Cannot open Regedit.exe in Windows server 2003

Olivier · 10-12-2007

Hello all,

I have been trying to install McAfee ePolicy orchestrator on my windows 2003
server. When I launched the install files for one of the component of McAfee
the system tells me that: 'The setup program cannot be run under a user
account other than the logged on user.

When I went to McAffe support they provided me with this solution:

IMPORTANT: These instructions are intended for network and ePO
administrators only. This article contains information about modifying the
registry. Before you modify the registry, make sure to back it up and make
sure that you understand how to restore the registry if a problem occurs. For
information about how to back up, restore, and edit the registry, see the
following Microsoft Knowledge Base article:
http://support.microsoft.com/kb/256986/EN-US/.

1. Back up the ePO server Registry to a network share.
2. Open the Registry Editor and navigate to the following registry key:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon]

3. Double-click the string value Shell.
4. Change Value Data to Explorer.exe.
5. Close the Registry Editor.
6. Run setup.exe again.

Cause

The installer cannot find Explorer.exe in C:\Windows as specified in the
Shell string value within the following registry key:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

- Now when I go to run Regedit.exe the system does not respond as if nothing
was send to process (No prompting windows.....).

I have downloaded a s;mall software called registry jumper but when i run it
to open a registry it tells me that: ' Can not launch Regedit.exe'.

I am desperatly needing to install this McAffe since virus has caused a
disaster to our network. Would you help me diagnose this problem so that I
can edit the registry.

Thank you for your understanding.

dreambig2212 · 10-12-2007

"Olivier" wrote:

> Hello all,
>
> I have been trying to install McAfee ePolicy orchestrator on my windows 2003
> server. When I launched the install files for one of the component of McAfee
> the system tells me that: 'The setup program cannot be run under a user
> account other than the logged on user.
>
> When I went to McAffe support they provided me with this solution:
>
> IMPORTANT: These instructions are intended for network and ePO
> administrators only. This article contains information about modifying the
> registry. Before you modify the registry, make sure to back it up and make
> sure that you understand how to restore the registry if a problem occurs. For
> information about how to back up, restore, and edit the registry, see the
> following Microsoft Knowledge Base article:
> http://support.microsoft.com/kb/256986/EN-US/.
>
> 1. Back up the ePO server Registry to a network share.
> 2. Open the Registry Editor and navigate to the following registry key:
>
> [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
> NT\CurrentVersion\Winlogon]
>
> 3. Double-click the string value Shell.
> 4. Change Value Data to Explorer.exe.
> 5. Close the Registry Editor.
> 6. Run setup.exe again.
>
> Cause
>
> The installer cannot find Explorer.exe in C:\Windows as specified in the
> Shell string value within the following registry key:
>
> [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
>
> - Now when I go to run Regedit.exe the system does not respond as if nothing
> was send to process (No prompting windows.....).
>
> I have downloaded a s;mall software called registry jumper but when i run it
> to open a registry it tells me that: ' Can not launch Regedit.exe'.
>
> I am desperatly needing to install this McAffe since virus has caused a
> disaster to our network. Would you help me diagnose this problem so that I
> can edit the registry.
>
> Thank you for your understanding.

Please use reg command in cmd and check whether you are able to edit the
shell or not from there.

Newell White · 10-12-2007

If regedit.exe will not run, first suspect is deliberate action by malware.

If you really want to try and recover your system 'as is', you can:
1) Copy regedit.exe from system32 to another folder.
2)Rename the copy 'myregedit.exe'
3)Move myregedit.exe back to system32 and run it.

However the recommendation for a compromised server is to backup application
data, then reformat and rebuild.
--
Regards,
Newell White

"Olivier" wrote:

> Hello all,
>
> I have been trying to install McAfee ePolicy orchestrator on my windows 2003
> server. When I launched the install files for one of the component of McAfee
> the system tells me that: 'The setup program cannot be run under a user
> account other than the logged on user.
>
> When I went to McAffe support they provided me with this solution:
>
> IMPORTANT: These instructions are intended for network and ePO
> administrators only. This article contains information about modifying the
> registry. Before you modify the registry, make sure to back it up and make
> sure that you understand how to restore the registry if a problem occurs. For
> information about how to back up, restore, and edit the registry, see the
> following Microsoft Knowledge Base article:
> http://support.microsoft.com/kb/256986/EN-US/.
>
> 1. Back up the ePO server Registry to a network share.
> 2. Open the Registry Editor and navigate to the following registry key:
>
> [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
> NT\CurrentVersion\Winlogon]
>
> 3. Double-click the string value Shell.
> 4. Change Value Data to Explorer.exe.
> 5. Close the Registry Editor.
> 6. Run setup.exe again.
>
> Cause
>
> The installer cannot find Explorer.exe in C:\Windows as specified in the
> Shell string value within the following registry key:
>
> [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
>
> - Now when I go to run Regedit.exe the system does not respond as if nothing
> was send to process (No prompting windows.....).
>
> I have downloaded a s;mall software called registry jumper but when i run it
> to open a registry it tells me that: ' Can not launch Regedit.exe'.
>
> I am desperatly needing to install this McAffe since virus has caused a
> disaster to our network. Would you help me diagnose this problem so that I
> can edit the registry.
>
> Thank you for your understanding.

Pegasus \(MVP\) · 10-12-2007

"Olivier" <[email protected]> wrote in message
news:[email protected]...
> Hello all,
>
> I have been trying to install McAfee ePolicy orchestrator on my windows
> 2003
> server. When I launched the install files for one of the component of
> McAfee
> the system tells me that: 'The setup program cannot be run under a user
> account other than the logged on user.
>
> When I went to McAffe support they provided me with this solution:
>
> IMPORTANT: These instructions are intended for network and ePO
> administrators only. This article contains information about modifying the
> registry. Before you modify the registry, make sure to back it up and make
> sure that you understand how to restore the registry if a problem occurs.
> For
> information about how to back up, restore, and edit the registry, see the
> following Microsoft Knowledge Base article:
> http://support.microsoft.com/kb/256986/EN-US/.
>
> 1. Back up the ePO server Registry to a network share.
> 2. Open the Registry Editor and navigate to the following registry key:
>
> [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
> NT\CurrentVersion\Winlogon]
>
> 3. Double-click the string value Shell.
> 4. Change Value Data to Explorer.exe.
> 5. Close the Registry Editor.
> 6. Run setup.exe again.
>
> Cause
>
> The installer cannot find Explorer.exe in C:\Windows as specified in the
> Shell string value within the following registry key:
>
> [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
>
> - Now when I go to run Regedit.exe the system does not respond as if
> nothing
> was send to process (No prompting windows.....).
>
> I have downloaded a s;mall software called registry jumper but when i run
> it
> to open a registry it tells me that: ' Can not launch Regedit.exe'.
>
> I am desperatly needing to install this McAffe since virus has caused a
> disaster to our network. Would you help me diagnose this problem so that I
> can edit the registry.
>
> Thank you for your understanding.

You can edit the registry either by booting the machine with
a Bart PE boot CD or by temporarily connecting the server
system disk to some Windows XP PC.

However, as others have said, an infected server is a
compromised server. I would rebuild it.