I've had a bit mixed results with Msf::Post::Windows::Registry and its methods on Win7. I have few other modules coming that collect information from the registry and in those I've used those methods. However for some reason if I use Msf::Post::Windows::Registry and its methods I can only run the modules maybe 1-3 times and after that registry reads starts failing/giving nil results which means I have to re-run the whole reverse_tcp etc. payload before I can get proper results again (for those 1-3 times until i have to re-run again...).

Error messages gives me missing/wrong file handle and procmon shows that if a certain registry hive is closed on the first run, it won't be opened on the consecutive runs which causes the nil results. I don't know if this is just HKU specific, if it's a problem with how Win7 uses registers, if it's a metasploit problem or if it's a problem in my code. I've actually been meaning to convert them to use registry.open_key and see if the bug still appears but I haven't had the time to test it yet. When I get the time to test it properly I'll file a bug report if necessary.

For this module I guess I can change it to use registry_getvaldata and see if it has the same problems I've had with HKU.