Get Windows From Registry

Exporting DigitalProductId from the registry. Navigate to the HKEYLOCALMACHINE TEST Microsoft Windows NT CurrentVersion key (you can copy and paste the key name in the key bar under the menu. On the right pane you will see registry values for the selected key and you should see the DigitalProductId value as REGBINARY. Given the key for some registry value (e.g. HKEYLOCALMACHINE blah blah blah foo) how can I: Safely determine that such a key exists. Programmatically (i.e. With code) get its value. I have absolutely no intention of writing anything back to the registry (for the duration of my career if I can help it).

Starting from its first version, PowerShell offers an administrator an extensive set of tools to interact with Windows system registry. If necessary, all typical operations with the registry can be performed not in the good old Regedit interface, or reg.exe, but in PowerShell command prompt. In different scripts and scenarios it is indispensable. In this article, we’ll consider how to create, edit or delete keys and parameters of Windows registry, search something or connect to the registry on a remote computer using PowerShell.

Registry Navigation Using PowerShell

Working with the registry in PowerShell is similar to working with common files on a local disk.

Display the list of available drives:

Get Windows From Registry

get-psdrive

As you can see, the built-in provider allows to get access to the contents of two branches of the registry: HKEY_CURRENT_USER (HKCU) and HKEY_LOCAL_MACHINE (HKLM). The branches of the registry are addressed like drives (HKLM: and HKCU:). For example, to go to the root of HKLM, run this command:

cd HKLM:

You can go to the specific branch of the registry (for example, to the one responsible for the settings of automatic driver updates) using Set-Location command (alias — sl)

Set-Location -Path HKLM:SOFTWAREMicrosoftWindowsCurrentVersionDriverSearching

Display the contents of the key:

dir

Or

Get-ChildItem

Open the same branch in the Registry Editor. As you can see, the command has displayed only the information about the subkeys, not the parameters of the current branch.

The matter is that, from PowerShell point of view, a registry branch (a key) is a file analog, and the parameters stored in this registry key are the properties of this file.

So, to get the parameters of this branch, use Get-Item cmdlet:

Get-Item .
Or
Get-Item -Path HKLM:SOFTWAREMicrosoftWindowsCurrentVersionDriverSearching

As you can see, DriverSearching key has only one parameter – SearchOrderConfig with its value equal to 0.

To address the specific key parameter, Get-ItemProperty cmdlet is used. For example, assign the contents of the branch to variable and get the value of the parameter:

$DriverUpdate = Get-ItemProperty –Path ‘HKLM:SOFTWAREMicrosoftWindowsCurrentVersionDriverSearching’
$DriverUpdate.SearchOrderConfig

We have got that the value of SearchOrderConfig parameter is equal to 1.

How to Change the Registry Value

To change the value of SearchOrderConfig parameter, use Set-ItemProperty cmdlet:

Set-ItemProperty -Path 'HKLM:SOFTWAREMicrosoftWindowsCurrentVersionDriverSearching' -Name SearchOrderConfig -Value 0

How to Create a New Register Key or Parameter

To add a new registry key, use New-Item command. Create a new key with the name NewKey:

$HKCU_Desktop= 'HKCU:Control PanelDesktop'
New-Item –Path $HKCU_Desktop –Name NewKey

Add a new string parameter with the name SuperParamString and the value file_name.txt for the created key:

New-ItemProperty -Path $HKCU_DesktopNewKey -Name 'SuperParamString' -Value ”file_name.txt” -PropertyType 'String'

Make sure that the new key and parameter have appeared in the registry.

Deleting a Registry Key or Parameter

Remove the parameter SuperParamString created earlier:

$HKCU_Desktop= 'HKCU:Control PanelDesktop'
Remove-ItemProperty –Path $HKCU_DesktopNewKey –Name 'SuperParamString'

Then delete the entire branch:

Remove-Item –Path $HKCU_DesktopNewKey –Recurse

Note. –Recurse key shows that all subkeys have to be removed recursively without confirmation.

To remove all items in the branch, but not the branch itself, the command looks like this:

Remove-Item –Path $HKCU_DesktopNewKey* –Recurse

How to Rename a Key or a Parameter

Get Windows Registry Key C#

To rename the parameter use this command:

Rename-ItemProperty –path ‘HKCU:Control PanelDesktopNewKey’ –name 'SuperParamString' –newname “OldParamString”

In the same way, you can rename the registry key:

Rename-Item -path 'HKCU:Control PanelDesktopNewKey' OldKey

Search the Registry Using PowerShell

PowerShell allows you to search registry. The next script searches the HKCU:Control PanelDesktop the parameters, whose names contain the *dpi* key.

$Path = (Get-ItemProperty ‘HKCU:Control PanelDesktop’)
$Path.PSObject.Properties | ForEach-Object {
If($_.Name -like '*dpi*'){
Write-Host $_.Name ' = ' $_.Value
}
}

Remote Access to the Registry Using PowerShell

PowerShell allows you to access the registry from of a remote computer. You can connect to a remote computer either using WinRM (Invoke-Command or Enter-PSSession):

Invoke-Command –ComputerName srv-fs1 –ScriptBlock { Get-ItemProperty -Path 'HKLM:SystemSetup' -Name WorkingDirectory}

Or using remote registry connection (RemoteRegistry must be enabled)

$Server = 'lon-fs1'
$Reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', $Server)
$RegKey= $Reg.OpenSubKey('SystemSetup')
$RegValue = $RegKey.GetValue('WorkingDirectory')

Tip. If you have to create/modify a certain registry parameter on a number of domain computers, it easier to use GPO features.

So, we looked at typical examples of using PowerShell to interract with the Windows registry.

Managing Saved Passwords Using Windows Credential Manager

August 9, 2021

Kill a Windows Service That Stucks on Stopping...

August 5, 2021

How to Repair and Reinstall Microsoft Store on...

August 4, 2021

Changing Time Zone Settings in Windows via CMD,...

August 4, 2021

Hyper-V: Enabling Routing Between Internal Networks (Subnets)

August 2, 2021

Whenever you install software, updates or make configuration changes, it’s common for Windows to need a reboot. Many OS tasks sometimes force Windows to require a reboot. When a reboot is pending, Windows add some registry values to show that. In this blog post, you’re going to learn how to check for a pending reboot and how to build a PowerShell script to automate the task.

Windows Needs Rebooted

When you’re in on the console, you can notice a reboot is pending by some popup box or notification as shown below.

From that notification, you can restart Windows and be done with it. But, what if you can’t immediately reboot a machine when it needs to? What if you’ve just installed updates on a production server and that server can’t be rebooted right now?

The reboot must wait.

Time goes by and by then the reboot may be forgotten about altogether! By the time you realize, many servers or workstations need to be rebooted but which ones?

Pending Reboot Flags are in the Registry

A pending reboot is defined in many places. Scroll right to see the values and conditions. A Windows computer is pending a reboot if any of the conditions in this table are true.

If you have the Microsoft System Center Configuration Manager (SCCM) client installed, you may also see these methods in WMI.

Once you know each method to check for a pending reboot, there are many different ways to check registry values. You could open up regedit.exe and manually mouse through each registry key.

Registry

Manually checking via the registry works but we’re human. What if you forget to check one registry path or just forget which ones to check? There’s a much better way to do this. You can create a script or function to do this for you. In my case, I prefer PowerShell so that’s what I’ll use.

By using a PowerShell script, you can query one or all computers in our domain or manually provide the server names to see if they are pending a reboot. You can then make a decision to whether to reboot them then or make a list to reboot later. The choice is yours.

To use my PowerShell method, you’ll need to ensure PowerShell Remoting is set up and available on your servers.

Testing for a a Pending Reboot (The Easy Way)

If you don’t want to learn how to check these registry keys and build a tool like this in PowerShell, I’ve made it easy for you. Simply open up your PowerShell console and type Install-Script Test-PendingReboot. Install-Script will download my PowerShell script from the PowerShell Gallery to C:Program FilesWindowsPowerShellScripts. Then run the script as shown below.

You can provide as many servers as you want via the ComputerName parameter. The script will return True or False along with the server name.

This tool checks all of the registry keys in the above table for you.

If you’d like to add conditions I’ve missed or correct any mistakes I’ve made, feel free to issue a pull request on GitHub to fix it.

If you want to learn how to build a tool like this, read on!

Building a Pending Reboot PowerShell Tool

Get Windows Registry Value Powershell

First, you’ll need to define all of the computers you’d like to test a reboot on. There are many different ways to do this but for this demonstration, I’ll define them manually via an array.

Now create a foreach loop to iterate over each of them.

Next, I recommend using PowerShell Remoting and checking each registry key and value condition inside of a single PSSession. Create a PSSession for every server.

Once you have a PSSession created, you’ll then need to run the checks.

Since you’ll be running many different checks using the same code such as:

  • Testing if a registry key exists
  • Testing if a registry value exists
  • Testing if a registry value is not null

I recommend creating simple functions for each of these checks. This allows you to call a function instead of duplicating code. The Test-PendingReboot script builds all of these helper functions into a single scriptblock as shown below.

Inside of that same scriptblock, define each condition referencing the helper functions you just created.

You can now create a foreach loop inside of your $serversforeach loop that reads each test executes each test.

When you run the code, the script returns an output like this:

You can create this output by ensuring the foreach loop returns a single object per server. You should know that if any of the registry values exist, then the server is pending a reboot. Knowing this, you then need to return True if any of the values exist and False if none of them exist.

Get My Windows Product Key From Registry

Wrap all of this up into a script and it should look like this (with some minor additions like Credential).

You can now execute it like this:

Summary

You should now have a quick way to test pending reboot across Windows servers. You can see that by using PowerShell, you can consolidate down many tedious steps into one script. This script allows you to quickly test for a pending reboot across many servers at once.

If you know of any other indications to check for a pending reboot, please let me know.

Get Windows Key From Registry

More from Adam The Automator & Friends