3

I have a very stubborn registry key which is impossible to delete or access: HKLM\Software\Symantec\Symantec Endpoint Protection\CurrentVersion. When I try to open it in regedit, it says "An error is preventing this key from being opened. Details: The system cannot find the file specified."

When I try to delete the whole branch, all I get is "Error while deleting key".

Following some advice I found elsewhere, I tried downloading the RegDelNull utility from Sysinternals, but scanning the whole HKLM tree did not reveal any items to delete. However, when I specified the entire path to the bad key, I got the following message:

"A null context handle was passed from the client to the host during a remote procedure call."

Why did regedit complain about being unable to find the file specified? Is it something related to the way registry entries are stored?

More importantly, how do I delete the keys when they cannot even be deleted by the utility made for precisely this purpose?

11
  • What is the path to the key, and do you have permissions for it?
    – Jonno
    Feb 12, 2016 at 15:05
  • Key added. Being the admin of the system, I have all the permissions I should need.
    – JohnEye
    Feb 12, 2016 at 15:11
  • Not necessarily - registry keys have their own permissions (right click -> Permissions). Make sure administrators/your account has permission to modify.
    – Jonno
    Feb 12, 2016 at 15:12
  • A permission problem would manifest differently though, wouldn't it? I have checked though and have both read and write permissions set to Allow for the account I'm using.
    – JohnEye
    Feb 12, 2016 at 15:14
  • Some keys need "full access," not just read-write. For my system builds, there's at least one registry key I have to go give full access to my account (or all accounts).
    – bgStack15
    Feb 12, 2016 at 16:39

1 Answer 1

3

I had a similar issue on my Windows 7 box. I eventually figured out that the key was a broken symbolic link. The built-in regedit tool does not seem to properly support these, and acts as described when trying to access such a key.

I managed to delete the broken symbolic link using https://github.com/tenox7/regln like this:

C:\Users\Zero3\Desktop>regln-x64.exe -d "\Registry\User\S-1-5-21-1688150413-3759
594893-2435602081-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extension
s\Approved"

You will need to adapt the path to your use case, of course.

(For reference, I noted that a similar issue was posted here: https://serverfault.com/questions/796797/regedit-error-cannot-find-the-file-specified-accessing-key/963975)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .