Use PowerShell to Enumerate Registry Property Values

Use PowerShell to Enumerate Registry Property Values

  • Comments 10
  • Likes

Summary: Microsoft Scripting Guy, Ed Wilson, shows how to use Windows PowerShell to enumerate all the properties and their values under a registry key.

Hey, Scripting Guy! Question Hey, Scripting Guy! I have a question. It seems that getting the property values under a registry key is a tedious process. It looks like I need to know the exact property value to find out its value. Often I do not have this information. I would like a way to say, “Just give me the property values and their associated value.” I do not want to do a lot of work to get this information. Is it possible?

—BW

Hey, Scripting Guy! Answer Hello BW,

Microsoft Scripting Guy, Ed Wilson, is here. I just checked on the status of an order of Monkey Picked Oolong Tea that the Scripting Wife ordered for me. It arrives tomorrow. Charlotte, North Carolina in the United States is not a huge tea market—but hey, I have great Internet access at home and that gives me access to some of the best tea brokers in the world. I first ran across Monkey Picked tea in a small tearoom while the Scripting Wife and I were on our way to the Mark Minasi Conference. I had the Monkey Picked Oolong; she had hot chocolate. But she remembered how much I kept going on and on about the light and delicate flavor, and next thing I know, we have a package arriving tomorrow.

Note   This is the fifth blog in a series of Hey, Scripting Guy! Blogs that discuss using the Registry provider. The first blog, Using the Registry Provider to Simply Registry Access posted on Monday. Tuesday I discussed using the *restore* cmdlets to perform a system state backup of a computer prior to manipulating the registry. On Wednesday I talked about creating new registry keys and assigning default values. In the fourth blog, I talked about creating new registry keys on remote computer systems. I also discussed creating registry property values. For additional information about working with the registry via Windows PowerShell, see this collection of blogs.

Working with registry property values

Note    For a VBScript version of this blog, see Hey, Scripting Guy! How Can I Retrieve All the Values in a Registry Key?

Because of the hierarchical nature of the registry in Windows, the file system metaphor sort of breaks down. On a file system drive, you can use the New-Item cmdlet to create a folder (directory), and then go back and create a file inside the folder by using the same cmdlet. With the registry, that is not the case. New-Item creates the registry keys, but it is the New-ItemProperty cmdlet that creates the properties that are associated with the registry keys. This concept is shown in the image that follows.

Image of Registry Editor

Yesterday’s Hey, Scripting Guy! Blog talked about retrieving registry properties. In that blog, I discussed using the Get-ItemProperty cmdlet to retrieve registry property values, in addition to the specific registry property value value. (I know, it gets a little redundant). But as you pointed out, BW, from the perspective of perusing preset registry values, knowing an exact registry property value name is not the most efficient way of doing things.

Enumerating registry property values

The image that follows illustrates the Winlogon registry key. This registry key has four registry properties (in addition to the Default registry property, which is not set in this example).

Image of Registry Editor

There are several steps involved in obtaining the value of the registry property values under a specific registry key.

Only the steps…

Enumerating registry property values:

  1. Use the Push-Location cmdlet to store the current working location.
  2. Use the Set-Location cmdlet to change the current working location to the appropriate registry drive.
  3. Use the Get-Item cmdlet to retrieve the properties of the registry key.
  4. Pipe the registry properties through the ForEach-Object cmdlet.
  5. In the script block of the ForEach-Object cmdlet, use the Get-ItemProperty cmdlet to retrieve the property values.
  6. Return to the original working location by using the Pop-Location cmdlet.

Note    When you are typing the path to the specific registry key, remember that you can use tab expansion. The use of the Windows PowerShell tab expansion feature not only saves time typing, but it also invariably saves time troubleshooting mistyped commands. It is essential that you train yourself to use tab expansion everywhere it is available.

The Get-RegistryKeyPropertiesAndValues.ps1 script follows the previous Enumerating registry property values steps, but it adds a bit of extra power to the equation by creating a custom object for each registry property/value combination. The script creates a new custom object for each key/property pair. To do this, the script creates the object inside the Foreach-Object cmdlet. The resulting object pipes to the Format-Table for display to the console. The script then returns to the original working location by using the Pop-Location cmdlet. The complete Get-RegistryKeyPropertiesAndValues.ps1 script is shown here.

Get-RegistryKeyPropertiesAndValues.ps1

Push-Location

Set-Location 'HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon'

Get-Item . |

Select-Object -ExpandProperty property |

ForEach-Object {

New-Object psobject -Property @{"property"=$_;

   "Value" = (Get-ItemProperty -Path . -Name $_).$_}} |

Format-Table property, value -AutoSize

Pop-Location

It is rather easy to convert the above script to a function. The Get-RegistryKeyPropertiiesAndValues function appears here.

Get-RegistryKeyPropertiesAndValues Function

 

Function Get-RegistryKeyPropertiesAndValues

{

  <#

   .Synopsis

    This function accepts a registry path and returns all reg key properties and values

   .Description

    This function returns registry key properies and values.

   .Example

    Get-RegistryKeyPropertiesAndValues -path 'HKCU:\Volatile Environment'

    Returns all of the registry property values under the \volatile environment key

   .Parameter path

    The path to the registry key

   .Notes

    NAME:  Get-RegistryKeyPropertiesAndValues

    AUTHOR: ed wilson, msft

    LASTEDIT: 05/09/2012 15:18:41

    KEYWORDS: Operating System, Registry, Scripting Techniques, Getting Started

    HSG: 5-11-12

   .Link

     Http://www.ScriptingGuys.com/blog

 #Requires -Version 2.0

 #>

 Param(

  [Parameter(Mandatory=$true)]

  [string]$path)

 Push-Location

 Set-Location -Path $path

 Get-Item . |

 Select-Object -ExpandProperty property |

 ForEach-Object {

 New-Object psobject -Property @{"property"=$_;

    "Value" = (Get-ItemProperty -Path . -Name $_).$_}}

 Pop-Location

} #end function Get-RegistryKeyPropertiesAndValues

To use the Get-RegistryKeyPropertiesAndValues function to obtain registry key properties and their associated values, pass the path to it. For example, the image that follows illustrates the Volatile Environment registry key. On the right are a large number of registry key properties.

Image of Registry Editor

Open the Windows PowerShell ISE and load the function by opening the script that contains it. Next load the function into memory by clicking the run button (or pressing F5). When it is loaded into memory, call the function by typing the function name in the immediate window and providing a path to a specific registry key. For this example, use the HKCU:\Volatile Environment registry key (make sure you put quotation marks around the entire path to the registry key). Use the Format-Table cmdlet to display the property name and then the property value. The following command illustrates a typical command line.

Get-RegistryKeyPropertiesAndValues -path 'HKCU:\Volatile Environment' | ft property, value -AutoSize

This technique is shown in the following image.

Image of command output

BW, that is all there is to obtaining the value of the registry property values under a specific registry key. Registry Week will continue tomorrow when I will talk about modifying registry property values.

I invite you to follow me on Twitter and Facebook. If you have any questions, send email to me at scripter@microsoft.com, or post your questions on the Official Scripting Guys Forum. See you tomorrow. Until then, peace.

Ed Wilson, Microsoft Scripting Guy 

Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment
  • This is horrible.  Honestly.  Powershell is bloated.  It's a really ugly language.

  • I agree with Eric. Please go back and look at how Visual Basic did it: open a key, read a value. That's all there is to it, that's the way it should be done.

    This line is the most unreadable thing, it looks like the *** child of Perl and Bash:

    New-Object psobject -Property @{"property"=$_; "Value" = (Get-ItemProperty -Path . -Name $_).$_}}

  • I don't think you guys get it.  Powershell uses objects underneath and passes those through the pipeline.  Being able to combine that with other commands becomes truly powerful.  I have been issuing powershell to control my dev environment for a few months now and it is amazing.  If you learn powershell and see other examples, you will realize that this stuff works with other providers.  You can set-location to c:, d:, Registry::HKLM, env:, and they can all use the same commands (get-item, new-item, etc)

  • Provides a c&p solution, but this still remains a mystery and should be clarified:

    "Value" = (Get-ItemProperty -Path . -Name $_).$_

  • mybe you want to work with batch :D it's more easy ...:))))

  • Can someone tell me what I'm missing?

    Get-Content C:\ScriptTest\comp2scan.txt | Test-RegValue -Key Software\ODBC\ODBC.INI\Oasis Data -Value Server | ForEach-Object | Select-Object computername, data | Export-Csv C:\scriptest\compscanned.csv

    I am getting a "comdlet ForEach-Object at command pipeline posistion 3 - Supply values for the following parameters:"

    The txt file has a list of computer names for example the file looks like this.

    CT-Server01

    CT-Server02

    CT-OffPC01

    CT-OffPC01

  • I agree that this solution is "powerful" but at the same time it is "pointless".  The example accomplishes dumping the value of a specific registry location out to the screen in a nice table format.  Hello, start > run > regedit ?  The command is laid out in a nice one-liner format (pipes and expansion and self-referencing, oh my) so that if we try to make it do something useful, we have to rewrite it from scratch.  Le sigh.

    Here's some constructive input:  can you show us how to read a registry location into an array and then print it out?  I have tried to massage the foreach-object and get-itemproperty to do that for me but its just a mess of red text flying by.

  • Hi, first excuse me for my bad english i am french :D I want to thank you for this tips but i have one problem, i will appreciate if you can help me to resolve this.. The problem is: i have a key registry (PEACY) that contain subkeys (0, 1 , 101, 100.....) like this for example: [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\PEACY] [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\PEACY\0] "Name"="Adobe Reader (0)" "Status"="success" "Prev_Timestamp"="2012/09/05 05:05:10" "Prev_UpdateVer"="63" "Prev_SubfunctionPkey"="{68DE7BC5-CCE7-40A9-A222-AB5B98A57895}" "LastInstallDate"="2013-08-21 09:30:30" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\PEACY\1006] "Name"="Microsoft Hotfix Rollout Status (1006)" "Status"="success" "UpdateVer"="3" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\PEACY\1008] "Name"="PEACY Performance Monitor (1015)" "Status"="unavailable" "install_never"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\PEACY\1009] "Name"="PEACY Performance Monitor (1009)" "status"="unavailable" "install_never"="1" "hidden"=dword:00000001 . . . . . ------------------------------------------------ I want to retrieve on every subkeys keys from (SOFTWARE\Wow6432Node\PEACY\) the content of the "Name" keys, but only if the other keys "Status" contain the value "Success" like my example..and finally store the result on text file to get a list of software name : -------------------------- Adobe Reader (0) Microsoft Hotfix Rollout Status (1006) ------------- i need you'r help because i am beginner on powershell, thanks for advance :) Best Regards Kevin

  • This one liner gets each property and value as object

    Get-Item 'HKCU:\Software\Microsoft\Internet Explorer\Main' | %{Get-ItemProperty -Path $_.PSPath}

  • Same as: Get-Item 'HKCU:\Software\Microsoft\Internet Explorer\Main' | Get-ItemProperty

    No need for enumerator. Enumerators are automatic in PowerShell.