NtDeleteKey - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
#ifndef _NTREGAPI_H
/**
* Deletes an opened registry key, not merely a value and not a recursive subtree. Remove subkeys from the
* leaves upward before deleting their parent.
*
* \param[in] KeyHandle Handle with DELETE (0x10000) access on the ordinary path. The handle remains
* caller-owned and must still be closed with NtClose, even after a successful deletion. Other open handles to
* the same key must also close.
* \return STATUS_SUCCESS, STATUS_ACCESS_DENIED, STATUS_INVALID_HANDLE, STATUS_CANNOT_DELETE or another
* registry error. In the ordinary path, a key with a live subkey returns STATUS_CANNOT_DELETE; a leaf
* containing values can be deleted without first deleting those values individually.
* \remarks Successful ordinary deletion removes the key from name lookup. Existing handles do not become
* usable handles to a replacement key: subsequent basic queries on them return STATUS_KEY_DELETED, yet
* NtClose remains required. Do not assume every operation on a deleted key has the same result, or that
* success implies a synchronous physical hive flush. Through an active transacted handle, deletion is staged:
* rollback preserves the original key and value; commit removes them. Registry filters, virtualization,
* read-only keys or hives, and protected special keys can affect deletion.
* \sa https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-zwdeletekey
*/
_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
NtDeleteKey(
_In_ HANDLE KeyHandle
);
View code on GitHub#ifndef _NTZWAPI_H
_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwDeleteKey(
_In_ HANDLE KeyHandle
);
View code on GitHub// wdm.h
NTSYSAPI NTSTATUS ZwDeleteKey(
[in] HANDLE KeyHandle
);
View the official Windows Driver Kit DDI referenceNo description available.
The ZwDeleteKey routine deletes an open key from the registry.
KeyHandle [in]Handle to the registry key to be deleted. The handle is created by a successful call to ZwCreateKey or ZwOpenKey.
ZwDeleteKey returns an NTSTATUS value. Possible return values include:
STATUS_ACCESS_DENIED
STATUS_INVALID_HANDLE
STATUS_CANNOT_DELETE (see Remarks)
Before calling ZwDeleteKey, ensure that all the keys and values under the given key have been deleted. Delete each subkey first, starting with the leaf keys and work your way up.
The handle must have been opened for DELETE access for this routine to succeed. For more information, see the DesiredAccess parameter for ZwCreateKey.
A call to ZwDeleteKey causes the handle that is specified in the KeyHandle parameter—and all other handles to the deleted key—to become invalid. After a call to ZwDeleteKey invalidates the key handles, you must call ZwClose to close the key handles.
For more information about working with registry keys, see Using the Registry in a Driver.
If the call to this function occurs in user mode, you should use the name "NtDeleteKey" instead of "ZwDeleteKey".
For calls from kernel-mode drivers, the NtXxx and ZwXxx versions of a Windows Native System Services routine can behave differently in the way that they handle and interpret input parameters. For more information about the relationship between the NtXxx and ZwXxx versions of a routine, see Using Nt and Zw Versions of the Native System Services Routines.
Using Nt and Zw Versions of the Native System Services Routines
This function is documented in Windows Driver Kit.
See ZwDeleteKey in NT DDK or 2000 DDK for detailed description.