I notice that the virt-win-reg tool says it doesn't work with HKU/$SID keys, and by golly it doesn't :-).
Is there a way to modify a users registry in a Windows XP image file using some other technique?
I've got my custom clone script working to modify the machine name, but I'd like to also modify the default background image, which is in my user's hive.
On Sat, May 14, 2011 at 09:55:08AM -0400, Tom Horsley wrote:
I notice that the virt-win-reg tool says it doesn't work with HKU/$SID keys, and by golly it doesn't :-).
Is there a way to modify a users registry in a Windows XP image file using some other technique?
I've got my custom clone script working to modify the machine name, but I'd like to also modify the default background image, which is in my user's hive.
It's just not implemented yet. That's because I haven't yet sat down and worked out how user names are mapped to the user hive files, across all the different versions of Windows.
However you can just edit the user hive file directly if you know where it is.
For example with Windows 7 (which works differently from other versions of Windows, hence the difficulty I mention above):
$ sudo guestfish --ro -i -d Win7x32
Welcome to guestfish, the libguestfs filesystem interactive shell for editing virtual machine filesystems.
Type: 'help' for help on commands 'man' to read the manual 'quit' to quit the shell
Operating system: Windows 7 Enterprise /dev/vda2 mounted on /
<fs> file /Users/rjones/NTUSER.DAT
MS Windows registry file, NT/2000 or above
<fs> download /Users/rjones/NTUSER.DAT /tmp/ntuser.dat <fs> exit
$ hivexregedit --export /tmp/ntuser.dat \ '\Software\Microsoft\Windows\CurrentVersion\Explorer' | head Windows Registry Editor Version 5.00
[\Software\Microsoft\Windows\CurrentVersion\Explorer] "CleanShutdown"=dword:00000001 "ExplorerStartupTraceRecorded"=dword:00000001 "ShellState"=hex(3):24,00,00,00,30,28,00,00,00,00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,12,00,00,00,00,00,00,00,22,00,00,00
[\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced] "AutoCheckSelect"=dword:00000000 "DontPrettyPath"=dword:00000000
You could also edit the hive file (hivexregedit --merge) and upload it back into the guest.
Patches welcome.
Rich.
On Sat, 14 May 2011 16:21:24 +0100 Richard W.M. Jones wrote:
However you can just edit the user hive file directly if you know where it is.
Yea, I was just figuring out the one I want is probably C:\Documents and Settings\Tom\NTUSER.DAT and am about to experiment with hivexregedit or hivexsh and see what I can do.
Thanks.
On Sat, May 14, 2011 at 11:49:19AM -0400, Tom Horsley wrote:
On Sat, 14 May 2011 16:21:24 +0100 Richard W.M. Jones wrote:
However you can just edit the user hive file directly if you know where it is.
Yea, I was just figuring out the one I want is probably C:\Documents and Settings\Tom\NTUSER.DAT and am about to experiment with hivexregedit or hivexsh and see what I can do.
I tried to change the background by altering the registry key but could come up with anything that actually worked. I'm not exactly sure what I'm doing wrong, but if you make it work please post how you did it ...
Rich.
On Sun, May 15, 2011 at 10:15:44AM +0100, Richard W.M. Jones wrote:
could come up with anything that actually worked.
^could NOT
I could make Windows change the background to all black though, very easily :-)
Rich.
On Sun, 15 May 2011 10:15:44 +0100 Richard W.M. Jones wrote:
I tried to change the background by altering the registry key but could come up with anything that actually worked. I'm not exactly sure what I'm doing wrong, but if you make it work please post how you did it ...
Well, it was tricky. The registry key (actually two different ones apparently) holds the name of the image last used to make the cached .bmp file that is really used as the background, so it turned out I really needed to change two registry keys, convert the jpeg those keys point at to a .bmp and update the .bmp file really being used as the background (whew! :-).
Here's the last half of my update-image script (which will probably get mangled by line wrapping :-)
# Next we need to do the much more complex task of updating the wallpaper # image for the default login user (me). Start by grabbing the NTUSER.DAT # hive file.
guestfish --ro -i -a $name.img download 'WIN:C:\Documents and Settings'"$user"'\NTUSER.DAT' $tmpdir/NTUSER.DAT
# Then update that hive to indicate that the wallpaper comes from the desired # standard wallpaper image
bak="$tmpdir/bak.reg" sed -e 's/@JPEG@/'"$wallpaper"'/g' > $bak <<'EOF' [Control Panel\Desktop] "ConvertedWallpaper"="C:\WINDOWS\Web\Wallpaper\@JPEG@.jpg"
[Software\Microsoft\Windows\CurrentVersion\Themes\LastTheme] "Wallpaper"="%SystemRoot%\Web\Wallpaper\@JPEG@.jpg" EOF hivexregedit --merge $tmpdir/NTUSER.DAT $bak guestfish -i -a $name.img upload $tmpdir/NTUSER.DAT 'WIN:C:\Documents and Settings'"$user"'\NTUSER.DAT'
# But wait! There's more, we not only need to fix the registry, but also # update the cached bitmap image of the jpg file.
guestfish --ro -i -a $name.img download 'WIN:C:\WINDOWS\Web\Wallpaper'"$wallpaper"'.jpg' $tmpdir/wall.jpg bmp="$tmpdir/Wallpaper1.bmp" convert $tmpdir/wall.jpg $bmp guestfish -i -a $name.img upload $bmp 'WIN:C:\Documents and Settings'"$user"'\Local Settings\Application Data\Microsoft\Wallpaper1.bmp'
I'm going to write this up in more detail and stick it on my web site, but I haven't gotten around to it yet (just got the script to finally work yesterday).
On Sun, 15 May 2011 10:15:44 +0100 Richard W.M. Jones wrote:
I tried to change the background by altering the registry key but could come up with anything that actually worked. I'm not exactly sure what I'm doing wrong, but if you make it work please post how you did it ...
I've updated my web page of my KVM tricks:
http://home.comcast.net/~tomhorsley/wisdom/braindump/kvm.html
It now has a link to my full update-image script which changes the machine name and the background wallpaper when cloning my XP KVM.
On Sun, May 15, 2011 at 12:56:22PM -0400, Tom Horsley wrote:
On Sun, 15 May 2011 10:15:44 +0100 Richard W.M. Jones wrote:
I tried to change the background by altering the registry key but could come up with anything that actually worked. I'm not exactly sure what I'm doing wrong, but if you make it work please post how you did it ...
I've updated my web page of my KVM tricks:
http://home.comcast.net/~tomhorsley/wisdom/braindump/kvm.html
It now has a link to my full update-image script which changes the machine name and the background wallpaper when cloning my XP KVM.
I didn't realize it would be so complicated :-)
You might use guestfish remote control to avoid repeated start-ups:
http://libguestfs.org/guestfish.1.html#remote_control_guestfish_over_a_socke...
Rich.
On Mon, 16 May 2011 11:27:33 +0100 Richard W.M. Jones wrote:
You might use guestfish remote control to avoid repeated start-ups:
http://libguestfs.org/guestfish.1.html#remote_control_guestfish_over_a_socke...
It seems to run quite fast already, don't know if I want to complicate the script any more than it already is :-).
-
Richard W.M. Jones -
Tom Horsley