFTWARE%5CTest%20or%26nbsp%3B%20HKEY_LOCAL_MACHINE%5CSOFTWARE%5CWOW6432Node%5CTest.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERunning%20the%20scripts%20as%20local%20admin%20on%20the%20PC%20works%20off%20course.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20hope%20someone%20can%20point%20me%20to%20a%20solution.%20Thanks%20in%20advance%20for%20your%20donated%20brain%20power.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22pl-s%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2291280%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EIntune%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2291439%22%20slang%3D%22en-US%22%3ERe%3A%20Win32%20App%20Powershell%2064bit%20registry%20access%20issue%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2291439%22%20slang%3D%22en-US%22%3EHi%2C%3CBR%20%2F%3E%3CBR%20%2F%3EPlease%20take%20a%20look%20at%3CBR%20%2F%3E%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fblog.italik.co.uk%2Frunning-powershell-scripts-using-intune%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fblog.italik.co.uk%2Frunning-powershell-scripts-using-intune%2F%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3EAnd%20this%20one%3CBR%20%2F%3E%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fwww.anoopcnair.com%2Fintune-win32-app-deploy-system32-vs-syswow64%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fwww.anoopcnair.com%2Fintune-win32-app-deploy-system32-vs-syswow64%2F%3C%2FA%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2291479%22%20slang%3D%22en-US%22%3ERe%3A%20Win32%20App%20Powershell%2064bit%20registry%20access%20issue%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2291479%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%20thank%20you%20for%20the%20links%2C%20however%20i%20have%20read%20those%20articles%20already.%3C%2FP%3E%3CP%3EAnd%20as%20i%20wrote%2C%20SysNative%20directory%20is%20not%20present%20Windows%2010%20anymore.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20cannot%20use%20a%20Powershell%20script%20as%20it%20is%20not%20bringing%20any%20files%20for%20installation%20an%20cannot%20be%20published%20for%20the%20user%20to%20install.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHowever%20i%20have%20tested%20the%20script%20to%20be%20run%20in%2064%20bit%20host%20and%20it%20correctly%20created%20the%20key%20and%20value.%3C%2FP%3E%3CP%3EI%20cannot%20use%20the%20script%20as%20a%20dependency%20for%20a%20win32%20app%20however.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2291501%22%20slang%3D%22en-US%22%3ERe%3A%20Win32%20App%20Powershell%2064bit%20registry%20access%20issue%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2291501%22%20slang%3D%22en-US%22%3EHi%3CBR%20%2F%3E%3CBR%20%2F%3EI%20have%20got%20one%20idea%2C%20after%20my%20lunch%20i%20will%20test%20it%20out%20and%20let%20you%20know%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2291614%22%20slang%3D%22en-US%22%3ERe%3A%20Win32%20App%20Powershell%2064bit%20registry%20access%20issue%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2291614%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3CBR%20%2F%3E%3CBR%20%2F%3EYou%20could%20create%20something%20like%20this%20and%20convert%20it%20(with%20the%20msi)%20to%20a%20intunewin%20file%3CBR%20%2F%3EJust%20like%20i%20I%20did%20with%20a%20win32%20app%20to%20disable%20the%20oobe%20stage%20(for%20when%20you%20don't%20use%20autopilot)%3CBR%20%2F%3E%3A%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fcall4cloud.nl%2F2020%2F10%2Fthe-curious-cage-of-hiding-the-oobe-stage%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noreferrer%22%3Ehttps%3A%2F%2Fcall4cloud.nl%2F2020%2F10%2Fthe-curious-cage-of-hiding-the-oobe-stage%2F%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3EI%20uploaded%20the%20app%20just%20a%20few%20seconds%20ago%2Cfirst%20I%20need%20to%20spin%20up%20a%20clean%20windows%2010%20test%20vm.%20I%20will%20let%20you%20know%20the%20outcome.%20UPDATE%2014%3A05%3A%20The%20registry%20keys%20were%20succefully%20created.%20Of%20course%2C%20I%20skipped%20the%20msi%20part%20but%20I%20this%20something%20you%20could%20use%3F%3CBR%20%2F%3E-----%3CBR%20%2F%3E%24content%20%3D%20%40'%3CBR%20%2F%3E%24flexreg%20%3D%20(Get-ItemProperty%20%22HKLM%3A%5CSoftware%5CFLEXlm%20License%20Manager%22).SW_D_LICENSE_FILE%3CBR%20%2F%3E%23Start-Process%20-Wait%20-NoNewWindow%20%22msiexec%22%20-ArgumentList%20%22%2Fi%22%2C%22%24pwd%5CDraftSight.msi%22%2C%22%2Fqb%22%2C%22LICENSETYPE%3D3%22%3CBR%20%2F%3Eif%20(!%24flexreg)%20%7B%3CBR%20%2F%3ENew-Item%20-Path%20%22HKLM%3A%5CSoftware%22%20-Name%20%22FLEXlm%20License%20Manager%22%20-Force%3CBR%20%2F%3ENew-ItemProperty%20%22HKLM%3A%5CSoftware%5CFLEXlm%20License%20Manager%22%20-Name%20%22SW_D_LICENSE_FILE%22%20-Value%20'portnr%40servername'%20-PropertyType%20STRING%20-Force%3CBR%20%2F%3E%7D%20elseif%20(%24flexreg%20-like%20'*portnr%40servername*')%20%7B%3CBR%20%2F%3EExit%3CBR%20%2F%3E%7D%20else%20%7B%3CBR%20%2F%3ENew-ItemProperty%20%22HKLM%3A%5CSoftware%5CFLEXlm%20License%20Manager%22%20-Name%20%22SW_D_LICENSE_FILE%22%20-Value%20%24flexreg'%3Bportnr%40servername'%20-PropertyType%20STRING%20-Force%3CBR%20%2F%3E%7D%3CBR%20%2F%3E'%40%3CBR%20%2F%3E%3CBR%20%2F%3EOut-File%20-FilePath%20%24(Join-Path%20%24env%3AProgramData%20CustomScripts%5Ctestreg.ps1)%20-Encoding%20unicode%20-Force%20-InputObject%20%24content%20-Confirm%3A%24false%3CBR%20%2F%3E%3CBR%20%2F%3E%23%20register%20script%20as%20scheduled%20task%3CBR%20%2F%3E%24Time%20%3D%20New-ScheduledTaskTrigger%20-AtLogOn%3CBR%20%2F%3E%24User%20%3D%20%22SYSTEM%22%3CBR%20%2F%3E%24Action%20%3D%20New-ScheduledTaskAction%20-Execute%20%22powershell.exe%22%20-Argument%20%22-ex%20bypass%20-file%20%60%22C%3A%5CProgramData%5CCustomScripts%5Ctestreg.ps1%60%22%20-Verb%20RunAs%22%3CBR%20%2F%3ERegister-ScheduledTask%20-TaskName%20%22testreg%22%20-Trigger%20%24Time%20-User%20%24User%20-Action%20%24Action%20-Force%3CBR%20%2F%3EStart-ScheduledTask%20-TaskName%20%22testreg%22%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

Hello to all.

Coming from SCCM to Intunes i started to recreate Application packages, with installers based on MSI, Batch, EXE and PowerShell. However i found an issue with PowerShell installations, that i am not able to overcome.
Powershell is not accessing 64 bit registry, due to Intune agent running the script in 32 bit mode.

For example when i try to write a key (or value) to HKEY_LOCAL_MACHINE\SOFTWARE\Test, it stores the key in HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Test

 

I am partially able to go around the issue by importing .reg files or adding keys/values in batch or PS using reg.exe with operator /reg:64  For example:

reg import "%~dp0import.reg" /reg:64 /f

reg add "HKLM\SOFTWARE\Test" /reg:64 /f

This is OK when i want to just write keys and values.

 

However when trying to read current registry and create new, or modify existing values i am not able to read/write the registry due to powershell running in 32bit mode and redirected to HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node

For Example installing draftsight that uses the same  license manager client as solidworks. 

If solidworks is installed, license server registry entry is added, if not present. If solidworks is not installed  key and value is created:

 

$flexreg = (Get-ItemProperty "HKLM:\Software\FLEXlm License Manager").SW_D_LICENSE_FILE
Start-Process -Wait -NoNewWindow "msiexec" -ArgumentList "/i","$pwd\DraftSight.msi","/qb","LICENSETYPE=3"
if (!$flexreg) {
    New-Item -Path "HKLM:\Software" -Name "FLEXlm License Manager" -Force
    New-ItemProperty "HKLM:\Software\FLEXlm License Manager" -Name "SW_D_LICENSE_FILE" -Value 'portnr@servername' -PropertyType STRING -Force
} elseif ($flexreg -like '*portnr@servername*') {
Exit
} else  {
    New-ItemProperty "HKLM:\Software\FLEXlm License Manager" -Name "SW_D_LICENSE_FILE" -Value $flexreg';portnr@servername' -PropertyType STRING -Force
}

 

I was searching the web for few days now and i am not able to find a solution.

 

I have found few articles for using SysNative, but that is not present in Windows 10 anymore

 

I tried to use 64bit powershell to start the program: %SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File registry.ps1

Same outcome , powershell is forced to 32 bit mode.

 

I tried to force the path:

 

New-Item -Path Registry::HKEY_LOCAL_MACHINE\SOFTWARE\ -Name "Test" -Force
New-ItemProperty Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Test\  -Name "testproperty" -Value 'testvalue0000' -PropertyType STRING -Force

 

Which does not even write to HKEY_LOCAL_MACHINE\SOFTWARE\Test or  HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Test.

 

Running the scripts as local admin on the PC works off course.

 

I hope someone can point me to a solution. Thanks in advance for your donated brain power.

 

 

10 Replies
best response confirmed by Ondrej_SK (Occasional Contributor)
Solution

Hi,

Please take a look at

https://blog.italik.co.uk/running-powershell-scripts-using-intune/

And this one

https://www.anoopcnair.com/intune-win32-app-deploy-system32-vs-syswow64/

 

What happens when you run a script with setting this option to yes instead of no

 

Rudy_Ooms_0-1619435688102.png

 

Hi, thank you for the links, however i have read those articles already.

And as i wrote, SysNative directory is not present Windows 10 anymore.

 

I cannot use a Powershell script as it is not bringing any files for installation an cannot be published for the user to install.

 

However i have tested the script to be run in 64 bit host and it correctly created the key and value.

I cannot use the script as a dependency for a win32 app however.

Hi

I have got one idea, after my lunch i will test it out and let you know

Hi,

You could create something like this and convert it (with the msi) to a intunewin file
Just like i I did with a win32 app to disable the oobe stage (for when you don't use autopilot)
:
https://call4cloud.nl/2020/10/the-curious-cage-of-hiding-the-oobe-stage/

I uploaded the app just a few seconds ago,first I need to spin up a clean windows 10 test vm. I will let you know the outcome. UPDATE 14:05: The registry keys were succefully created. Of course, I skipped the msi part but I this something you could use?
-----
$content = @'
$flexreg = (Get-ItemProperty "HKLM:\Software\FLEXlm License Manager").SW_D_LICENSE_FILE
#Start-Process -Wait -NoNewWindow "msiexec" -ArgumentList "/i","$pwd\DraftSight.msi","/qb","LICENSETYPE=3"
if (!$flexreg) {
New-Item -Path "HKLM:\Software" -Name "FLEXlm License Manager" -Force
New-ItemProperty "HKLM:\Software\FLEXlm License Manager" -Name "SW_D_LICENSE_FILE" -Value 'portnr@servername' -PropertyType STRING -Force
} elseif ($flexreg -like '*portnr@servername*') {
Exit
} else {
New-ItemProperty "HKLM:\Software\FLEXlm License Manager" -Name "SW_D_LICENSE_FILE" -Value $flexreg';portnr@servername' -PropertyType STRING -Force
}
'@

Out-File -FilePath $(Join-Path $env:ProgramData CustomScripts\testreg.ps1) -Encoding unicode -Force -InputObject $content -Confirm:$false

# register script as scheduled task
$Time = New-ScheduledTaskTrigger -AtLogOn
$User = "SYSTEM"
$Action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-ex bypass -file `"C:\ProgramData\CustomScripts\testreg.ps1`" -Verb RunAs"
Register-ScheduledTask -TaskName "testreg" -Trigger $Time -User $User -Action $Action -Force
Start-ScheduledTask -TaskName "testreg"

Woah. So you pack the script to a file, register a Scheduled task and execute it so that a new instance is executed in 64 bit. Is task scheduler using %SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe due to system default?

This is quite a stretch to get it working. Registering a scheduled task for each powershell installation that needs to work with registry and cleanup the scheduled task (with detection script for example)
Don't take me wrong you seem to have a workaround, but its quite complicated.

But you gave me an idea. i have to test to call %SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe from a batch file with start command.
Hi

Yes it's a little bit complicated... I just used this script which I had to control the oobe settings before the user logged on. Maybe it could be a little bit stripped down but it does the job :) . The schedule part was meant for scheduling :)
If the schedule part is only for scheduling, i do not understand how can i use it without it, to go around the problem of starting powershell in 64 bit mode to access the registry. Could you please explain?
Hi,

I guess my reply is/was missing the last part.

The schedule part was meant for scheduling :). But you don't need to schedule it to run at each user login, just let it run once and delete it after the task was run.

Unregister-ScheduledTask -TaskName testreg -Confirm:$false
OK, so i understood correctly.
Thank you for your help. I will continue to search for a more native resolution for this issue. Could be i need to fall back to your solution :)

@Rudy_Ooms So once Rudy pointed out that the sysnative is only accessible from 32bit consoles, i have tested and voila, the script is working like a charm! I have used a separate one line script to start the install script:

Start-Process -FilePath "$ENV:WINDIR\SysNative\WindowsPowershell\v1.0\PowerShell.exe" -ArgumentList "-File `"$($PSScriptRoot)\registry.ps1`" " -Wait -NoNewWindow

Happy ending of a thread :D