Skip to content

Registry Paths

Calvindd2f edited this page Jan 14, 2026 · 1 revision

Registry Paths

Relevant source files

The following files were used as context for generating this wiki page:

This reference page documents all Windows Registry locations accessed by OfficeScrubC2R during Office Click-to-Run detection and cleanup operations. These registry paths are organized by functional category and include both native 64-bit and WOW64 32-bit views where applicable.

For information about the registry operations and WOW64 handling implementation, see WOW64 Registry Handling. For details on the helper classes that access these paths, see RegistryHelper.


Office Click-to-Run Detection Paths

The following registry paths are used to detect installed Office Click-to-Run products and their configuration.

Office 15.0 (Office 2013)

Registry Path Hive Purpose Referenced In
SOFTWARE\Microsoft\Office\15.0\ClickToRun HKLM Main C2R configuration for Office 2013 Detection, cleanup
SOFTWARE\Microsoft\Office\15.0\ClickToRun\PackageFolder HKLM Package installation directory Package location
SOFTWARE\Microsoft\Office\15.0\ClickToRun\PackageGUID HKLM Package identifier Uninstall operations
SOFTWARE\Microsoft\Office\15.0\ClickToRun\Configuration HKLM Product release IDs Product detection
SOFTWARE\Microsoft\Office\15.0\ClickToRun\ProductReleaseIDs\Active\culture HKLM Active product cultures and versions Version detection
SOFTWARE\Microsoft\Office\15.0\ClickToRun\propertyBag HKLM Additional configuration properties Configuration data
SOFTWARE\Microsoft\Office\15.0\Registration HKCU User-specific registration data Cleanup target
SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot\Virtual HKLM Virtual installation root Cleanup target

Office 16.0 (Office 2016/2019)

Registry Path Hive Purpose Referenced In
SOFTWARE\Microsoft\Office\16.0\ClickToRun HKLM Main C2R configuration for Office 2016+ Detection, cleanup
SOFTWARE\Microsoft\Office\16.0\ClickToRun\PackageFolder HKLM Package installation directory Package location
SOFTWARE\Microsoft\Office\16.0\ClickToRun\PackageGUID HKLM Package identifier Uninstall operations
SOFTWARE\Microsoft\Office\16.0\ClickToRun\Configuration HKLM Product release IDs Product detection
SOFTWARE\Microsoft\Office\16.0\ClickToRun\ProductReleaseIDs\Active\culture HKLM Active product cultures and versions Version detection
SOFTWARE\Microsoft\Office\16.0\Registration HKCU User-specific registration data Cleanup target
SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot\Virtual HKLM Virtual installation root Cleanup target

Office ClickToRun (Version-agnostic paths for Office 365/QR8+)

Registry Path Hive Purpose Referenced In
SOFTWARE\Microsoft\Office\ClickToRun HKLM Main C2R configuration for Office 365 Detection, cleanup
SOFTWARE\Microsoft\Office\ClickToRun\PackageFolder HKLM Package installation directory Package location
SOFTWARE\Microsoft\Office\ClickToRun\PackageGUID HKLM Package identifier Uninstall operations
SOFTWARE\Microsoft\Office\ClickToRun\Configuration HKLM Product configuration Product detection
SOFTWARE\Microsoft\Office\ClickToRun\ProductReleaseIDs HKLM Product release identifiers root Product enumeration
SOFTWARE\Microsoft\Office\ClickToRun\ProductReleaseIDs\ActiveConfiguration HKLM Current active configuration name Configuration selection
SOFTWARE\Microsoft\Office\ClickToRun\ProductReleaseIDs\<config>\culture HKLM Culture-specific product data Version and culture info

Sources: OfficeScrubC2R-Native.cs:1313-1383, direct_conversion.cs:881-993


Registry Path Discovery Flow

This diagram shows how the OfficeScrubOrchestrator coordinates registry detection through the RegistryHelper class.

graph TB
    subgraph "PowerShell Layer"
        PSM["OfficeScrubC2R.psm1<br/>FindInstalledOProducts"]
    end
    
    subgraph "Native Layer - Detection Logic"
        ORCH["OfficeScrubOrchestrator"]
        REGHELP["RegistryHelper<br/>GetValue, EnumerateKeys"]
    end
    
    subgraph "Registry Paths - Office Detection"
        O15_C2R["HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun"]
        O16_C2R["HKLM\SOFTWARE\Microsoft\Office\16.0\ClickToRun"]
        O_C2R["HKLM\SOFTWARE\Microsoft\Office\ClickToRun"]
        O15_PROD["HKLM\...\15.0\ClickToRun\ProductReleaseIDs"]
        O16_PROD["HKLM\...\16.0\ClickToRun\ProductReleaseIDs"]
        O_PROD["HKLM\...\ClickToRun\ProductReleaseIDs"]
    end
    
    subgraph "ARP Detection"
        ARP["HKLM\SOFTWARE\Microsoft\Windows\<br/>CurrentVersion\Uninstall"]
    end
    
    PSM --> ORCH
    ORCH --> REGHELP
    
    REGHELP --> O15_C2R
    REGHELP --> O16_C2R
    REGHELP --> O_C2R
    REGHELP --> O15_PROD
    REGHELP --> O16_PROD
    REGHELP --> O_PROD
    REGHELP --> ARP
    
    O15_C2R -.PackageFolder.-> O15_PROD
    O16_C2R -.PackageFolder.-> O16_PROD
    O_C2R -.PackageFolder.-> O_PROD
Loading

Sources: OfficeScrubC2R-Native.cs:334-616, direct_conversion.cs:872-1195


Windows Installer Metadata Paths

Windows Installer stores product and component metadata using compressed GUIDs as registry key names. The system cleans these paths to remove Office-related entries.

Product Metadata

Registry Path Hive GUID Format Purpose
SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes HKLM Compressed (32 chars) Upgrade code mappings
Installer\UpgradeCodes HKCR Compressed (32 chars) Per-user upgrade codes
SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products HKLM Compressed (32 chars) System product installations
Installer\Products HKCR Compressed (32 chars) Published products
Installer\Features HKCR Compressed (32 chars) Feature installation data

Component Metadata

Registry Path Hive GUID Format Purpose
SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components HKLM Compressed (32 chars) System component registrations
Installer\Components HKCR Compressed (32 chars) Published components with encoded GUIDs

Note: Published Components use Base85-encoded GUIDs (20 characters) as value data within the registry keys.

Sources: OfficeScrubC2R-Native.cs:979-1094, direct_conversion.cs:2024-2323


Windows Installer Cleanup Operations

This diagram illustrates the GUID transformation and Windows Installer metadata cleanup process.

graph LR
    subgraph "WindowsInstallerHelper Methods"
        CLEANUP_UC["CleanupUpgradeCodes()"]
        CLEANUP_P["CleanupProducts()"]
        CLEANUP_C["CleanupComponents()"]
        CLEANUP_PC["CleanupPublishedComponents()"]
    end
    
    subgraph "GuidHelper Transformations"
        GET_EXP["GetExpandedGuid()<br/>32-char → 38-char"]
        GET_DEC["GetDecodedGuid()<br/>20-char Base85 → 38-char"]
    end
    
    subgraph "Registry Paths - WI Metadata"
        UC_PATH["HKLM\SOFTWARE\...\Installer\UpgradeCodes\<br/>[32-char compressed GUID keys]"]
        PROD_PATH["HKLM\...\UserData\S-1-5-18\Products\<br/>[32-char compressed GUID keys]"]
        COMP_PATH["HKLM\...\UserData\S-1-5-18\Components\<br/>[32-char keys with 32-char values]"]
        PUB_PATH["HKCR\Installer\Components\<br/>[32-char keys with 20-char encoded values]"]
    end
    
    subgraph "Scope Check"
        INSCOPE["OfficeScrubOrchestrator<br/>IsInScope(guid)"]
    end
    
    CLEANUP_UC --> UC_PATH
    CLEANUP_P --> PROD_PATH
    CLEANUP_C --> COMP_PATH
    CLEANUP_PC --> PUB_PATH
    
    UC_PATH --> GET_EXP
    PROD_PATH --> GET_EXP
    COMP_PATH --> GET_EXP
    PUB_PATH --> GET_DEC
    
    GET_EXP --> INSCOPE
    GET_DEC --> INSCOPE
    
    INSCOPE -->|"True"| DELETE["RegistryHelper.DeleteKey()<br/>or DeleteValue()"]
Loading

Sources: OfficeScrubC2R-Native.cs:979-1094, OfficeScrubC2R-Native.cs:172-328


Shell Integration Paths

Shell integration registry paths control Windows Explorer context menus, icon overlays, and browser extensions. These are cleaned to remove Office shell hooks.

Protocol Handlers

Registry Path Hive Purpose
SOFTWARE\Classes\Protocols\Handler\osf HKLM Office Shared Facilities protocol handler

Context Menu Handlers

Registry Path Hive CLSID Component
SOFTWARE\Classes\CLSID\{573FFD05-2805-47C2-BCE0-5F19512BEB8D} HKLM SharePoint context menu Document management
SOFTWARE\Classes\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7} HKLM Office context menu General Office integration
SOFTWARE\Classes\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE} HKLM Office context menu File operations
SOFTWARE\Classes\CLSID\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} HKLM SharePoint context menu SharePoint integration
SOFTWARE\Classes\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1} HKLM Office context menu Additional operations

Shell Icon Overlay Identifiers

Registry Path Hive Purpose
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Microsoft SPFS Icon Overlay 1 (ErrorConflict) HKLM Error/conflict indicator
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Microsoft SPFS Icon Overlay 2 (SyncInProgress) HKLM Sync progress indicator
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Microsoft SPFS Icon Overlay 3 (InSync) HKLM In-sync indicator

Browser Helper Objects (BHO)

Registry Path Hive CLSID Purpose
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} HKLM Office BHO Office web integration
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} HKLM Groove BHO Groove/OneDrive integration
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} HKLM SharePoint BHO SharePoint integration

Namespace Extensions

Registry Path Hive Purpose
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7} HKLM OneNote desktop integration
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\Namespace\{B28AA736-876B-46DA-B3A8-84C5E30BA492} HKLM SharePoint sites
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\NetworkNeighborhood\Namespace\{46137B78-0EC3-426D-8B89-FF7C3A458B5E} HKLM Network neighborhood integration

Approved Shell Extensions

Registry Path Hive Purpose
SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved HKLM Registry values list approved shell extensions by CLSID

Sources: direct_conversion.cs:2331-2396


Startup and Run Keys

Run keys configure applications to launch at system startup or user login.

Registry Path Hive Purpose Typical Values
SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKLM System-wide startup programs ClickToRun service monitors
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Lync15 HKLM Skype for Business 2013 startup Removed during cleanup
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Lync16 HKLM Skype for Business 2016 startup Removed during cleanup

The system removes Run key values that contain C2R-specific paths or are explicitly named for Office components.

Sources: direct_conversion.cs:2088-2102


Add/Remove Programs (ARP) Paths

ARP entries register installed applications in the Windows control panel.

Registry Path Hive Purpose
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall HKLM Main ARP registration root
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\<ProductGUID> HKLM Individual product entries

ARP Entry Detection

The system identifies Office C2R products in ARP by examining:

  • UninstallString value containing "MICROSOFT OFFICE 1" or "OFFICECLICKTORUN.EXE"
  • DisplayVersion value for version identification
  • DisplayName value for product name
  • SystemComponent DWORD value (should be 0 or absent for visible entries)

Sources: OfficeScrubC2R-Native.cs:41, direct_conversion.cs:41-42, 1039-1195


TypeLib Registration Paths

COM TypeLib registrations link type library GUIDs to physical DLL/TLB files on disk.

TypeLib Root Path

Registry Path Hive Structure
Software\Classes\TypeLib\{GUID} HKLM Root for each TypeLib GUID
Software\Classes\TypeLib\{GUID}\{Version} HKLM Version-specific registration
Software\Classes\TypeLib\{GUID}\{Version}\0\Win32 HKLM 32-bit default locale file path
Software\Classes\TypeLib\{GUID}\{Version}\0\Win64 HKLM 64-bit default locale file path
Software\Classes\TypeLib\{GUID}\{Version}\9\Win32 HKLM 32-bit neutral locale file path
Software\Classes\TypeLib\{GUID}\{Version}\9\Win64 HKLM 64-bit neutral locale file path

Known Office TypeLib GUIDs

The TypeLibHelper class maintains a list of 80+ known Office TypeLib GUIDs for cleanup. Key examples include:

TypeLib GUID Component
{000204EF-0000-0000-C000-000000000046} Microsoft Office Core
{00020813-0000-0000-C000-000000000046} Excel Type Library
{00020905-0000-0000-C000-000000000046} Word Type Library
{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} Office Shared
{91493440-5A91-11CF-8700-00AA0060263B} PowerPoint Type Library
{EDCD5812-6A06-43C3-AFAC-46EF5D14E22C} Office Common

The cleanup process validates that registered DLL/TLB files still exist before removing TypeLib entries.

Sources: OfficeScrubC2R-Native.cs:1099-1176, direct_conversion.cs:2404-2531


AppV (App-V) Registry Paths

App-V integration paths store Click-to-Run virtualization metadata.

Registry Path Hive Purpose
SOFTWARE\Microsoft\AppV\ISV HKCU User-specific App-V integration
SOFTWARE\Microsoft\AppV\ISV HKLM System-wide App-V integration
SOFTWARE\Microsoft\AppVISV HKCU Alternative App-V path (legacy)
SOFTWARE\Microsoft\AppVISV HKLM Alternative App-V path (legacy)

The system enumerates all values under these keys and removes those that match C2R installation patterns.

Sources: direct_conversion.cs:1638-1671


WOW64 Registry Path Transformation

On 64-bit systems, the RegistryHelper class automatically accesses both the native 64-bit and WOW64 32-bit registry views. The transformation is handled by the GetWow64Key() method.

Transformation Rules

Original Path WOW64 Transformed Path
Software\Microsoft\Office Software\Wow6432Node\Microsoft\Office
Software\Classes\TypeLib\{GUID} Software\Classes\Wow6432Node\TypeLib\{GUID}
SOFTWARE\Microsoft\Windows\CurrentVersion\Run SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run

Special Case: Classes

Paths beginning with Software\Classes\ receive special handling where Wow6432Node is inserted after Classes\:

Software\Classes\CLSID\{GUID}
→ Software\Classes\Wow6432Node\CLSID\{GUID}

Implementation: OfficeScrubC2R-Native.cs:583-593


RegistryHelper Class Operations

This diagram shows the dual-path registry access pattern for WOW64 support.

graph TB
    subgraph "RegistryHelper Public Methods"
        KEYEXISTS["KeyExists(hive, subKey)"]
        DELETEKEY["DeleteKey(hive, subKey)"]
        DELETEVALUE["DeleteValue(hive, subKey, valueName)"]
        ENUMKEYS["EnumerateKeys(hive, subKey)"]
        GETVALUE["GetValue(hive, subKey, valueName)"]
    end
    
    subgraph "Internal Path Resolution"
        GETHIVEKEY["GetHiveKey(hive)<br/>→ Registry.LocalMachine, etc"]
        GETWOW64["GetWow64Key(subKey)<br/>→ Insert Wow6432Node"]
        IS64BIT["_is64Bit flag<br/>determines dual-path access"]
    end
    
    subgraph "Native Registry Access"
        NATIVE64["Native 64-bit View<br/>Software\Microsoft\Office"]
        WOW6432["WOW64 32-bit View<br/>Software\Wow6432Node\Microsoft\Office"]
    end
    
    subgraph "Registry.NET API"
        REGAPI["Microsoft.Win32.Registry<br/>OpenSubKey, DeleteSubKey, etc"]
    end
    
    KEYEXISTS --> IS64BIT
    DELETEKEY --> IS64BIT
    DELETEVALUE --> IS64BIT
    ENUMKEYS --> IS64BIT
    GETVALUE --> IS64BIT
    
    IS64BIT -->|"Always"| GETHIVEKEY
    IS64BIT -->|"If 64-bit"| GETWOW64
    
    GETHIVEKEY --> NATIVE64
    GETWOW64 --> WOW6432
    
    NATIVE64 --> REGAPI
    WOW6432 --> REGAPI
    
    REGAPI -->|"Results merged"| KEYEXISTS
    REGAPI -->|"Both views"| DELETEKEY
Loading

Sources: OfficeScrubC2R-Native.cs:334-616


PendingFileRenameOperations Registry Key

When files cannot be deleted immediately (due to locks), the system schedules deletion on reboot using this registry key:

Registry Path Hive Value Name Type
SYSTEM\CurrentControlSet\Control\Session Manager HKLM PendingFileRenameOperations REG_MULTI_SZ

The value contains paired entries:

  1. Source path (prefixed with \??\)
  2. Empty string (indicating deletion rather than move)

Implementation: OfficeScrubC2R-Native.cs:595-615


Session Manager and Reboot Scheduling

Registry Path Hive Value Name Purpose
SYSTEM\CurrentControlSet\Control\Session Manager HKLM PendingFileRenameOperations Multistring list of files to delete/rename on next boot

This is populated by FileHelper.ScheduleDeleteOnReboot() when files cannot be immediately deleted.

Sources: OfficeScrubC2R-Native.cs:595-615, OfficeScrubC2R-Native.cs:689-727


Office-Specific MAPI Search Registration

Registry Path Hive CLSID Office Version
SOFTWARE\Classes\CLSID\{2027FC3B-CF9D-4ec7-A823-38BA308625CC} HKLM Office 15 Office 2013
SOFTWARE\Classes\CLSID\{F8E61EDD-EA25-484e-AC8A-7447F2AAE2A9} HKLM Office 16 Office 2016+

These keys register Office's MAPI search functionality with Windows and are removed during cleanup if no Office installations remain.

Sources: direct_conversion.cs:2059-2064


Volume Cache Registration

Registry Path Hive Purpose
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Microsoft Office Temp Files HKLM Registers Office temp files for Disk Cleanup utility

This entry is removed to prevent Disk Cleanup from attempting to clean non-existent Office temp files.

Sources: direct_conversion.cs:2385


Summary Tables

Registry Hives Used

Hive Abbreviation Numeric Value Primary Usage
HKEY_CLASSES_ROOT HKCR 0x80000000 COM registrations, file associations
HKEY_CURRENT_USER HKCU 0x80000001 User-specific settings
HKEY_LOCAL_MACHINE HKLM 0x80000002 System-wide configuration
HKEY_USERS HKU 0x80000003 All user profiles

Sources: OfficeScrubC2R-Native.cs:21-27

Registry Operation Constants

Constant Value Purpose
KEY_WOW64_64KEY 0x0100 Access 64-bit registry view
KEY_WOW64_32KEY 0x0200 Access 32-bit registry view
KEY_READ 0x20019 Read access rights
KEY_WRITE 0x20006 Write access rights
KEY_ALL_ACCESS 0xF003F Full access rights

Sources: OfficeScrubC2R-Native.cs:145-149


Registry Cleanup Sequence

The cleanup operations follow this sequence:

  1. Detection Phase: Enumerate Office products from C2R configuration keys and ARP
  2. Shell Integration: Clear shell extension registrations to release file locks
  3. AppV Keys: Remove App-V integration registry values
  4. C2R Configuration: Delete ClickToRun configuration keys
  5. Windows Installer Metadata: Clean upgrade codes, products, components
  6. Run Keys: Remove startup entries
  7. ARP Entries: Delete remaining Add/Remove Programs registrations
  8. TypeLib Cleanup: Remove orphaned COM TypeLib registrations
  9. WOW64 Views: Repeat operations in 32-bit view on 64-bit systems

This sequence ensures proper cleanup order, addressing dependencies and minimizing the need for system reboots.

Sources: OfficeScrubC2R-Native.cs:1313-1383, direct_conversion.cs:2024-2531

Clone this wiki locally