Skip to content

Instantly share code, notes, and snippets.

@milesgratz
Last active April 20, 2017 12:09
Show Gist options
  • Save milesgratz/bdbca20654e4b9ee2749840b05fca577 to your computer and use it in GitHub Desktop.
Save milesgratz/bdbca20654e4b9ee2749840b05fca577 to your computer and use it in GitHub Desktop.
Recursively get all keys, subkeys, and values from specific Registry Path
#---------------------------------------------------
# Let's find all registry keys beneath specific path
#---------------------------------------------------
# Define root of registry query
$topLayer = "HKLM:\SOFTWARE\Microsoft\.NETFramework"
# Define empty array for all layers
$allLayers = @()
$allLayers += $topLayer
# Define first layer
$currentLayer = (Get-ChildItem $topLayer).Name -replace "HKEY_LOCAL_MACHINE","HKLM:"
# If the first layer exists, add to all Layers
If ($currentLayer -ne $null){ $allLayers += $currentLayer }
# Loop through the layers
while ($currentLayer.Count -gt 1)
{
# Define empty array for next layer of SubKeys
$nextLayers = @()
# Loop through current layer of Keys
foreach ($Layer in $currentLayer)
{
# Check for any SubKeys
$nextLayer = Get-ChildItem $Layer
If ($nextLayer -ne $null)
{
$nextLayers += $nextLayer.Name -replace "HKEY_LOCAL_MACHINE","HKLM:"
}
}
# Add any SubKeys to all layers array
$allLayers += $nextLayers
# Redefine current layer to be any Subkeys found
$currentLayer = $nextLayers
}
# Let's sort the layers
$allLayers = $allLayers | Sort-Object
#---------------------------------------------------
# Let's create an array with keys and values
#---------------------------------------------------
# Define array for results
$Results = @()
# Loop through all layers
$allLayers | ForEach-Object {
# Get registry item
$regItem = Get-Item $_
# Define parent key path
$parentKeySplit = ($regItem.Name -split '\\')
$parentKey = $parentKeySplit[0..($parentKeySplit.Count-2)] -join "\"
$shortKeyName = $parentKeySplit[-1]
# Add information about the current key path
# + Create custom object with Key Name, SubKey Name, and SubKey Value
$Object = New-Object PSCustomObject
$Object | Add-Member -MemberType NoteProperty -Name "Full Key Name" -Value $regItem.Name
$Object | Add-Member -MemberType NoteProperty -Name "Short Key Name" -Value $shortKeyName
$Object | Add-Member -MemberType NoteProperty -Name "Parent Key Name" -Value $parentKey
$Object | Add-Member -MemberType NoteProperty -Name "SubKey Name" -Value $null
$Object | Add-Member -MemberType NoteProperty -Name "SubKey Value" -Value $null
$Object | Add-Member -MemberType NoteProperty -Name "SubKey Type" -Value $null
# Add to Results array
$Results += $Object
# Loop through SubKeys
$regItem.GetValueNames() | ForEach-Object {
# Create custom object with Key Name, SubKey Name, and SubKey Value
$Object = New-Object PSCustomObject
$Object | Add-Member -MemberType NoteProperty -Name "Full Key Name" -Value $regItem.Name
$Object | Add-Member -MemberType NoteProperty -Name "Short Key Name" -Value $shortKeyName
$Object | Add-Member -MemberType NoteProperty -Name "Parent Key Name" -Value $parentKey
$Object | Add-Member -MemberType NoteProperty -Name "SubKey Name" -Value $_
$Object | Add-Member -MemberType NoteProperty -Name "SubKey Value" -Value $regItem.GetValue($_)
$Object | Add-Member -MemberType NoteProperty -Name "SubKey Type" -Value $regItem.GetValueKind($_)
# Add to Results array
$Results += $Object
}
}
# Output results
$Results | Sort-Object 'Parent Key Name','Short Key Name' | Out-GridView
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment