Powershell and the Registry
Originally Posted here: https://blogs.flaphead.dns2go.com/archive/2006/09/08/3548.aspx
Brett touched on this a while back, and I just wanted to pad things out a bit.
So as brett mentioned, you can access the registry like a file system in powershell.
So start up powershell and type:
PS C:\> sl HKLM:
PS HKLM:\>
Now you can sl, cd and chdir are all an alias for Set-Location, so you can use either. You can see the aliases for Set-Location by typing:
PS HKLM:\> get-alias | where-object {$_.Definition -eq "Set-Location"}
CommandType Name Definition
----------- ---- ----------
Alias sl Set-Location
Alias cd Set-Location
Alias chdir Set-Location
Now you can type dir and navigate the registry like the file system using cd etc etc. How cool is that. You can also get it to “auto fillin” by using <TAB>.
So that is okay, but what about the properties of keys? Well get to the key you want and show it’s properties like this:
PS HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters> get-itemproperty .
PSPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHIN E\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT
PSChildName : Parameters
PSDrive : HKLM
PSProvider : Microsoft.PowerShell.Core\Registry
NbProvider : _tcp
NameServerPort : 137
CacheTimeout : 600000
BcastNameQueryCount : 3
BcastQueryTimeout : 750
NameSrvQueryCount : 3
NameSrvQueryTimeout : 1500
Size/Small/Medium/Large : 1
SessionKeepAlive : 3600000
TransportBindName : \Device\
EnableLMHOSTS : 1
DhcpNodeType : 4
If you want a specific property you can get it by typing:
PS C:\> $(Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters).DHCPNodeType
4
so this is cool too. So now in a cmdlet I want to store a variable from a registry key entry. How do I do that? Well the same as above
PS C:\> $regkey = $(Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters).DHCPNodeType
PS C:\> $regkey
4
Okay, so what else. You can do this:
PS HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters> dir -recurse
and it wil list all the folders and subfolder under the key. What I have not been able to find yet is get an output similar to reg.exe /enum. If anyone know hows to let me know
Anyway so this is how you read from the registry, what about writing?. So create a new key just do this:
PS HKLM:\SYSTEM\CurrentControlSet\Services\NetBT> md test
Hive: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT
SKC VC Name Property
--- -- ---- --------
0 0 test {}
PS HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\test> New-ItemProperty . -name Fred -value "hello"
PSPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\test
PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT
PSChildName : test
PSDrive : HKLM
PSProvider : Microsoft.PowerShell.Core\Registry
Fred : hello
and if I want to change the value for Fred
PS HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\test> Set-ItemProperty . -name Fred -value "goodbye"
PS HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\test> Get-ItemProperty .
PSPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\test
PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT
PSChildName : test
PSDrive : HKLM
PSProvider : Microsoft.PowerShell.Core\Registry
Fred : goodbye
How cool is that. Hope this helps more to come soon