I'd like complete Bogdan Mitrache's answer with an exemple.
To perform this i use a C# custom action to acces registry and control the WOW behavior.
public partial class CustomActions
{
#region marshalling RegCreateKeyEx RegOpenKeyEx RegCloseKey RegSetValueEx
[Flags]
public enum RegOption
{
NonVolatile = 0x0,
Volatile = 0x1,
CreateLink = 0x2,
BackupRestore = 0x4,
OpenLink = 0x8
}
[Flags]
public enum RegSAM
{
QueryValue = 0x0001,
SetValue = 0x0002,
CreateSubKey = 0x0004,
EnumerateSubKeys = 0x0008,
Notify = 0x0010,
CreateLink = 0x0020,
WOW64_32Key = 0x0200,
WOW64_64Key = 0x0100,
WOW64_Res = 0x0300,
Read = 0x00020019,
Write = 0x00020006,
Execute = 0x00020019,
AllAccess = 0x000f003f
}
public enum RegResult
{
CreatedNewKey = 0x00000001,
OpenedExistingKey = 0x00000002
}
[StructLayout(LayoutKind.Sequential)]
public class SECURITY_ATTRIBUTES
{
public int nLength;
public IntPtr lpSecurityDescriptor;
public int bInheritHandle;
}
[DllImport("advapi32.dll", SetLastError = true)]
static extern int RegCreateKeyEx(
RegistryHive hKey,
string lpSubKey,
int Reserved,
string lpClass,
RegOption dwOptions,
RegSAM samDesired,
SECURITY_ATTRIBUTES lpSecurityAttributes,
out UIntPtr phkResult,
out RegResult lpdwDisposition);
[DllImport("advapi32.dll", CharSet = CharSet.Unicode, EntryPoint = "RegOpenKeyEx")]
static extern int RegOpenKeyEx(
RegistryHive hKey,
string subKey,
uint options,
RegSAM sam,
out UIntPtr phkResult);
[DllImport("advapi32.dll", SetLastError = true)]
static extern int RegCloseKey(
UIntPtr hKey);
[DllImport("advapi32.dll", SetLastError = true)]
static extern uint RegSetValueEx(
UIntPtr hKey,
[MarshalAs(UnmanagedType.LPStr)]
string lpValueName,
int Reserved,
RegistryValueKind dwType,
[MarshalAs(UnmanagedType.LPStr)] string lpData,
int cbData);
const int KEY_WOW64_64KEY = 0x0100;
const int KEY_READ = 0x20019;
#endregion
private static uint WriteValue_String(UIntPtr hKey, string sName, string sValue)
{
uint setRes = RegSetValueEx(hKey, sName, 0, Microsoft.Win32.RegistryValueKind.String, sValue, sValue.Length + 1);
return setRes;
}
[CustomAction]
public static ActionResult EnableAutoLogon(Session session)
{
_session = session;
LogUtil.WriteDebugInfo(session, "Enter Function");
try
{
SECURITY_ATTRIBUTES secAttribs = new SECURITY_ATTRIBUTES();
UIntPtr hKey;
RegResult regResult;
LogUtil.WriteDebugInfo(session, "RegOpenKeyEx");
int result = RegOpenKeyEx(
RegistryHive.LocalMachine,
@"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",
0,
RegSAM.WOW64_64Key | RegSAM.SetValue,
out hKey);
LogUtil.WriteDebugInfo(session, "WriteValue_String");
uint setRes = WriteValue_String(hKey, "DefaultUserName", "admin");
setRes = WriteValue_String(hKey, "DefaultPassword", "admin");
setRes = WriteValue_String(hKey, "AutoAdminLogon", "1");
LogUtil.WriteDebugInfo(session, "RegCloseKey");
int closeRes = RegCloseKey(hKey);
}
catch (System.Exception ex)
{
LogUtil.WriteDebugInfo(session, "Exception occured : " + ex.Message + "\n" + ex.StackTrace);
LogUtil.WriteDebugInfo(session, "Exit Function");
return ActionResult.Failure;
}
LogUtil.WriteDebugInfo(session, "Exit Function");
return ActionResult.Success;
}
}
KEY_WOW64_32KEY (0x0200) Indicates that an application on 64-bit
Windows should operate on the 32-bit registry view. This flag is
ignored by 32-bit Windows. For more information, see Accessing an
Alternate Registry View.
This flag must be combined using the OR operator with the other flags
in this table that either query or access registry values.
Windows 2000: This flag is not supported.
KEY_WOW64_64KEY (0x0100) Indicates that an application on 64-bit
Windows should operate on the 64-bit registry view. This flag is
ignored by 32-bit Windows. For more information, see Accessing an
Alternate Registry View.
This flag must be combined using the OR operator with the other flags
in this table that either query or access registry values.
Windows 2000: This flag is not supported.