How to disable In-Pane search in Explorer

I once came across a client who wanted to disable the search option for the users. His problem was that users were still able to bring up the windows explorer in-pane search option. [more]

At first it look a bit hard to achieve but I knew it had to be something in the shell and for shell I love to use one tool and that is Shellexview. I decided to to look into shellexview tool and search there.

 Before we start the troubleshooting, we need to understand what a shell extension is, how to use the tools like shellexview and process monitor. Though you won’t be using the Process monitor now that the actual steps is mentioned. I used to discover the registry for the desired shell extension.

So, I loaded the shellexview and it gave me a whole list of shell extensions currently being loaded. Now I had to look for something related to search. Luckily, I found one entry with name ‘In-pane Search’

Here is the screenshot:

shellexview

Now all I had to do was to disable that shell extension! For who are not familiar with shellexview, just right click on the name and click on the option ‘Disable Selected Item’. Once you disable it, that extension won’t be enabled, try using that..you won’t be able to. We don’t require a reboot for it.

Now the next deal was to implement this (disable search) at the enterprise level, that is, on hundreds of client machines.

Now, every shell extension is registered in the registry under CLSID key and that’s where shellexview loads the entry from. So, if we are able to disable it from Shellexview tool, it’s got to be making changes under In-pane search registry key under CLSID. That means, it should be changing some values in it’s registry to tell it not to load (not to be enabled).

Registry key for In-pane Search:

HKEY_CLASSES_ROOT\CLSID\{169A0691-8DF9-11d1-A1C4-00C04FD75D13}How would we find the registry now? Hmm.. You guessed it right, we used Process Monitor(Procmon) for it. We ran procmon to capture logs while disabling the In-pane Search from the Shellexview tool. Once done, we stopped the procmon logs and saved it  in csv format. I prefer CSV because it can be loaded in Excel and can be analysed easily.

Once loaded in Excel, I looked for Setvalue and Createkey entries under ACTION column because that is what it must do in registry to change anything!

Luckily, I found the same CLSID that was mentioned in the Shellexview tool for In-search pane (duh!) and found a new String value under the subkey \InProcServer32

String value that got created was: ~~Disabled~~

Value data set for it was: %SystemRoot%\system32\browseui.dll

Not that string value name includes tilde (~) sign.

There is a ‘Default’ string value already present there and it’s value set to “%SystemRoot%\system32\browseui.dll”. Double click on Default and remove the value data.
DO NOT DELETE THE ‘DEFAULT’ STRING VALUE, instead delete its value data. So it should be empty.

Once known, it was easy to create a batch file that creates the string value and that batch file can be used as login script for users.

So the registry that is involved in here is:

HKEY_CLASSES_ROOT\CLSID\{169A0691-8DF9-11d1-A1C4-00C04FD75D13}\InProcServer32

String Value: ~~Disabled~~
Value Data: %SystemRoot%\system32\browseui.dll

HKEY_CLASSES_ROOT\CLSID\{169A0691-8DF9-11d1-A1C4-00C04FD75D13}

String Value: Default

Value Data should be null (empty)