In this demo, we will enumerate the registry keys and values using Get‑Item,
Get‑ChildItem, and Get‑ItemProperty commands.
We will also see how to enumerate registry on a remote computer.
We will then see how to navigate to a specific registry path using PowerShell.
The first thing in this module, what we are going to learn,
is to enumerate, or list registry items.
It can be done in various ways.
You can add Include Exclude, and Recurse parameter to refine your searches.
We'll quickly start with the simplest way of listing an item,
that is, by running Get‑Item command.
When I run Get‑Item command followed by a period,
I will get the details of current working directory,
which is, in our case, is HKLM drive.
Running Get‑Item* will return all child objects of the current directory.
Here we are getting all the registry keys that reside in HKLM PS drive.
Here we can see that my account is not having permissions to
view or manage one of the registry keys.
We can also list the child objects using Get‑ChildItem command.
So when I run it, we get the same result where all the subkeys are returned.
If you have the exact path of the registry and you want to fetch the details,
you can directly query the complete path by using Get‑Item command.
As in this case,
I am querying PowerShellEngine registry key by entering its complete path.
This will list the details of the key, along with its properties.
If I want to query a specific registry property,
I can use Get‑ItemProperty command,
followed by the path where the property exists,
and in the name parameter I must enter the name of
the property that I wish to query.
Here I will enter ApplicationBase,
which is the property that resides in PowerShellEngine registry key.
This will list out details of the registry property.
In addition,
it will also list some metadata of the item like the
parent path and the Registry provider.
Now,
if I want to search for a specific registry key and
I'm unsure about its exact location,
or if I want to list all the registry paths that have a specific name in it,
I can use parameters that help in achieving this.
For example,
if I want to search for all the registry keys that
have the name PowerShell in it, I can do so by running Get‑ChildItem command.
In the Path parameter, I'll enter the current location.
Next,
I'll use Include parameter and enter the name for
which I want to perform the search.
I will enter PowerShell.
This will tell PowerShell to refine its search and search only for
registry keys whose name has PowerShell in it.
Lastly, I'll add Recurse parameter so that the search will be recursive,
and each child path will be searched.
Note that I'm performing the search in top‑level registry path,
that is, HKLM, so each and every registry path under HKLM will be queried.
When I hit Enter,
PowerShell will start its search for registries that
have the name PowerShell in it.
You may also use Exclude parameter if you want to
exclude some results from the search.
So when I enter Exclude parameter and in the argument enter PowerShell,
this will return all the registry keys except those
that have PowerShell in their name.
There's also a parameter named Filter that is used to refine search,
but it is not supported in Registry provider,
although you can use it in FileSystem provider to filter searches
based on the properties of the file or folder.
It is quite fast in fetching and filtering the results,
but unfortunately, it is not supported in Registry provider.
Now, I would like to show you how to connect to a registry of a remote computer.
In situations where you need to query any of the
data store on a remote computer, you cannot do it directly from the command,
as these generic commands like Get‑Item and Get‑ChildItem
do not support ComputerName parameter.
I'll show it to you by typing in Get‑ItemProperty command and
then check each of the supported parameters.
As you witnessed,
there wasn't any parameter in the list that would help
us to connect to the remote computer,
but that doesn't mean we will not be able to connect to remote machines.
We can do so by using PowerShell command Invoke‑Command.
This command can be used to run any command or
script on local or remote computers.
Here I have the option to use ComputerName parameter.
I can use this to connect to computers on my network.
For this demo, I will connect to my domain controller server.
Hence, in the name parameter I'll enter its name DC.
Next,
the command that we need to run must be written in curly
braces under ScriptBlock parameter.
I'll enter the command,
and we will query PowerShell registry that is residing on DC server.
When the command succeeds, we get the result on our screen.
In PSComputerName property, we can see that the ComputerName is showing as DC.
Similarly, by using Invoke‑Command for remote computers,
you can also perform other operations that we are going to see further.
Next, we are going to learn how to navigate the registry keys.
As we have seen in earlier modules,
Registry provider can be managed mainly by two different pairs drives,
at HKLM and HKCU.
This serves as an entry point to navigate to specific registry location.
I will now open registry editor and navigate to HKLM.
SOFTWARE, Microsoft, PowerShell.
This is the registry entry of native PowerShell
that comes built in with Windows.
Under this we have a subkey, PowerShellEngine.
This subkey has few properties, which we can see here in the right pane.
Now, to navigate to this path using PowerShell,
we can use Set‑Location command, followed by the complete registry path.
We start with an entry point, which, in this case,
is HKLM PS drive, followed by SOFTWARE, then Microsoft,
then PowerShell, then the subkey, and finally,
PowerShellEngine subkey.
To list the properties,
I will run Get‑Item property command. This will list out all the properties that we saw earlier using Registry snap‑in.