diff --git a/reactos/subsys/system/services/config.c b/reactos/subsys/system/services/config.c
index 321949daae5..8e23f92df73 100644
--- a/reactos/subsys/system/services/config.c
+++ b/reactos/subsys/system/services/config.c
@@ -231,6 +231,8 @@ ScmReadString(HKEY hServiceKey,
     DWORD dwError;
     DWORD dwSize;
     DWORD dwType;
+    DWORD dwSizeNeeded;
+    LPWSTR expanded = NULL;
     LPBYTE ptr = NULL;
 
     *lpValue = NULL;
@@ -260,9 +262,22 @@ ScmReadString(HKEY hServiceKey,
 
     if (dwType == REG_EXPAND_SZ)
     {
-        /* FIXME: ... */
-        DPRINT1("Expand me!\n");
-        *lpValue = (LPWSTR)ptr;
+        /* Expand the value... */
+        dwSizeNeeded = ExpandEnvironmentStringsW((LPCWSTR)ptr, NULL, 0);
+        if (dwSizeNeeded == 0)
+        {
+            dwError = GetLastError();
+            goto done;
+        }
+        expanded = HeapAlloc(GetProcessHeap(), 0, dwSizeNeeded);
+        if (dwSizeNeeded < ExpandEnvironmentStringsW((LPCWSTR)ptr, expanded, dwSizeNeeded))
+        {
+            dwError = GetLastError();
+            goto done;
+        }
+        *lpValue = expanded;
+        HeapFree(GetProcessHeap(), 0, ptr);
+        dwError = ERROR_SUCCESS;
     }
     else
     {
@@ -271,7 +286,10 @@ ScmReadString(HKEY hServiceKey,
 
 done:;
     if (dwError != ERROR_SUCCESS)
+    {
         HeapFree(GetProcessHeap(), 0, ptr);
+        HeapFree(GetProcessHeap(), 0, expanded);
+    }
 
     return dwError;
 }