by: Helge, published: Jan 23, 2012, in

ShMgrate – An Analysis

ShMgrate.exe is an executable file in Windows XP and Server 2003 and one of those files that are documented nowhere. I will try to shed a little light on this tool in this article.

ShMgrate, the “Windows NT User Data Migration Tool” (description in the file’s properties), is used to configure Outlook Express and Internet Explorer. It is called from Active Setup and when the user chooses to replace Internet Explorer and other system components, something the European Commission fought very hard to make possible. Additionally it upgrades user profiles and shell settings from Windows 9x and NT4 to 2000/XP. I guess that was its initial task, hence the name.

Adding and Removing Windows Components

When you click on “Set Program Access and Defaults” in XP you have the option to replace the built-in system components Internet Explorer, Outlook Express, Windows Messenger and Microsoft’s Java Virtual Machine with third-party software. This functionality was added to Windows after long and hard fights with the Europeans. Of course removing a component like Internet Explorer from Windows XP is next to impossible, so Microsoft decided to simple hide the icons instead. The functionality to do that was added to the already existing tool ShMgrate.

ShMgrate can be used to show or hide the start menu icons of Internet Explorer, Outlook Express and Windows Messenger like this:

%SystemRoot%\system32\shmgrate.exe OCInstallShowIEmd
%SystemRoot%\system32\shmgrate.exe OCInstallHideIE
%SystemRoot%\system32\shmgrate.exe OCInstallShowOE
%SystemRoot%\system32\shmgrate.exe OCInstallHideOE
%systemroot%\system32\shmgrate.exe Show-WM
%systemroot%\system32\shmgrate.exe Hide-WM

Similarly Microsoft’s Java VM (does anyone even remember that?) can be disabled and enabled:

%SystemRoot%\system32\shmgrate.exe OCInstallShowVM
%SystemRoot%\system32\shmgrate.exe OCInstallHideVM

It can also be used to reinstall Internet Explorer, Outlook Express, Windows Messenger and Microsoft’s Java Virtual Machine:

%SystemRoot%\system32\shmgrate.exe OCInstallReinstallIE
%SystemRoot%\system32\shmgrate.exe OCInstallReinstallOE
%systemroot%\system32\shmgrate.exe Reinstall-WM
%systemroot%\system32\shmgrate.exe OCInstallReinstallVM

Active Setup

ShMgrate is used by Active Setup to preconfigure settings for Internet Explorer and Outlook Express in new user profiles. The following commands are executed once per user profile:

%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

Above commands are stored in the following Active Setup registry keys:

  • Software\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}
  • Software\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}

Profile and Shell Upgrade

Since I do not have Windows 9x or NT4 virtual machines ready and did not feel inclined to install either of those dinosaurs I cannot say exactly how the upgrade procedure works, but I found some hints in the strings stored in ShMgrate.exe:

  • Set-Screensaver-On-FriendlyUI
  • Fix-HTML-Help
  • MoveAndAdjustIconMetrics
  • MergeDesktopAndNormalStreams
  • FixCAPIDirAttrib
  • UpgradeSchemesAndNcMetricsFromWin9xToWin2000
  • UpgradeSchemesAndNcMetricsToWin2000
  • UpgradeProfileNT4ToNT5
  • Cvt-Mouse-Schemes
  • Fix-Policies-Security
  • Fix-User-Security
  • Fix-Win-Security
  • Fix-Folders
  • Fix-Curs
  • Cvt-Curs

What About Windows 7?

If you read until here you might wonder if all of this is of any relevance for today’s systems or if this is a historical essay. It is a bit of both, I guess.

ShMgrate’s original task, migrating user profiles from previous versions of Windows to the V2 format used by Windows 7 is not implemented in the operating system (but there are third-party tools for that) – a shame, really.

The capabilites to hide, show and reinstall applications like Internet Explorer and Windows Mail (the successor of Outlook Express) was moved from ShMgrate to the applications themselves. Interestingly non-Microsoft browsers like Google Chrome have these capabilities, too. Here are some examples:

Windows Mail:

"%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallHideOE
"%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallReinstallOE

(I do not know if OCInstallShowOE works, too)

Internet Explorer:

"C:\Windows\System32\ie4uinit.exe" -hide
"C:\Windows\System32\ie4uinit.exe" -reinstall
"C:\Windows\System32\ie4uinit.exe" -show

Media Center:

C:\Windows\ehome\mcspad.exe hideicons
C:\Windows\ehome\mcspad.exe reinstall
C:\Windows\ehome\mcspad.exe showicons

Google Chrome:

"C:\Users\UserName\AppData\Local\Google\Chrome\Application\chrome.exe" --hide-icons
"C:\Users\UserName\AppData\Local\Google\Chrome\Application\chrome.exe" --make-default-browser
"C:\Users\UserName\AppData\Local\Google\Chrome\Application\chrome.exe" --show-icons

And ShMgrate.exe? It is gone. R.I.P.

Previous Article Permissions Windows Does Not Show You
Next Article Analysis: Require Domain Controller Authentication to Unlock Workstation