{"id":67683,"date":"2006-03-24T08:16:00","date_gmt":"2006-03-24T08:16:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2006\/03\/24\/how-can-i-retrieve-a-list-of-the-commands-typed-into-the-run-dialog-box\/"},"modified":"2006-03-24T08:16:00","modified_gmt":"2006-03-24T08:16:00","slug":"how-can-i-retrieve-a-list-of-the-commands-typed-into-the-run-dialog-box","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/how-can-i-retrieve-a-list-of-the-commands-typed-into-the-run-dialog-box\/","title":{"rendered":"How Can I Retrieve a List of the Commands Typed Into the Run Dialog Box?"},"content":{"rendered":"

\"Hey, \n

Hey, Scripting Guy! Sometimes I type commands in the Run<\/B> dialog box that I\u2019d like to retrieve later on. I know the most recent commands I used are cached somewhere; that\u2019s because they show up when I start typing in the Run<\/B> dialog box. How can I use a script to retrieve these commands?

— KJ<\/P>\"Spacer\"\"Hey,\"Script<\/A> \n

Hey, KJ. You know, our first thought upon reading your question was this: why didn\u2019t we<\/I> think of that? Needless to say, the Scripting Guys have been using the Run<\/B> dialog box for years, and we, too are well aware that the most recent commands (the last 26, if you\u2019re scoring at home) are cached somewhere on the computer. And yet, it never occurred to us to write a script that could retrieve this list. How could we have overlooked something so obvious?<\/P>\n\n<\/THEAD>\n\n\n
\n

Note<\/B>. Actually, it\u2019s not all that surprising we overlooked something so obvious. For example, the Scripting Guys have been in their current building for about a year now, yet it was only a few weeks ago that the Scripting Guy who writes this column found out that there was a stairway just down the hall from his office.<\/P><\/TD><\/TR><\/TBODY><\/TABLE>\n

<\/DIV>\n

After poking around a bit we discovered that this information is stored in the registry; more specifically, it\u2019s stored as individual registry values within the registry key HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU. Is that good? You bet it is; after all, it allows us to write a script like this:<\/P>

Const HKEY_CURRENT_USER = &H80000001<\/p>\n
strComputer = “.”<\/p>\n
Set objRegistry = GetObject(“winmgmts:\\\\” & strComputer & “\\root\\default:StdRegProv”)<\/p>\n
strKeyPath = “Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU”\nobjRegistry.EnumValues HKEY_CURRENT_USER, strKeyPath, arrValueNames, arrValueTypes<\/p>\n
For Each strValue in arrValueNames\n    If Len(strValue) = 1 Then\n        objRegistry.GetStringValue HKEY_CURRENT_USER,strKeyPath,strValue,strRunCommand\n        intLength = Len(strRunCommand)\n        strRunCommand = Left(strRunCommand, intLength – 2)\n        Wscript.Echo strRunCommand\n    End If   \nNext\n<\/PRE>\n
This script connects to the RunMRU key and then enumerates the values of all the values found there. (And, yes, we know: values of values? Such is the joy of registry terminology.) To accomplish that feat, the script starts off by defining a constant named HKEY_CURRENT_USER and setting the value to &H80000001; this constant is used later on to tell the script which registry hive to work with. We then connect to the WMI service on the local computer, taking care to bind to the root\\default<\/B> namespace, home of the WMI registry provider.<\/P>\n\n<\/THEAD>\n\n\n
\n
Note<\/B>. Can we use this same script to retrieve the most-recently used commands from a remote computer? Of course we can; just assign the name of the remote computer to the variable strComputer.<\/P><\/TD><\/TR><\/TBODY><\/TABLE>\n
<\/DIV>\n
After connecting to the WMI service, we assign the value Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU to a variable named strKeyPath. We then use the EnumValues<\/B> method to grab a collection of all the registry values found in the RunMRU key:<\/P>
objRegistry.EnumValues HKEY_CURRENT_USER, strKeyPath, arrValueNames, arrValueTypes\n<\/PRE>\n
As you can see, we pass EnumValues four parameters:<\/P>\n\n<\/THEAD>\n\n\n\n\n\n\n
\n
Parameter<\/B><\/P><\/TD>\n
\n
Description<\/B><\/P><\/TD><\/TR>\n
\n
HKEY_CURRENT_USER<\/P><\/TD>\n
\n
The registry hive where the information can be found.<\/P><\/TD><\/TR>\n
\n
strKeyPath<\/P><\/TD>\n
\n
The path to the RunMRU key within the HKCU hive.<\/P><\/TD><\/TR>\n
\n
arrValueNames<\/P><\/TD>\n
\n
\u201cOut\u201d parameter that serves as place to store all the registry value names. All we do is supply EnumValues with a variable name; EnumValues will then populate this variable with all the value names found in RunMRU.<\/P><\/TD><\/TR>\n
\n
arrValueTypes<\/P><\/TD>\n
\n
Another out parameter, this one containing data types corresponding to each value found in RunMRU. This is a required parameter, but because the values found in RunMRU all have a data type of REG_SZ we don\u2019t actually use it in the script.<\/P><\/TD><\/TR><\/TBODY><\/TABLE>\n
<\/DIV>\n
As it turns out, each command typed into the Run dialog box is given its own value in the registry; these values are assigned names using the letters A through Z (which explains why only the 26 most-recently used commands are tracked in the registry). In the registry RunMRU looks something like this:<\/P>\"Hey, \n

After executing the EnumValues method we\u2019ll get back a collection of all these value names; in other words, our collection will consist of the letters A through Z. That\u2019s good, but what this collection doesn\u2019t <\/I>contain are any of the actual commands themselves. To get the commands (which is the whole idea in the first place) we need to connect to and read each of the 26 values in the registry.<\/P>\n
Can we do that, can we easily connect to and read each of the 26 values in the registry? Of course we can; in fact, that\u2019s what we do in this block of code:<\/P>
For Each strValue in arrValueNames\n    If Len(strValue) = 1 Then\n        objRegistry.GetStringValue HKEY_CURRENT_USER,strKeyPath,strValue,strRunCommand\n        intLength = Len(strRunCommand)\n        strRunCommand = Left(strRunCommand, intLength – 2)\n        Wscript.Echo strRunCommand\n    End If   \nNext\n<\/PRE>\n
You\u2019re right: at first glance that is<\/I> a little forbidding, isn\u2019t it? Tell you what, let\u2019s show you a simplified version of this For Each loop, then we\u2019ll explain why we added some additional code to the loop. Here\u2019s the simplified loop:<\/P>
For Each strValue in arrValueNames\n    objRegistry.GetStringValue HKEY_CURRENT_USER,strKeyPath,strValue,strRunCommand\n    Wscript.Echo strRunCommand\nNext\n<\/PRE>\n
What we\u2019re doing here is setting up a loop that runs through all of the registry values. To read each of those values we simply call the GetStringValue<\/B> method:<\/P>
objRegistry.GetStringValue HKEY_CURRENT_USER,strKeyPath,strValue,strRunCommand\n<\/PRE>\n
GetStringValue gets passed four parameters: the constant HKEY_CURRENT_USER; the variable strKeyPath; the variable strValue (which represents the individual value name, e.g., A, B, or C); and an out parameter named strRunCommand. With this out parameter we simply specify a variable name and the GetStringValue method assigns it the value of the registry value (that is, the appropriate Run command). After calling GetStringValue we echo back strRunCommand, loop around, and tackle the next value in the collection.<\/P>\n
So much for the simplified For Each loop; now what about all that extra code in our real<\/I> For Each loop? The extra code is there primarily to give us slightly-nicer output. For example, in the RunMRU key there\u2019s a registry value named MRUList<\/B>. This doesn\u2019t represent an actual command; instead, it represents the order in which the most recently-used commands are presented. That\u2019s not important to us (at least not today), so we\u2019d just as soon skip the MRUList value altogether. That\u2019s\u2019 what we do here:<\/P>
If Len(strValue) = 1 Then\n<\/PRE>\n
In this line of code we use the Len<\/B> function to check the number of characters in the value name. If the number of characters (length) is equal to 1 we go ahead and read the value. If the length is not<\/I> equal to 1 (which, obviously, is the case with MRUList, which has 7 characters) then we simply skip that value and move on to the next item in the collection.<\/P>\n
The other little touch we added was this:<\/P>
intLength = Len(strRunCommand)\nstrRunCommand = Left(strRunCommand, intLength – 2)\n<\/PRE>\n
If you look in the registry, you\u2019ll see that our commands all have a \\1<\/B> appended to the end. We could leave that if we wanted to, but it\u2019s easy enough to get rid of. All we do is determine the length of the command, then use the Left<\/B> function to return the first x<\/I> characters in the string. And what is x<\/I> equal to? It\u2019s equal to the total number of characters minus 2. That simply means we\u2019re going to grab all the characters except the last 2 (the \\1) and echo those to the screen.<\/P>\n
And there you have it: a script that returns the most-recently used commands typed into the Run<\/B> dialog box. We still haven\u2019t figured out where that mysterious stairway leads, but first things first.<\/P><\/p>\n","protected":false},"excerpt":{"rendered":"
Hey, Scripting Guy! Sometimes I type commands in the Run dialog box that I\u2019d like to retrieve later on. I know the most recent commands I used are cached somewhere; that\u2019s because they show up when I start typing in the Run dialog box. How can I use a script to retrieve these commands?— KJ […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[16,31,26,3,5,226],"class_list":["post-67683","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-desktop-management","tag-operating-system","tag-registry","tag-scripting-guy","tag-vbscript","tag-windows-explorer"],"acf":[],"blog_post_summary":"
Hey, Scripting Guy! Sometimes I type commands in the Run dialog box that I\u2019d like to retrieve later on. I know the most recent commands I used are cached somewhere; that\u2019s because they show up when I start typing in the Run dialog box. How can I use a script to retrieve these commands?— KJ […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/67683","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=67683"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/67683\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=67683"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=67683"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=67683"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}