NtDeleteValueKey - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers 
#ifndef _NTREGAPI_H

/**
 * Deletes a value from a registry key.
 *
 * \param[in] KeyHandle A handle to the key that contains the value to be deleted.
 * \param[in] ValueName A pointer to a UNICODE_STRING structure that specifies the name of the value to be deleted.
 * \return NTSTATUS Successful or errant status.
 */
NTSYSCALLAPI
NTSTATUS
NTAPI
NtDeleteValueKey(
    _In_ HANDLE KeyHandle,
    _In_ PCUNICODE_STRING ValueName
    );

#endif

View code on GitHub
#ifndef _NTZWAPI_H

NTSYSCALLAPI
NTSTATUS
NTAPI
ZwDeleteValueKey(
    _In_ HANDLE KeyHandle,
    _In_ PCUNICODE_STRING ValueName
    );

#endif

View code on GitHub
// wdm.h

NTSYSAPI NTSTATUS ZwDeleteValueKey(
  [in] HANDLE          KeyHandle,
  [in] PUNICODE_STRING ValueName
);
View the official Windows Driver Kit DDI reference

NtDoc

No description available.

Edit description on GitHub

Windows Driver Kit DDI reference (nf-wdm-zwdeletevaluekey)

ZwDeleteValueKey function

Description

The ZwDeleteValueKey routine deletes a value entry matching a name from an open key in the registry. If no such entry exists, an error is returned.

Parameters

KeyHandle [in]

The handle to the registry key containing the value entry of interest. This key must have been opened with KEY_SET_VALUE set for the desired access. This handle is created by a successful call to ZwCreateKey or ZwOpenKey.

ValueName [in]

Pointer to a UNICODE_STRING structure that contains the name of the value entry to delete. This parameter can be an empty string if the value entry has no name.

Return value

ZwDeleteValueKey returns STATUS_SUCCESS or an appropriate error status representing the final completion status of the operation. Possible error status codes include the following:

Return code Description
STATUS_ACCESS_DENIED The KeyHandle handle does not have the KEY_SET_VALUE access.
STATUS_INSUFFICIENT_RESOURCES Additional resources required by this function were not available.
STATUS_INVALID_HANDLE The specified KeyHandle parameter was a NULL pointer or not a valid pointer to an open registry key.
STATUS_OBJECT_NAME_NOT_FOUND The ValueName registry key entry was not found.

Remarks

The KeyHandle passed to ZwDeleteValueKey must have been opened for delete access to succeed. The DesiredAccess values of KEY_SET_VALUE, KEY_WRITE, and KEY_ALL_ACCESS include the KEY_SET_VALUE access mask required for delete access. For a description of possible values for DesiredAccess, see ZwCreateKey.

If callback functions are registered for this registry key, then these callback functions will be called.

Device drivers should not attempt to call ZwDeleteValueKey directly to delete value entries in a subkey of the \Registry..\ResourceMap key. Only the system can write or delete value entries in the \Registry..\HardwareDescription tree.

If the call to this function occurs in user mode, you should use the name "NtDeleteValueKey" instead of "ZwDeleteValueKey".

For calls from kernel-mode drivers, the Nt*Xxx* and Zw*Xxx* versions of a Windows Native System Services routine can behave differently in the way that they handle and interpret input parameters. For more information about the relationship between the Nt*Xxx* and Zw*Xxx* versions of a routine, see Using Nt and Zw Versions of the Native System Services Routines.

See also

Using Nt and Zw Versions of the Native System Services Routines

ZwCreateKey

ZwDeleteKey

ZwEnumerateValueKey

ZwOpenKey

ZwQueryValueKey

ZwSetValueKey

View the official Windows Driver Kit DDI reference

Edit description on GitHub

NTinternals.net (undocumented.ntinternals.net)

This function is documented in Windows Driver Kit.

See also

Edit description on GitHub