Day: January 3, 2012

#Powershell

So I have been messing with Powershell for a while now, Jeff asked me to look at script he had that read remote registry values.  He was using PSRemoteRegistry but got some errors.

So I knocked this function up for him

function Get-RegistryValue([Switch]$Recurse=$false, [String]$ComputerName=(hostname), [String]$Hive="HKLM", [String]$key)
{
  $OutArray = @()
  Switch($Hive){
    "HKCR"  {$type = [Microsoft.Win32.RegistryHive]::ClassesRoot}
    "HKU"   {$type = [Microsoft.Win32.RegistryHive]::Users}
    "HKPD"  {$type = [Microsoft.Win32.RegistryHive]::PerformanceData}
    "HKDD"  {$type = [Microsoft.Win32.RegistryHive]::DynData}
    "HKCU"  {$type = [Microsoft.Win32.RegistryHive]::CurrentUser}
    "HKLM"  {$type = [Microsoft.Win32.RegistryHive]::LocalMachine}
  }#Case

  $regKey = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey($type, $ComputerName)
  $regKey = $regKey.OpenSubKey($key)
  If($regKey -eq $Null){Write-Host "Registry Key ["$Hive""$key"] Not Found" -ForeGroundColor Red;Return}
  Write-Host "`n"$regkey -ForeGroundColor Blue
  If ($Recurse -AND $regKey.SubKeyCount -gt 0){

    ForEach($sub in $regKey.GetSubKeyNames()){
      $SUBkey = $key + "" + $Sub
      Get-RegistryValue -ComputerName $ComputerName -Hive $Hive -Key $SUBKey -Recurse $Recurse
    }#ForEach
  }#If
  ForEach($Subx in $RegKey.GetValueNames()){
    $RegArray = "" | Select ComputerName, Key, Value, path
    $RegArray.ComputerName = $ComputerName
    $RegArray.Key          = $SubX
    $RegArray.Value        = $Regkey.GetValue($SubX)
    $RegArray.Path         = $RegKey.Name
    $OutArray             += $RegArray
  }#ForEach
Return $OutArray
}#End Function Get-RegistryValue

Essentially all you need to do is

Get-RegistryValue –ComputerName <Computername> -Key "SYSTEMCurrentControlSetservicesSNMPParametersTrapConfiguration" -Hive HKLM –Recurse

You change the -Hive switch to the particular registry hive (by default it will use HKLM), give it a computername (by default it will use the localhost) and a registry key path .. Done!

You can also recurse a registry if there are subkeys .. nice

Let me know what you think