[quote=4517]Hope this helps you…
PowerShell
#Registry Hives
[long]$HIVE_HKROOT = 2147483648
[long]$HIVE_HKCU = 2147483649
[long]$HIVE_HKLM = 2147483650
[long]$HIVE_HKU = 2147483651
[long]$HIVE_HKCC = 2147483653
[long]$HIVE_HKDD = 2147483654
Value Data Types
[int]$REG_SZ = 1
[int]$REG_EXPAND_SZ = 2
[int]$REG_BINARY = 3
[int]$REG_DWORD = 4
[int]$REG_MULTI_SZ = 7
[int]$REG_QWORD = 11
Get Regeirty Provider
if ($Computer) {
Remote Computer
$RegProv = [WMIClass]$(“\$Computer\root\Default:StdRegProv”)
} else {
Local Computer
$RegProv = [WMIClass]“root\Default:StdRegProv”
}
Enumerate Keys
$ReturnedInfo = $RegProv.EnumKey($Hive, $RegKey)
Enumerate Values
$ReturnedInfo = $RegProv.EnumValues($Hive, $RegKey)
Create a Key
$ReturnedInfo = $RegProv.CreateKey($Hive, $RegKey)
Delete a Key
$ReturnedInfo = $RegProv.DeleteKey($Hive, $RegKey)
Write a Values
$ReturnedInfo = $RegProv.SetBinaryValue($Hive, $RegKey, $ValueName, $Value)
$ReturnedInfo = $RegProv.SetDWORDValue($Hive, $RegKey, $ValueName, $Value)
$ReturnedInfo = $RegProv.SetQWORDValue($Hive, $RegKey, $ValueName, $Value)
$ReturnedInfo = $RegProv.SetExpandedStringValue($Hive, $RegKey, $ValueName, $Value)
$ReturnedInfo = $RegProv.SetMultiStringValue($Hive, $RegKey, $ValueName, $Value)
$ReturnedInfo = $RegProv.SetStringValue($Hive, $RegKey, $ValueName, $Value)
Read Values
$ReturnedInfo = $RegProv.GetBinaryValue($Hive, $RegKey, $ValueName)
$ReturnedInfo = $RegProv.GetDWORDValue($Hive, $RegKey, $ValueName)
$ReturnedInfo = $RegProv.GetQWORDValue($Hive, $RegKey, $ValueName)
$ReturnedInfo = $RegProv.GetExpandedStringValue($Hive, $RegKey, $ValueName)
$ReturnedInfo = $RegProv.GetMultiStringValue($Hive, $RegKey, $ValueName)
$ReturnedInfo = $RegProv.GetStringValue($Hive, $RegKey, $ValueName)
Delete values
$ReturnedInfo = $RegProv.DeleteValue($Hive, $RegKey, $ValueName)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
#Registry Hives
[long]$HIVE_HKROOT=2147483648
[long]$HIVE_HKCU=2147483649
[long]$HIVE_HKLM=2147483650
[long]$HIVE_HKU=2147483651
[long]$HIVE_HKCC=2147483653
[long]$HIVE_HKDD=2147483654
Value Data Types
[int]$REG_SZ=1
[int]$REG_EXPAND_SZ=2
[int]$REG_BINARY=3
[int]$REG_DWORD=4
[int]$REG_MULTI_SZ=7
[int]$REG_QWORD=11
Get Regeirty Provider
if($Computer){
Remote Computer
$RegProv=[WMIClass]$(“\$Computer\root\Default:StdRegProv”)
}else{
Local Computer
$RegProv=[WMIClass]“root\Default:StdRegProv”
}
Enumerate Keys
$ReturnedInfo=$RegProv.EnumKey($Hive,$RegKey)
Enumerate Values
$ReturnedInfo=$RegProv.EnumValues($Hive,$RegKey)
Create a Key
$ReturnedInfo=$RegProv.CreateKey($Hive,$RegKey)
Delete a Key
$ReturnedInfo=$RegProv.DeleteKey($Hive,$RegKey)
Write a Values
$ReturnedInfo=$RegProv.SetBinaryValue($Hive,$RegKey,$ValueName,$Value)
$ReturnedInfo=$RegProv.SetDWORDValue($Hive,$RegKey,$ValueName,$Value)
$ReturnedInfo=$RegProv.SetQWORDValue($Hive,$RegKey,$ValueName,$Value)
$ReturnedInfo=$RegProv.SetExpandedStringValue($Hive,$RegKey,$ValueName,$Value)
$ReturnedInfo=$RegProv.SetMultiStringValue($Hive,$RegKey,$ValueName,$Value)
$ReturnedInfo=$RegProv.SetStringValue($Hive,$RegKey,$ValueName,$Value)
Read Values
$ReturnedInfo=$RegProv.GetBinaryValue($Hive,$RegKey,$ValueName)
$ReturnedInfo=$RegProv.GetDWORDValue($Hive,$RegKey,$ValueName)
$ReturnedInfo=$RegProv.GetQWORDValue($Hive,$RegKey,$ValueName)
$ReturnedInfo=$RegProv.GetExpandedStringValue($Hive,$RegKey,$ValueName)
$ReturnedInfo=$RegProv.GetMultiStringValue($Hive,$RegKey,$ValueName)
$ReturnedInfo=$RegProv.GetStringValue($Hive,$RegKey,$ValueName)
Delete values
$ReturnedInfo=$RegProv.DeleteValue($Hive,$RegKey,$ValueName)
[/quote]
That was incredibly helpful.  Thank you.  I’m still having a little trouble.
My registry looks like this:
Obiwan
Kenobi
Plugin Objects
Agents
Luke
Vader
So, HKLM\Software\Obiwan\Kenobi\Plugin Objects\Agents will always be there. Â Â I need to go into every sub-key under Agents and retrieve one or two string values. Â I then need to only include, as done in a where-object command, specific string values that were retrieved.
Using your very helpful post, I’m able to enumerate the keys under Agents. Â They’re in the sNames property. Â I just am unable to figure out how to go further.
Any help, or example using my keys, would be a tremendous help.