Some registry leftovers after components removed

[garson]

Hi nuhi
Just wanted to report registry leftovers after some components were removed. I wouldn't mind this at all, but this can be seen in MMC.



So these 3 are:
{57C596D0-9370-40C0-BA0D-AB491B63255D} - ip security monitor
{DEA8AFA0-CC85-11D0-9CE2-0080C7221EBD} - ip security policy management
{7478EF61-8C46-11d1-8D99-00A0C913CAD4} - performance monitor

Not sure which exact component removes first 2, third is Performance Monitor. I looked a bit into registry and seems that these should be good to remove:
[HKEY_CLASSES_ROOT\CLSID\{57C596D0-9370-40C0-BA0D-AB491B63255D}]
[HKEY_CLASSES_ROOT\CLSID\{DEA8AFA0-CC85-11D0-9CE2-0080C7221EBD}]
[HKEY_CLASSES_ROOT\CLSID\{7478EF61-8C46-11d1-8D99-00A0C913CAD4}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MMC\SnapIns\{7478EF61-8C46-11d1-8D99-00A0C913CAD4}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MMC\SnapIns\{57C596D0-9370-40C0-BA0D-AB491B63255D]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MMC\SnapIns\{DEA8AFA0-CC85-11d0-9CE2-0080C7221EBD}]
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\MMC\SnapIns\{7478EF61-8C46-11d1-8D99-00A0C913CAD4}]
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\MMC\SnapIns\{57C596D0-9370-40C0-BA0D-AB491B63255D}]
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\MMC\SnapIns\{DEA8AFA0-CC85-11d0-9CE2-0080C7221EBD}]

In MMC section of Components in NTLite you can remove some, but not 3 mentioned above. So, for me it would make sense, if you remove for example Performance Monitor, it should remove its MMC snap-in as well.

For some components you can separately remove their MMC snap-in. But this can lead to unexpected results, for example, if you remove 'Certificate Tools', and you don't remove 'Certificate Manager' and 'Certificate Manager - 32 bit' you will get something like this:



Probably 'Certificate Tools' should have 'Certificate Manager' and 'Certificate Manager - 32 bit' as dependencies that should be removed as well?

 

[garlin]

{57C596D0-9370-40C0-BA0D-AB491B63255D}, {DEA8AFA0-CC85-11D0-9CE2-0080C7221EBD} -> domainclientssvc 'IPsec Policy Agent'

 

[garson]

Thanks garlin

 

[garlin]

I can't decode delta-compressed Manifest files, so the W7 versions will have to do.

Those Policy Agent reg keys are created by package amd64_microsoft-windows-n..rity-domain-clients. Even if you made this right, W10 CU includes an updated version of this package. Which means it will likely re-install everything.

 

[garson]

Thanks again garlin
Would the same happen for the removed MMC Certificates snap-in? Would it return after you install W10 CU?

 

[garlin]

certmgr.msc is part of:

amd64_microsoft-windows-c..atemanagersnapindll
amd64_microsoft-windows-c..snapindll.resources

W10 CU does update the DLL, but not the MSC file. I'm assuming as a delta update (meaning it's only diff's, not a complete package), it will not change any registry values. With CU, it's probably a matter of luck whether your previous removal gets undone or not. You'd have to perform host refresh after installing CU to make sure your changes stay.

Here's how I figured things out:

1. Download KB5008212
2. expand -f:*.* windows10.0-kb5008212-x64_...msu .
3. 7-zip the MSU, continue extracting each nesting CAB until we reach Cab_2_for_KB5008212_PSFX
4. Look inside for matching component folders (or known filenames)

 

[garson]

nuhi Any thoughts on this subject?