Repository navigation
Registry Paths
Relevant source files
The following files were used as context for generating this wiki page:
This reference page documents all Windows Registry locations accessed by OfficeScrubC2R during Office Click-to-Run detection and cleanup operations. These registry paths are organized by functional category and include both native 64-bit and WOW64 32-bit views where applicable.
For information about the registry operations and WOW64 handling implementation, see WOW64 Registry Handling. For details on the helper classes that access these paths, see RegistryHelper.
The following registry paths are used to detect installed Office Click-to-Run products and their configuration.
| Registry Path | Hive | Purpose | Referenced In |
|---|---|---|---|
SOFTWARE\Microsoft\Office\15.0\ClickToRun |
HKLM | Main C2R configuration for Office 2013 | Detection, cleanup |
SOFTWARE\Microsoft\Office\15.0\ClickToRun\PackageFolder |
HKLM | Package installation directory | Package location |
SOFTWARE\Microsoft\Office\15.0\ClickToRun\PackageGUID |
HKLM | Package identifier | Uninstall operations |
SOFTWARE\Microsoft\Office\15.0\ClickToRun\Configuration |
HKLM | Product release IDs | Product detection |
SOFTWARE\Microsoft\Office\15.0\ClickToRun\ProductReleaseIDs\Active\culture |
HKLM | Active product cultures and versions | Version detection |
SOFTWARE\Microsoft\Office\15.0\ClickToRun\propertyBag |
HKLM | Additional configuration properties | Configuration data |
SOFTWARE\Microsoft\Office\15.0\Registration |
HKCU | User-specific registration data | Cleanup target |
SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot\Virtual |
HKLM | Virtual installation root | Cleanup target |
| Registry Path | Hive | Purpose | Referenced In |
|---|---|---|---|
SOFTWARE\Microsoft\Office\16.0\ClickToRun |
HKLM | Main C2R configuration for Office 2016+ | Detection, cleanup |
SOFTWARE\Microsoft\Office\16.0\ClickToRun\PackageFolder |
HKLM | Package installation directory | Package location |
SOFTWARE\Microsoft\Office\16.0\ClickToRun\PackageGUID |
HKLM | Package identifier | Uninstall operations |
SOFTWARE\Microsoft\Office\16.0\ClickToRun\Configuration |
HKLM | Product release IDs | Product detection |
SOFTWARE\Microsoft\Office\16.0\ClickToRun\ProductReleaseIDs\Active\culture |
HKLM | Active product cultures and versions | Version detection |
SOFTWARE\Microsoft\Office\16.0\Registration |
HKCU | User-specific registration data | Cleanup target |
SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot\Virtual |
HKLM | Virtual installation root | Cleanup target |
| Registry Path | Hive | Purpose | Referenced In |
|---|---|---|---|
SOFTWARE\Microsoft\Office\ClickToRun |
HKLM | Main C2R configuration for Office 365 | Detection, cleanup |
SOFTWARE\Microsoft\Office\ClickToRun\PackageFolder |
HKLM | Package installation directory | Package location |
SOFTWARE\Microsoft\Office\ClickToRun\PackageGUID |
HKLM | Package identifier | Uninstall operations |
SOFTWARE\Microsoft\Office\ClickToRun\Configuration |
HKLM | Product configuration | Product detection |
SOFTWARE\Microsoft\Office\ClickToRun\ProductReleaseIDs |
HKLM | Product release identifiers root | Product enumeration |
SOFTWARE\Microsoft\Office\ClickToRun\ProductReleaseIDs\ActiveConfiguration |
HKLM | Current active configuration name | Configuration selection |
SOFTWARE\Microsoft\Office\ClickToRun\ProductReleaseIDs\<config>\culture |
HKLM | Culture-specific product data | Version and culture info |
Sources: OfficeScrubC2R-Native.cs:1313-1383, direct_conversion.cs:881-993
This diagram shows how the OfficeScrubOrchestrator coordinates registry detection through the RegistryHelper class.
graph TB
subgraph "PowerShell Layer"
PSM["OfficeScrubC2R.psm1<br/>FindInstalledOProducts"]
end
subgraph "Native Layer - Detection Logic"
ORCH["OfficeScrubOrchestrator"]
REGHELP["RegistryHelper<br/>GetValue, EnumerateKeys"]
end
subgraph "Registry Paths - Office Detection"
O15_C2R["HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun"]
O16_C2R["HKLM\SOFTWARE\Microsoft\Office\16.0\ClickToRun"]
O_C2R["HKLM\SOFTWARE\Microsoft\Office\ClickToRun"]
O15_PROD["HKLM\...\15.0\ClickToRun\ProductReleaseIDs"]
O16_PROD["HKLM\...\16.0\ClickToRun\ProductReleaseIDs"]
O_PROD["HKLM\...\ClickToRun\ProductReleaseIDs"]
end
subgraph "ARP Detection"
ARP["HKLM\SOFTWARE\Microsoft\Windows\<br/>CurrentVersion\Uninstall"]
end
PSM --> ORCH
ORCH --> REGHELP
REGHELP --> O15_C2R
REGHELP --> O16_C2R
REGHELP --> O_C2R
REGHELP --> O15_PROD
REGHELP --> O16_PROD
REGHELP --> O_PROD
REGHELP --> ARP
O15_C2R -.PackageFolder.-> O15_PROD
O16_C2R -.PackageFolder.-> O16_PROD
O_C2R -.PackageFolder.-> O_PROD
Sources: OfficeScrubC2R-Native.cs:334-616, direct_conversion.cs:872-1195
Windows Installer stores product and component metadata using compressed GUIDs as registry key names. The system cleans these paths to remove Office-related entries.
| Registry Path | Hive | GUID Format | Purpose |
|---|---|---|---|
SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes |
HKLM | Compressed (32 chars) | Upgrade code mappings |
Installer\UpgradeCodes |
HKCR | Compressed (32 chars) | Per-user upgrade codes |
SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products |
HKLM | Compressed (32 chars) | System product installations |
Installer\Products |
HKCR | Compressed (32 chars) | Published products |
Installer\Features |
HKCR | Compressed (32 chars) | Feature installation data |
| Registry Path | Hive | GUID Format | Purpose |
|---|---|---|---|
SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components |
HKLM | Compressed (32 chars) | System component registrations |
Installer\Components |
HKCR | Compressed (32 chars) | Published components with encoded GUIDs |
Note: Published Components use Base85-encoded GUIDs (20 characters) as value data within the registry keys.
Sources: OfficeScrubC2R-Native.cs:979-1094, direct_conversion.cs:2024-2323
This diagram illustrates the GUID transformation and Windows Installer metadata cleanup process.
graph LR
subgraph "WindowsInstallerHelper Methods"
CLEANUP_UC["CleanupUpgradeCodes()"]
CLEANUP_P["CleanupProducts()"]
CLEANUP_C["CleanupComponents()"]
CLEANUP_PC["CleanupPublishedComponents()"]
end
subgraph "GuidHelper Transformations"
GET_EXP["GetExpandedGuid()<br/>32-char → 38-char"]
GET_DEC["GetDecodedGuid()<br/>20-char Base85 → 38-char"]
end
subgraph "Registry Paths - WI Metadata"
UC_PATH["HKLM\SOFTWARE\...\Installer\UpgradeCodes\<br/>[32-char compressed GUID keys]"]
PROD_PATH["HKLM\...\UserData\S-1-5-18\Products\<br/>[32-char compressed GUID keys]"]
COMP_PATH["HKLM\...\UserData\S-1-5-18\Components\<br/>[32-char keys with 32-char values]"]
PUB_PATH["HKCR\Installer\Components\<br/>[32-char keys with 20-char encoded values]"]
end
subgraph "Scope Check"
INSCOPE["OfficeScrubOrchestrator<br/>IsInScope(guid)"]
end
CLEANUP_UC --> UC_PATH
CLEANUP_P --> PROD_PATH
CLEANUP_C --> COMP_PATH
CLEANUP_PC --> PUB_PATH
UC_PATH --> GET_EXP
PROD_PATH --> GET_EXP
COMP_PATH --> GET_EXP
PUB_PATH --> GET_DEC
GET_EXP --> INSCOPE
GET_DEC --> INSCOPE
INSCOPE -->|"True"| DELETE["RegistryHelper.DeleteKey()<br/>or DeleteValue()"]
Sources: OfficeScrubC2R-Native.cs:979-1094, OfficeScrubC2R-Native.cs:172-328
Shell integration registry paths control Windows Explorer context menus, icon overlays, and browser extensions. These are cleaned to remove Office shell hooks.
| Registry Path | Hive | Purpose |
|---|---|---|
SOFTWARE\Classes\Protocols\Handler\osf |
HKLM | Office Shared Facilities protocol handler |
| Registry Path | Hive | CLSID | Component |
|---|---|---|---|
SOFTWARE\Classes\CLSID\{573FFD05-2805-47C2-BCE0-5F19512BEB8D} |
HKLM | SharePoint context menu | Document management |
SOFTWARE\Classes\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7} |
HKLM | Office context menu | General Office integration |
SOFTWARE\Classes\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE} |
HKLM | Office context menu | File operations |
SOFTWARE\Classes\CLSID\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} |
HKLM | SharePoint context menu | SharePoint integration |
SOFTWARE\Classes\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1} |
HKLM | Office context menu | Additional operations |
| Registry Path | Hive | Purpose |
|---|---|---|
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Microsoft SPFS Icon Overlay 1 (ErrorConflict) |
HKLM | Error/conflict indicator |
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Microsoft SPFS Icon Overlay 2 (SyncInProgress) |
HKLM | Sync progress indicator |
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Microsoft SPFS Icon Overlay 3 (InSync) |
HKLM | In-sync indicator |
| Registry Path | Hive | CLSID | Purpose |
|---|---|---|---|
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} |
HKLM | Office BHO | Office web integration |
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} |
HKLM | Groove BHO | Groove/OneDrive integration |
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} |
HKLM | SharePoint BHO | SharePoint integration |
| Registry Path | Hive | Purpose |
|---|---|---|
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7} |
HKLM | OneNote desktop integration |
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\Namespace\{B28AA736-876B-46DA-B3A8-84C5E30BA492} |
HKLM | SharePoint sites |
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\NetworkNeighborhood\Namespace\{46137B78-0EC3-426D-8B89-FF7C3A458B5E} |
HKLM | Network neighborhood integration |
| Registry Path | Hive | Purpose |
|---|---|---|
SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved |
HKLM | Registry values list approved shell extensions by CLSID |
Sources: direct_conversion.cs:2331-2396
Run keys configure applications to launch at system startup or user login.
| Registry Path | Hive | Purpose | Typical Values |
|---|---|---|---|
SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
HKLM | System-wide startup programs | ClickToRun service monitors |
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Lync15 |
HKLM | Skype for Business 2013 startup | Removed during cleanup |
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Lync16 |
HKLM | Skype for Business 2016 startup | Removed during cleanup |
The system removes Run key values that contain C2R-specific paths or are explicitly named for Office components.
Sources: direct_conversion.cs:2088-2102
ARP entries register installed applications in the Windows control panel.
| Registry Path | Hive | Purpose |
|---|---|---|
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall |
HKLM | Main ARP registration root |
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\<ProductGUID> |
HKLM | Individual product entries |
The system identifies Office C2R products in ARP by examining:
-
UninstallStringvalue containing"MICROSOFT OFFICE 1"or"OFFICECLICKTORUN.EXE" -
DisplayVersionvalue for version identification -
DisplayNamevalue for product name -
SystemComponentDWORD value (should be 0 or absent for visible entries)
Sources: OfficeScrubC2R-Native.cs:41, direct_conversion.cs:41-42, 1039-1195
COM TypeLib registrations link type library GUIDs to physical DLL/TLB files on disk.
| Registry Path | Hive | Structure |
|---|---|---|
Software\Classes\TypeLib\{GUID} |
HKLM | Root for each TypeLib GUID |
Software\Classes\TypeLib\{GUID}\{Version} |
HKLM | Version-specific registration |
Software\Classes\TypeLib\{GUID}\{Version}\0\Win32 |
HKLM | 32-bit default locale file path |
Software\Classes\TypeLib\{GUID}\{Version}\0\Win64 |
HKLM | 64-bit default locale file path |
Software\Classes\TypeLib\{GUID}\{Version}\9\Win32 |
HKLM | 32-bit neutral locale file path |
Software\Classes\TypeLib\{GUID}\{Version}\9\Win64 |
HKLM | 64-bit neutral locale file path |
The TypeLibHelper class maintains a list of 80+ known Office TypeLib GUIDs for cleanup. Key examples include:
| TypeLib GUID | Component |
|---|---|
{000204EF-0000-0000-C000-000000000046} |
Microsoft Office Core |
{00020813-0000-0000-C000-000000000046} |
Excel Type Library |
{00020905-0000-0000-C000-000000000046} |
Word Type Library |
{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} |
Office Shared |
{91493440-5A91-11CF-8700-00AA0060263B} |
PowerPoint Type Library |
{EDCD5812-6A06-43C3-AFAC-46EF5D14E22C} |
Office Common |
The cleanup process validates that registered DLL/TLB files still exist before removing TypeLib entries.
Sources: OfficeScrubC2R-Native.cs:1099-1176, direct_conversion.cs:2404-2531
App-V integration paths store Click-to-Run virtualization metadata.
| Registry Path | Hive | Purpose |
|---|---|---|
SOFTWARE\Microsoft\AppV\ISV |
HKCU | User-specific App-V integration |
SOFTWARE\Microsoft\AppV\ISV |
HKLM | System-wide App-V integration |
SOFTWARE\Microsoft\AppVISV |
HKCU | Alternative App-V path (legacy) |
SOFTWARE\Microsoft\AppVISV |
HKLM | Alternative App-V path (legacy) |
The system enumerates all values under these keys and removes those that match C2R installation patterns.
Sources: direct_conversion.cs:1638-1671
On 64-bit systems, the RegistryHelper class automatically accesses both the native 64-bit and WOW64 32-bit registry views. The transformation is handled by the GetWow64Key() method.
| Original Path | WOW64 Transformed Path |
|---|---|
Software\Microsoft\Office |
Software\Wow6432Node\Microsoft\Office |
Software\Classes\TypeLib\{GUID} |
Software\Classes\Wow6432Node\TypeLib\{GUID} |
SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run |
Paths beginning with Software\Classes\ receive special handling where Wow6432Node is inserted after Classes\:
Software\Classes\CLSID\{GUID}
→ Software\Classes\Wow6432Node\CLSID\{GUID}
Implementation: OfficeScrubC2R-Native.cs:583-593
This diagram shows the dual-path registry access pattern for WOW64 support.
graph TB
subgraph "RegistryHelper Public Methods"
KEYEXISTS["KeyExists(hive, subKey)"]
DELETEKEY["DeleteKey(hive, subKey)"]
DELETEVALUE["DeleteValue(hive, subKey, valueName)"]
ENUMKEYS["EnumerateKeys(hive, subKey)"]
GETVALUE["GetValue(hive, subKey, valueName)"]
end
subgraph "Internal Path Resolution"
GETHIVEKEY["GetHiveKey(hive)<br/>→ Registry.LocalMachine, etc"]
GETWOW64["GetWow64Key(subKey)<br/>→ Insert Wow6432Node"]
IS64BIT["_is64Bit flag<br/>determines dual-path access"]
end
subgraph "Native Registry Access"
NATIVE64["Native 64-bit View<br/>Software\Microsoft\Office"]
WOW6432["WOW64 32-bit View<br/>Software\Wow6432Node\Microsoft\Office"]
end
subgraph "Registry.NET API"
REGAPI["Microsoft.Win32.Registry<br/>OpenSubKey, DeleteSubKey, etc"]
end
KEYEXISTS --> IS64BIT
DELETEKEY --> IS64BIT
DELETEVALUE --> IS64BIT
ENUMKEYS --> IS64BIT
GETVALUE --> IS64BIT
IS64BIT -->|"Always"| GETHIVEKEY
IS64BIT -->|"If 64-bit"| GETWOW64
GETHIVEKEY --> NATIVE64
GETWOW64 --> WOW6432
NATIVE64 --> REGAPI
WOW6432 --> REGAPI
REGAPI -->|"Results merged"| KEYEXISTS
REGAPI -->|"Both views"| DELETEKEY
Sources: OfficeScrubC2R-Native.cs:334-616
When files cannot be deleted immediately (due to locks), the system schedules deletion on reboot using this registry key:
| Registry Path | Hive | Value Name | Type |
|---|---|---|---|
SYSTEM\CurrentControlSet\Control\Session Manager |
HKLM | PendingFileRenameOperations |
REG_MULTI_SZ |
The value contains paired entries:
- Source path (prefixed with
\??\) - Empty string (indicating deletion rather than move)
Implementation: OfficeScrubC2R-Native.cs:595-615
| Registry Path | Hive | Value Name | Purpose |
|---|---|---|---|
SYSTEM\CurrentControlSet\Control\Session Manager |
HKLM | PendingFileRenameOperations |
Multistring list of files to delete/rename on next boot |
This is populated by FileHelper.ScheduleDeleteOnReboot() when files cannot be immediately deleted.
Sources: OfficeScrubC2R-Native.cs:595-615, OfficeScrubC2R-Native.cs:689-727
| Registry Path | Hive | CLSID | Office Version |
|---|---|---|---|
SOFTWARE\Classes\CLSID\{2027FC3B-CF9D-4ec7-A823-38BA308625CC} |
HKLM | Office 15 | Office 2013 |
SOFTWARE\Classes\CLSID\{F8E61EDD-EA25-484e-AC8A-7447F2AAE2A9} |
HKLM | Office 16 | Office 2016+ |
These keys register Office's MAPI search functionality with Windows and are removed during cleanup if no Office installations remain.
Sources: direct_conversion.cs:2059-2064
| Registry Path | Hive | Purpose |
|---|---|---|
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Microsoft Office Temp Files |
HKLM | Registers Office temp files for Disk Cleanup utility |
This entry is removed to prevent Disk Cleanup from attempting to clean non-existent Office temp files.
Sources: direct_conversion.cs:2385
| Hive | Abbreviation | Numeric Value | Primary Usage |
|---|---|---|---|
HKEY_CLASSES_ROOT |
HKCR | 0x80000000 | COM registrations, file associations |
HKEY_CURRENT_USER |
HKCU | 0x80000001 | User-specific settings |
HKEY_LOCAL_MACHINE |
HKLM | 0x80000002 | System-wide configuration |
HKEY_USERS |
HKU | 0x80000003 | All user profiles |
Sources: OfficeScrubC2R-Native.cs:21-27
| Constant | Value | Purpose |
|---|---|---|
KEY_WOW64_64KEY |
0x0100 | Access 64-bit registry view |
KEY_WOW64_32KEY |
0x0200 | Access 32-bit registry view |
KEY_READ |
0x20019 | Read access rights |
KEY_WRITE |
0x20006 | Write access rights |
KEY_ALL_ACCESS |
0xF003F | Full access rights |
Sources: OfficeScrubC2R-Native.cs:145-149
The cleanup operations follow this sequence:
- Detection Phase: Enumerate Office products from C2R configuration keys and ARP
- Shell Integration: Clear shell extension registrations to release file locks
- AppV Keys: Remove App-V integration registry values
- C2R Configuration: Delete ClickToRun configuration keys
- Windows Installer Metadata: Clean upgrade codes, products, components
- Run Keys: Remove startup entries
- ARP Entries: Delete remaining Add/Remove Programs registrations
- TypeLib Cleanup: Remove orphaned COM TypeLib registrations
- WOW64 Views: Repeat operations in 32-bit view on 64-bit systems
This sequence ensures proper cleanup order, addressing dependencies and minimizing the need for system reboots.
Sources: OfficeScrubC2R-Native.cs:1313-1383, direct_conversion.cs:2024-2531