Query registry based on value inside key without knowing key name

Question

I am a system administrator at a high school and I would like to uninstall LanSchool off all my teachers laptops, however the uninstall requires that it be uninstalled using the MSI that installed it, this I have found can be circumvented by uninstalling using the UninstallString found in the registry HKLM\Software\Microsoft\Windows(SID) UninstallString=Value

The issue I am having however is the SID is a variable for different versions of the software.

Inside the variable key however, is the DisplayName "LanSchool Teacher".

I would like to know if it is possible to somehow REG QUERY the DisplayName, then from there export the KEY to a txt file to Set it as a variable in CMD and then run an msiexec.exe /X{SIDVariable} /quiet

This would then uninstall LanSchool Teacher from that computer.

My question is: How do I REG QUERY without knowing the KEY Name as it would vary per teachers laptop.

Answer 1

In your case, it looks to me that you could use

REG Query HKLM\Software\Microsoft /V "DisplayName" /S

and then parse the output to find the name of the key you are looking for. /V indicates to query for a value./S indicates the search should be done recursively.

If this does not work and/or if I did not understand your question, check out Rob van der Woude's Scripting Pages which have a fairly extensive overview about searching the registry. This might teach you other ways to find your key as well.