registry management

Managing the Registry

PowerShell has the ability to treat the registry like a file system. With little effort you can connect to the registry and navigate it just as you would a directory.

PS C:\> set-location HKLM:System
PS HKLM:\System> dir
PS HKLM:\> cd currentcontrolset\services\tcpip
PS HKLM:\system\currentcontrolset\services\tcpip> dir
PS HKLM:\system\currentcontrolset\services\tcpip>

You can use Get-ItemProperty to view registry keys. For example, if we want to see the keys in our current registry location, we would use an expression like this:

PS HKLM:\system\currentcontrolset\services\tcpip> get-itemproperty .
PS HKLM:\system\currentcontrolset\services\tcpip>

You can also create a variable for an item's properties. Here we get the registry keys for Parameters from our current location:

PS HKLM:\system\currentcontrolset\services\tcpip> `
   $ipparams=get-itemproperty Parameters
   
PS HKLM:\system\currentcontrolset\services\tcpip>$ipparams
PS HKLM:\system\currentcontrolset\services\tcpip>
PS HKLM:\system\currentcontrolset\services\tcpip> `
   $ipparams.tcpwindowsize

PS HKLM:\system\currentcontrolset\services\tcpip>

We defined $ipparams to hold the registry keys from HKLM\System\CurrentControlSet\Services\Tcpip\Parameters. Invoking the variable lists all the keys and their values. Alternatively, we can get a specific key and value by specifying a property name: We can set a registry value using Set-Itemproperty. Here we changed the Domain key under parameters that had no value to a value of TEST:

PS HKLM:\system\currentcontrolset\services\tcpip\parameters> `
   set-itemproperty -path . -name Domain -value TEST

PS HKLM:\system\currentcontrolset\services\tcpip\parameters> `
   (get-itemproperty .).Domain TEST

PS HKLM:\system\currentcontrolset\services\tcpip\parameters>

To properly use Set-Itemproperty, you should specify a path. In this example we used a "." to indicate the current location, the name of the key and its new value. Because accessing the registry in PowerShell is like accessing a file system, you can recurse through it, search for specific items, or do a massive search and replace.

You can use New-Item and New-Itemproperty to create new registry keys and properties. Let's change our location to HKEY_Current_User and look at the current items in the root:

PS HKCU:\> dir
PS HKCU:\>
PS HKCU:\> cd "PowerShell TFM"
PS HKCU:\PowerShell TFM>
To remove an item we call Remove-Itemproperty:

PS HKCU:\PowerShell TFM> remove-itemproperty -path . -name Recommend

We use Remove-Item to remove the subkey we created:

PS HKCU:\> remove-item "PowerShell TFM"

Standard Registry Rules Apply

Since PowerShell takes a new approach to managing the registry, take great care in modifying the registry. Be sure to test your registry editing skills with these new expressions and cmdlets on a test system before even thinking about touching a production server or desktop.