Carpe Diem: Flaphead.com

Powershell and the Registry

Brett touched on this a while back, and I just wanted to pad things out a bit.

So as brett mentioned, you can access the registry like a file system in powershell. 

So start up powershell and type:

PS C:\> sl HKLM:
PS HKLM:\>

Now you can sl, cd and chdir are all an alias for Set-Location, so you can use either.  You can see the aliases for Set-Location by typing:

PS HKLM:\> get-alias | where-object {$_.Definition -eq "Set-Location"}

CommandType     Name                            Definition
-----------     ----                            ----------
Alias           sl                              Set-Location
Alias           cd                              Set-Location
Alias           chdir                           Set-Location

Now you can type dir and navigate the registry like the file system using cd etc etc.  How cool is that.  You can also get it to “auto fillin” by using <TAB>.

So that is okay, but what about the properties of keys?  Well get to the key you want and show it’s properties like this:

PS HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters> get-itemproperty .

PSPath                  : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHIN E\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
PSParentPath            : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT
PSChildName             : Parameters
PSDrive                 : HKLM
PSProvider              : Microsoft.PowerShell.Core\Registry
NbProvider              : _tcp
NameServerPort          : 137
CacheTimeout            : 600000
BcastNameQueryCount     : 3
BcastQueryTimeout       : 750
NameSrvQueryCount       : 3
NameSrvQueryTimeout     : 1500
Size/Small/Medium/Large : 1
SessionKeepAlive        : 3600000
TransportBindName       : \Device\
EnableLMHOSTS           : 1
DhcpNodeType            : 4

If you want a specific property you can get it by typing:

PS C:\> $(Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters).DHCPNodeType
4

so this is cool too.  So now in a cmdlet I want to store a variable from a registry key entry.  How do I do that?  Well the same as above

PS C:\> $regkey = $(Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters).DHCPNodeType
PS C:\> $regkey
4

Okay, so what else.  You can do this:

PS HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters> dir -recurse

and it wil list all the folders and subfolder under the key.  What I have not been able to find yet is get an output similar to reg.exe /enum.  If anyone know hows to let me know

Anyway so this is how you read from the registry, what about writing?.  So create a new key just do this:

PS HKLM:\SYSTEM\CurrentControlSet\Services\NetBT> md test

   Hive: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT

SKC  VC Name                           Property
---  -- ----                           --------
  0   0 test                           {}

PS HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\test> New-ItemProperty . -name Fred -value "hello"

PSPath       : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\test
PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT
PSChildName  : test
PSDrive      : HKLM
PSProvider   : Microsoft.PowerShell.Core\Registry
Fred         : hello

and if I want to change the value for Fred

PS HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\test> Set-ItemProperty . -name Fred -value "goodbye"
PS HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\test> Get-ItemProperty .

PSPath       : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\test
PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT
PSChildName  : test
PSDrive      : HKLM
PSProvider   : Microsoft.PowerShell.Core\Registry
Fred         : goodbye

How cool is that.  Hope this helps more to come soon