We Keep Coding

Change MachineGuid C#

i was wondering for a project of mine, is it possible to change the MachineGuid from the registry or any other way? I've seen it in multiple applications and I can't do it myself..This is my code
RegistryKey reg = Registry.LocalMachine;
reg.OpenSubKey("SOFTWARE\\Microsoft\\Cryptography");
reg.DeleteValue("MachineGuid");
reg.Close();
consolebox.AppendText("MachineGuid should be changed!\n");
But it doesn't work.. it doesn't delete the MachineGuid value, which would automatically regenerate in about a second....
The error says that it doesnt find the value.. that MachineGuid doesn't exist... but when i go to regedit it does?
If i don't run the application as an Administrator, it says the value got deleted, but if i do it says it doesn't exist....

You have a couple of issues, first you don't open the key to be writeable and you don't use the result of OpenSubKey. That method returns the key you actually opened.
RegistryKey reg = Registry.LocalMachine;
using(var key = reg.OpenSubKey("SOFTWARE\\Microsoft\\Cryptography", true)) // writeable
{
key.DeleteValue("MachineGuid");
}
The RegistryKey object implements IDisposable, better apply the using pattern in that case to close and dispose the key.

C# editing Registry does not work

I am trying to do some registry editing. The below code is a MCVE of my problem:
RegistryKey key;
key = Registry.LocalMachine.OpenSubKey("DRIVERS", true);
key = key.CreateSubKey("Names");
key.SetValue("Name", "nick", RegistryValueKind.String);
key.Close();
That code works fine. The following (changed DRIVERS to SOFTWARE) does not:
RegistryKey key;
key = Registry.LocalMachine.OpenSubKey("SOFTWARE", true);
key = key.CreateSubKey("Names");
key.SetValue("Name", "nick", RegistryValueKind.String);
key.Close();
To me, the difference between the two blocks of code is trivial. What is the cause of this issue, and how can I get around it? I am already running the code as an admin.
My end goal is to modify the values in the "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" folder.
I know this is possible from Powershell - it should be possible from C# as well.

You can write to the 64-bit registry from a 32-bit process, but you need to explicitly request the 64-bit registry as follows (modified from your code in the Q).
var hklm = RegistryKey.OpenBaseKey(Microsoft.Win32.RegistryHive.LocalMachine, RegistryView.Registry64);
RegistryKey key = hklm.OpenSubKey("SOFTWARE", true);
key = key.CreateSubKey("Names");
key.SetValue("Name", "nick", RegistryValueKind.String);
key.Close();

Remote Registry Reads Not Working

I've searched and found a lot of good information on remote registry reads but nothing seems to address my problem. I've never had to ask for help before but I'm at a loss as to why I can't get my code to work. I have a mapped drive, on the same domain, so credentials are not the issue. I'm not getting access denied. My code is pretty much straight from the Microsoft examples. It should be pretty easy.
This code works with no problems:
string keyname = #"SOFTWARE\Microsoft\Windows\CurrentVersion";
RegistryKey rk = RegistryKey.OpenRemoteBaseKey(RegistryHive.LocalMachine, "COMPUTER.opr.domain.org");
RegistryKey registryKey = rk.OpenSubKey(keyname);
string mykey = (string)registryKey.GetValue("DevicePath");
Console.WriteLine(mykey);
However, if I simply change the key as follows, it now fails with a null exception
string keyname = #"SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update";
RegistryKey rk = RegistryKey.OpenRemoteBaseKey(RegistryHive.LocalMachine, "COMPUTER.opr.domain.org");
RegistryKey registryKey = rk.OpenSubKey(keyname);
string mykey = (string)registryKey.GetValue("RebootRequired");
Console.WriteLine(mykey);
The key RebootRequired is present on the remote machine. And permissions don't seem to be an issue either. This is also my first post so I hope I did not violate any rules.
Thoughts?
Thanks,
Rob

issue with RegistryKey when using opensubkey and then changing that subkey

OK, so i'm having this issue and i really just dont understand why. although i know i can just change the whole text i would just like to better understand why this is happening. so lets say im opening a subkey
RegistryKey regkey = RegistryKey.OpenRemoteBaseKey(RegistryHive.LocalMachine, workstation, RegistryView.Registry64).OpenSubKey(#"Software\Censored\Issuance\test\", true);
that will work fine i can set/get key values and such but then lets say i need to move to another subkey why cant i just do
regkey= regkey.opensubkey(#"\Software\something\somewhere\youknow");
then start setting or getting values from that new location? any help would be appreciated!
i tried to search for a similar post but didnt appear that anyone had asked about this before sorry if it's a dupe!

RegistryKey regkey = RegistryKey.OpenRemoteBaseKey(RegistryHive.LocalMachine, workstation, RegistryView.Registry64)
.OpenSubKey(#"Software\Censored\Issuance\test\", true);
regkey = regkey.opensubkey(#"Foo");
This will open the subkey Foo at Software\Censored\Issuance\test\Foo
To read from a key that is not a subkey
RegistryKey baseKey = RegistryKey.OpenRemoteBaseKey(RegistryHive.LocalMachine, workstation, RegistryView.Registry64);
RegistryKey regkey = baseKey.OpenSubKey(#"Software\Censored\Issuance\test\", true);
...
regkey = baseKey.OpenSubKey(#"Software\something\somewhere\youknow", true);

Changing the Shell registry

At the start of my application i change the shell value of the registry to a custom shell and kill the explorer.exe (It is done outside the application), i want to allow a backdoor to return to the original shell and bring back the explorer.exe. brining the process back works fine for me but when i run my code to change the registry value no exception is thrown but the value doesn't change when i check in regedit,
this is my code (saw it here on a different question) :
RegistryKey regKey = Registry.LocalMachine.OpenSubKey(#"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon", true);
regKey.SetValue("Shell", "explorer.exe", RegistryValueKind.String);
regKey.Close();
Please help

In your code, you are actually set the value of
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
Because some registry keys are redirected by WOW64, please check MSDN to get more details.
Try this:
RegistryKey localMachine = RegistryKey.OpenBaseKey(Microsoft.Win32.RegistryHive.LocalMachine, RegistryView.Registry64);
RegistryKey regKey = localMachine .OpenSubKey(#"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon", true);
regKey.SetValue("Shell", "explorer.exe", RegistryValueKind.String);
regKey.Close();