Windows Dev Center

GetExpandedStringValue method of the StdRegProv class

The GetExpandedStringValue method returns the data value for a named value whose data type is REG_EXPAND_SZ.

This topic uses Managed Object Format (MOF) syntax. For more information about using this method, see Calling a Method.


uint32 GetExpandedStringValue(
  [in]  uint32 hDefKey = HKEY_LOCAL_MACHINE,
  [in]  string sSubKeyName,
  [in]  string sValueName,
  [out] string sValue


hDefKey [in]

A registry tree, also known as a hive, that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE.

The following trees are defined in WinReg.h.

HKEY_CLASSES_ROOT (2147483648)
HKEY_CURRENT_USER (2147483649)
HKEY_USERS (2147483651)
sSubKeyName [in]

[in] A path that contains the named values.

sValueName [in]

[in] A named value whose data value you are retrieving. Specify an empty string to get the default named value.

sValue [out]

[out] An expanded string data value for the named value. The string is only expanded if the environment variable (for example, %Path%) is defined.


Registry values of the expanded string type are strings that include items that are evaluated only when the string value is actually used. For instance, a typical expanded string value is the one that holds the location of the TEMP directory:

%USERPROFILE%\Local Settings\Temp

The \Local Settings\Temp component of the string is treated literally, but the value of the %USERPROFILE% component can be determined only when it is actually accessed. This is because the value is dependent upon the user accessing the entry. If you look at the registry entry in Regedit.exe, you will see the value %USERPROFILE%\Local Settings\Temp. However, when you retrieve the value of the entry, the value will be something like this: C:\Documents and Settings\jsmith.REDMOND\Local Settings\Temp. In other words, the environment variable %USERPROFILE% is replaced with the folder (in this case, jsmith.REDMOND) that contains the user profile.

The components of expanded string types that appear between percent symbols (%) correspond to environment variables and are dependent either on the aspects of the particular user or the current configuration of the computer.

You use the GetExpandedStringValue method to retrieve expanded string values. The method takes, as one of its parameters, a variable in which the retrieved value is stored. In the retrieved value, the components of the string that appear between percent symbols are automatically evaluated. This means your script will echo a value similar to C:\Documents and Settings\jsmith.REDMOND\Local Settings\Temp rather than a value like %USERPROFILE%\Local Settings\Temp.


The Add a Folder to Your Windows Path VBScript sample adds a new folder to your Windows path.

The Collect userprofile, recycle bin and selective folder size for remote servers PowerShell sample generates a report for all user profiles, user specified folders, and user recycle bin that are more than a specified size.

The following VBScript code example shows how to read the REG_EXPAND_SZ value that is located in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon. You can save the script as a file with a .vbs extension and send the output to a file by executing the command line in the folder that contains the script:

cscript Filename.vbs > output.txt

const HKEY_LOCAL_MACHINE = &H80000002
strComputer = "."
Set objReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\"&_
    strComputer & "\root\default:StdRegProv")
strKeyPath = "SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon"
strValueName = "UIHost"
Return = objReg.GetExpandedStringValue(HKEY_LOCAL_MACHINE,_
If (Return = 0) And (Err.Number = 0) Then   
    WScript.Echo  "The Windows logon UI host is: " & strValue
    Wscript.Echo _
        "GetExpandedStringValue failed. Error = " & Err.Number
End If


Minimum supported client

Windows Vista

Minimum supported server

Windows Server 2003









© 2015 Microsoft