4
Get-ChildItem is the one to use, and a quickie would be:
Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion'
More examples here: https://msdn.microsoft.com/en-us/powershell/scripting/getting-started/cookbooks/working-with-registry-keys
If you want to get a specific key value:
$val = (Get-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName').ComputerName
And how to set/edit appropriately https://blogs.technet.microsoft.com/heyscriptingguy/2015/04/02/update-or-add-registry-key-value-with-powershell/
3
Get-ItemPropertyValue
For registry operations, use:
Get-ItemProperty
and Get-ItemPropertyValue
to read registry values and dataGet-Item
to get registry keys and sub-keys (but not to read registry values and data)Get-ChildItem
to list sub-keys within keys and hivesNew-PSDrive
to make registry drives (only HKCU and HKLM exist by default). Note you can also use long form without mounting (more details below)For more information, see Registry Provider.
Using your example as a starting point, which is using the HKEY_USERS registry root key, I'm going to lookup the MenuBar color, since the key you had was not available on my system.
reg query "HKEY_USERS\.DEFAULT\Control Panel\Colors" /v MenuBar
Using Get-ItemPropertyValue
:
PS C:\> Get-ItemPropertyValue 'Registry::HKEY_USERS\.DEFAULT\Control Panel\Colors' -Name MenuBar
240 240 240
Using Get-ItemProperty
:
PS C:\> (Get-ItemProperty 'Registry::HKEY_USERS\.DEFAULT\Control Panel\Colors').MenuBar
240 240 240
Using New-PSDrive
to mount HKEY_USERS as HKU:
PS C:\> New-PSDrive -PSProvider Registry -Root HKEY_USERS -Name HKU
Name Used (GB) Free (GB) Provider Root
---- --------- --------- -------- ----
HKU Registry HKEY_USERS
PS C:\> Get-ItemPropertyValue 'HKU:\.DEFAULT\Control Panel\Colors' -Name MenuBar
240 240 240
PS C:\>
From Registry Provider:
The registry is divided into keys, subkeys, and entries. For more information about registry structure, see Structure of the Registry.
In a Registry drive, each key is a container. A key can contain any number of keys. A registry key that has a parent key is called a subkey. You can use
Get-ChildItem
to view registry keys andSet-Location
to navigate to a key path.Registry values are attributes of a registry key. In the Registry drive, they are called Item Properties. A registry key can have both children keys and item properties.
...
Each registry key can also have subkeys. When you use Get-Item on a registry key, the subkeys are not displayed. The
Get-ChildItem
cmdlet will show you children items of the "Spooler" key, including each subkey's properties. The parent keys properties are not shown when usingGet-ChildItem
.
From Get-Item:
This command shows the contents of the Microsoft.PowerShell registry key. You can use this cmdlet with the PowerShell Registry provider to get registry keys and subkeys, but you must use the
Get-ItemProperty
cmdlet to get the registry values and data.
1
This format, while very similar can also be used:
$username = Get-ItemProperty -path "HKCU:\Volatile Environment"
Which creates an object. The properties can be called using:
$username.username