PowerShell : Registry

PowerShell provides a large set of tools for interacting with the Microsoft Windows registry, either on the local machine or remotely.

You can get, edit, create and delete registry keys with PowerShell.

Below are the some of the cmdlets which can be used to interact with the Registry.

  • Get-PSDrive
  • Get-Item
  • Get-ItemProperty
  • New-Item
  • New-ItemProperty
  • Remove-Item
  • Remove-ItemProperty

 

The Get-PSDrive cmdlet gets the drives in the current session.

Get drives in the current session

PS C:> Get-PSDrive

Name           Used (GB)     Free (GB) Provider      Root                                               CurrentLocation
----           ---------     --------- --------      ----                                               ---------------
Alias                                  Alias
C                 102.59         95.20 FileSystem    C:                                                     UsersSree
Cert                                   Certificate   
D                  89.39        260.62 FileSystem    D:
E                 174.16        209.21 FileSystem    E:
Env                                    Environment
F                                      FileSystem    F:
Function                               Function
HKCU                                   Registry      HKEY_CURRENT_USER
HKLM                                   Registry      HKEY_LOCAL_MACHINE
Variable                               Variable
WSMan                                  WSMan

HKLM: and HKCU: drives that are exposed by Registry provider.

You can show all items directly within a registry key by using Get-ChildItem.

Listing All Subkeys of a Registry Key

PS C:> Get-ChildItem -Path HKCU:


    Hive: HKEY_CURRENT_USER


Name                           Property
----                           --------
AppEvents
Applications
................
.............................
..................................

Getting properties

You can get the property names associated with a key using the following command.

PS C:> Get-Item -Path `
​Registry::HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion | `
Select-Object -ExpandProperty Property

To view the registry entries in a more readable form, use Get-ItemProperty

PS C:> Get-ItemProperty -Path `
Registry::HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion

Creating Registry Keys and Entries

Creating new keys in the registry is simpler than creating a new item in a file system.

PS C:> New-Item -Path HKCU::SOFTWAREMicrosoftWindowsDeleteMe

You can also use a provider-based path to specify a key

PS C:> New-Item -Path Registry::SOFTWAREMicrosoftWindowsDeleteMe

You can add the new entry to the key by using New-ItemProperty.

PS C:> New-ItemProperty -Path HKCU::SOFTWAREMicrosoftWindowsCurrentVersion `
-Name PowerShellPath `
-PropertyType String `
-Value $PSHome

Copying Keys

You can copy the registry keys with Copy-Item cmdlet.

PS C:> Copy-Item -Path 'HKLM:SOFTWAREMicrosoftWindowsCurrentVersion' `
-Destination HKCU:

If you have subkeys in it, you need to specify the Recurse parameter.

PS C:> Copy-Item -Path 'HKLM:SOFTWAREMicrosoftWindowsCurrentVersion' `
-Destination HKCU: -Recurse

Renaming Registry Entries

To rename any entry of key, use Rename-ItemProperty cmdlet

PS C:> Rename-ItemProperty -Path HKLM:SOFTWAREMicrosoftWindowsCurrentVersion `
-Name PowerShellPath `
-NewName PSHome

Deleting Registry Keys and Entries

You can delete the registry keys with Remove-Item cmdlet.

PS C:> Remove-Item -Path HKCU::SOFTWAREMicrosoftWindowsDeleteMe

To delete subkeys without prompting, specify the -Recurse parameter

PS C:> Remove-Item -Path HKCU::SOFTWAREMicrosoftWindowsDeleteMe `
-Recurse

To delete Registry entries, use Remove-ItemProperty cmdlet.

PS C:> Remove-ItemProperty -Path HKLM:SOFTWAREMicrosoftWindowsCurrentVersion `
-Name PSHome