Remove registry references to PST files (O2K, OXP, O2K3)

[Oloff]

Before I dive into my issue, let me give the necessary background info.
Machines are running either Windows 2000 SP4, Windows XP, or Windows XP SP1
in a Windows 2003 domain. The majority of users are on Office 2000. A
decent amount of users are on Office 2003. A small chunk of users are on
Office XP. All Office users are configured for corporate e-mail (exchange).

Here is the big picture: I need to remove all profile pointers to PST
files. I do NOT need to remove the PST files themselves. It needs to run
quickly, without user interaction, and be implemented via a Group Policy
logon script.

Assumptions: Outlook will not be open at the time the script is executed.

Here is what I have working code for thus far:
Get the default profile.
(HKCU\Software\Microsoft\WIndows NT\CurrentVersion\Windows Messaging
Subsystem\Profiles\DefaultProfile)
Scan all keys beneath the default profile looking for REG_SZ entries
containing the text "Personal Folders". Delete any key that contains such a
reference.

On Office 2000, this works great. PST references are gone with no errors.

Office XP & Office 2003 run without any errors EXCEPT when doing the
following. Right-click "Microsoft Outlook" on the desktop->Click
"properties"->Click "data files..." and then the error hits: "There was an
error locating one of the items needed to complete this operation. It might
have been deleted."

Using some registry snapshot tools I have narrowed down the culprit(s) to
the following key/values (again, we are still under the default outlook
profile in HKCU):
key: 9207f3e0a3b11019908b08002b2a56c2
value: 01023d00 (binary_value)
value: 01023d0e (binary_value)

It appears that whenever a pst file is added, a binary reference is also
added to those two values. This is consistent for all the versions of Office
I am testing with. For whatever reason, Outlook 2000 doesn't mind a bogus
reference being left in those values, but Office XP and Office 2003 do (see
error above).

I have tried deleting the values but that semi-corrupts the Outlook profile
causing weird problems. So, long story short, how can I remove the stinking
PST references from those two values??? I have never dealt with processing
binary values and have hit a wall.

I feel I am 95% of the way home and could really use a gentle nudge to get
the rest of the way.

Thanks!

P.S. I haven't mentioned a specific programming/scripting language because
I'm not having problems with my existing code. I simply need help chopping
down those two binary values. If you choose to post code I would prefer
vbscript or perl. I also know this is a VBA newsgroup but I figured since
my question is Outlook-specific this was the best place.

 

[Jim Vierra]

Outlook 2002/2003 make mutliple registry changes to remove a PST.

Here is the trace of the registry session for a remove of a PST. As you can see two keys are deleted and 5 have values adjusted.

If you use regmon from Sysinternals.com you can trace this. I would suggest using some other method to remove PST files in batch such as a VBA startup script or an add-in. Maybe someone has decoded this sequence of events and has published it but I haven't found it anywhere yet.

I tried to track the create PST process on teh registry but it produces hundreds of reg accesses and would take quite a while to decompose.
Registry Trace:
1 11.46956303 OUTLOOK.EXE:824 SetValue HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2\01023d01 SUCCESS BF 8A FE B1 90 E0 F0 42 ...
2 11.47171302 OUTLOOK.EXE:824 SetValue HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2\01023d00 SUCCESS 6C 8B EE A3 E0 35 E0 43 ...
3 11.47196501 OUTLOOK.EXE:824 SetValue HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2\01023d02 SUCCESS
4 11.47295452 OUTLOOK.EXE:824 SetValue HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2\01023d0e SUCCESS E4 40 32 8C 79 35 D0 44 ...
5 11.47833621 OUTLOOK.EXE:824 DeleteKey HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9bd48b1fbbe3e34eb0f6c0b0e6130925 SUCCESS Key: 0xE1434450
6 11.47996798 OUTLOOK.EXE:824 DeleteKey HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\c9283aa8aafc1d4bb0095ceb5bb05600 SUCCESS Key: 0xE1434450
7 11.53970882 OUTLOOK.EXE:824 SetValue HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046\0003040d SUCCESS 9D 00 00 00

 

[Oloff]

Thanks for the quick reply Jim. I have a few thoughts on the registry
comments you posted and a couple questions about VBA.

First, I understand that creating/removing a PST might access many registry
keys/values, but the snapshot software I was using only records things that
have ultimately changed. Items that actually change seem to be very few.

For example, creating one PST file (from Outlook XP) only created the
following keys:

HKCU\Software\Microsoft\Office\10.0\Common\Open Find\Microsoft
Outlook\Settings\Create or Open Outlook Data File\File Name MRU
(Probably safe to ignore this, MRU items are usually just file name histories)

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging
Subsystem\Profiles\Outlook:

30a653e28d432e48a7428da250f9ce3f
ad29571640acd3419340dd6f0a503ad8
(These are the two keys--randomly named--associated with the PST file. They
both have a 001e3001 REG_SZ with a value of "Personal Folders")

9207f3e0a3b11019908b08002b2a56c2
(This is the key common across Outlook 2000, XP, 2003 and has only two
values that get changed when creating a PST: 01023d00 and 01023d0e)

So again, while many keys may get touched, very few actually change. I'm
sure if I could find out how to reveal/remove the PST hooks from those two
binary values, everything would work fine.

Now onto my VBA questions (and I am a VBA newbie).

1) I thought VBA programs could only from inside an application (Outlook,
Word, Excel, etc.). If I did take the time to figure out VBA/MAPI could it
be executed from a Group Policy script without any interaction from the user?
(a web link to an example would be great if you know one)
2) Would a user's macro settings effect whether a VBA script ran or not?

Thanks!

 

[Oloff]

I think I may have found the push I needed:

http://www.fabalou.com/Outlook/GetPSTFileNames.asp

Each part of the 01023d00 binary value is a 16 byte chunk!!! His code is
actually doing something quite different than what I am doing, but his
handling of the binary value might be enough to get me over the wall I hit.

 

[Jim Vierra]

Be interested in knowing if it still works for 2000/2003 as it is old code
(ancient 95). Hopefully this is the root key and hasn't been changed since
95 version. Post back an let me know if you are successful.