Returning a Registry KEY based on specific Values data

I’ve been trying to create a simple command which will look through a registry path, and return the NAME of the Key if a value’s data underneath that key is “Like” a string.

I’ve started with:

Get-ChildItem -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ | where { $_.DisplayName -like 'symantec' }

Nothing gets returned.

IF I can get something returned, I still then need to have the result be the KEY name, which is directly under “Uninstall” and of course is different for each product.

I’m so confused :slight_smile: Any advice would be appreciated. I can also use a script but It would be easier with a one line command.

Thanks in advance!

What you should looking for are item properties not items. Try something like this:

Get-ChildItem -Path “REGISTRY::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall” |
Where-Object {
(Get-ItemProperty -Path $_.PSPath -Name DisplayName).DisplayName -like ‘symantec
} |
Select-Object -Property Name

If you’re using the -like operator you have to use asterisks either on one side or on both sides. Otherwise you will only find exact matches.

I wish I could do “Get-Childitem -Recurse HKLM: | Select-String” on the registry, but that doesn’t work so well with values and data. Here’s a nice registry search script: