Last active
April 20, 2017 12:09
-
-
Save milesgratz/bdbca20654e4b9ee2749840b05fca577 to your computer and use it in GitHub Desktop.
Recursively get all keys, subkeys, and values from specific Registry Path
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#--------------------------------------------------- | |
# Let's find all registry keys beneath specific path | |
#--------------------------------------------------- | |
# Define root of registry query | |
$topLayer = "HKLM:\SOFTWARE\Microsoft\.NETFramework" | |
# Define empty array for all layers | |
$allLayers = @() | |
$allLayers += $topLayer | |
# Define first layer | |
$currentLayer = (Get-ChildItem $topLayer).Name -replace "HKEY_LOCAL_MACHINE","HKLM:" | |
# If the first layer exists, add to all Layers | |
If ($currentLayer -ne $null){ $allLayers += $currentLayer } | |
# Loop through the layers | |
while ($currentLayer.Count -gt 1) | |
{ | |
# Define empty array for next layer of SubKeys | |
$nextLayers = @() | |
# Loop through current layer of Keys | |
foreach ($Layer in $currentLayer) | |
{ | |
# Check for any SubKeys | |
$nextLayer = Get-ChildItem $Layer | |
If ($nextLayer -ne $null) | |
{ | |
$nextLayers += $nextLayer.Name -replace "HKEY_LOCAL_MACHINE","HKLM:" | |
} | |
} | |
# Add any SubKeys to all layers array | |
$allLayers += $nextLayers | |
# Redefine current layer to be any Subkeys found | |
$currentLayer = $nextLayers | |
} | |
# Let's sort the layers | |
$allLayers = $allLayers | Sort-Object | |
#--------------------------------------------------- | |
# Let's create an array with keys and values | |
#--------------------------------------------------- | |
# Define array for results | |
$Results = @() | |
# Loop through all layers | |
$allLayers | ForEach-Object { | |
# Get registry item | |
$regItem = Get-Item $_ | |
# Define parent key path | |
$parentKeySplit = ($regItem.Name -split '\\') | |
$parentKey = $parentKeySplit[0..($parentKeySplit.Count-2)] -join "\" | |
$shortKeyName = $parentKeySplit[-1] | |
# Add information about the current key path | |
# + Create custom object with Key Name, SubKey Name, and SubKey Value | |
$Object = New-Object PSCustomObject | |
$Object | Add-Member -MemberType NoteProperty -Name "Full Key Name" -Value $regItem.Name | |
$Object | Add-Member -MemberType NoteProperty -Name "Short Key Name" -Value $shortKeyName | |
$Object | Add-Member -MemberType NoteProperty -Name "Parent Key Name" -Value $parentKey | |
$Object | Add-Member -MemberType NoteProperty -Name "SubKey Name" -Value $null | |
$Object | Add-Member -MemberType NoteProperty -Name "SubKey Value" -Value $null | |
$Object | Add-Member -MemberType NoteProperty -Name "SubKey Type" -Value $null | |
# Add to Results array | |
$Results += $Object | |
# Loop through SubKeys | |
$regItem.GetValueNames() | ForEach-Object { | |
# Create custom object with Key Name, SubKey Name, and SubKey Value | |
$Object = New-Object PSCustomObject | |
$Object | Add-Member -MemberType NoteProperty -Name "Full Key Name" -Value $regItem.Name | |
$Object | Add-Member -MemberType NoteProperty -Name "Short Key Name" -Value $shortKeyName | |
$Object | Add-Member -MemberType NoteProperty -Name "Parent Key Name" -Value $parentKey | |
$Object | Add-Member -MemberType NoteProperty -Name "SubKey Name" -Value $_ | |
$Object | Add-Member -MemberType NoteProperty -Name "SubKey Value" -Value $regItem.GetValue($_) | |
$Object | Add-Member -MemberType NoteProperty -Name "SubKey Type" -Value $regItem.GetValueKind($_) | |
# Add to Results array | |
$Results += $Object | |
} | |
} | |
# Output results | |
$Results | Sort-Object 'Parent Key Name','Short Key Name' | Out-GridView |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment