Basic PowerShell commands to work with Windows Registry.
Don't mess up with the registry, if you're not sure of what
you are doing.
Messing up with the registry for fun is just good in a
virtual environment with no important data at all.
To list software registry keys on path HKCU type this
command below:
Get-ChildItem -Path hkcu:\software | Select Name
It will list all the software registry keys, it's good to
list all the software registry keys and check for any illicit software
installed by malwares or viruses.
If there's a lot of software installed on the PC it will be
a long list.
But PowerShell comes handy when it comes to filtering.
Code below will filter for any Keys in HKCU path that has
"Ad" values on it.
Use the parameter "-like" and not "-eq",
-eq or equal will match 100% and will not return any value if no match at all.
Get-ChildItem -Path hkcu:\software | Where-Object {$_.Name -like '*Ad*'}
Sample output:
Hive:
HKEY_CURRENT_USER\software
Name Property
---- --------
Adobe
Below is another code filtering example that will look for
any keys with "Win" string.
Sample output:
Get-ChildItem -Path hkcu:\software | Where-Object {$_.Name -like '*Win*'}
Hive:
HKEY_CURRENT_USER\software
Name Property
---- --------
Cygwin
GnuWin32
Windows Live Writer
Winpolicies
WinRAR
WinRAR SFX C%%Program Files%WinRAR :
C:\Program Files\WinRAR
Those are just basics way of handling registry keys, using
PowerShell.
If want to learn some more using PowerShell on messing up with the registry check out cmdlets:
Start-Transaction, Use-Transaction, Complete-Transaction
To check out some more tips on how to play around or edit the registry using PowerShell refer to Technet links below.
To check out some more tips on how to play around or edit the registry using PowerShell refer to Technet links below.
Check out links below for Technet references:
Hope it helps you to get started on how to edit the Windows registry using PowerShell.
Cheers!!!
Comments
Post a Comment