search

StackCrash / Fix-Unquoted

Powershell script to find and correct unquoted search/service paths
https://www.itsecguy.com/fixing_unquoted/
MIT License
9 stars 2 forks source link

No longer remediates the unquoted search paths issue in `\Services\` #1

Open branpurn opened 1 year ago

branpurn commented 1 year ago

The error requested registry access is not allowed is returned on trying to use *.OpenSubKey on scattered keys (not all); this may be what is causing the behavior, RE: script no longer remediates the unquoted search paths issue in \Services\

ex.,

1/4/2023 11:11    Unable to open System\CurrentControlSet\Services\EventLog\Application\Software Installation
1/4/2023 11:11    Unable to open System\CurrentControlSet\Services\EventLog\Application\SPP
1/4/2023 11:11    Unable to open System\CurrentControlSet\Services\EventLog\Application\SrmSvc
1/4/2023 11:11    Unable to open System\CurrentControlSet\Services\EventLog\Application\System Restore
1/4/2023 11:11    Unable to open System\CurrentControlSet\Services\EventLog\Application\Universal Print
1/4/2023 11:11    Unable to open System\CurrentControlSet\Services\EventLog\Application\VSS
1/4/2023 11:11    Unable to open System\CurrentControlSet\Services\EventLog\Application\WerSvc
1/4/2023 11:11    Unable to open System\CurrentControlSet\Services\EventLog\Application\Windows Backup
1/4/2023 11:11    Unable to open System\CurrentControlSet\Services\EventLog\Application\Windows Search Service
1/4/2023 11:11    Unable to open System\CurrentControlSet\Services\EventLog\Application\Windows Search Service Profile Notification
1/4/2023 11:11    Unable to open System\CurrentControlSet\Services\EventLog\System\AppReadiness
1/4/2023 11:11    Unable to open System\CurrentControlSet\Services\EventLog\System\Kerberos

Expected behavior: see alternative remediation scripts, ex., VectorBCO Windows Path Enumeration

StackCrash commented 1 year ago

I haven't see this behavior on my local systems. Did you run the script in an elevated PowerShell instance? What version of Windows?