PS> reg load HKLM\VHDSYS h:\windows\system32\config\system
The operation completed successfully.

If I perform a reg unload at this point everything works but if I access the registry – for instance

PS> ls hklm:

and then try and unload I get an error!

PS> reg unload HKLM\VHDSYS
ERROR: Access is denied.

One thing I found is that there is as reference to the remote hive in the variable collection

PS> ls variable:

Name                           Value
—-                           —–
$                              HKLM\VHDSYS

Empirically I’ve found that running these commands

ls env:
ls variable:

changes the value of the $ variable

You can then unload the hive

PS> reg unload HKLM\VHDSYS
The operation completed successfully.

Get-Item -Path HKLM:\SYSTEM\MountedDevices

returns data of this form

Name                           Property
—-                           ——–
MountedDevices                 \DosDevices\C: : {218, 187, 32, 142…}
                               \DosDevices\G: : {92, 0, 63, 0…}
                               \DosDevices\E: : {95, 0, 63, 0…}
                               \DosDevices\F: : {92, 0, 63, 0…}
                               \DosDevices\D: : {218, 187, 32, 142…}
                               \DosDevices\I: : {95, 0, 63, 0…}

We need to drill into the property but if we expand the property we will only get the name of the device. So we need to loop through those names

$data = @()            
Get-Item -Path HKLM:\SYSTEM\MountedDevices |            
select -ExpandProperty Property |            
where {$_ -like "\Dos*"} |             
foreach {            
 $name = $_            
$data += New-Object -TypeName psobject -Property @{            
  Device =  $name             
  Value  = (Get-ItemProperty -Path HKLM:\SYSTEM\MountedDevices -Name $name)."$name"            
 }            
            
}            
$data

To simplify the output is limited to Dos devices

Get-itemproperty returns the data with the name of the device as the property name so we need to drill in to get the value

http://msmvps.com/blogs/richardsiddaway/archive/2012/03/10/migrating-to-cim-doh.aspx

and its predecessors we saw how to enumerate registry sub-keys. But how do we read a registry value?

function get-CIMRegValue{             
[CmdletBinding(DefaultParameterSetName="UseComputer")]             
            
param (             
 [parameter(Mandatory=$true)]            
 [ValidateSet("HKCR", "HKCU", "HKLM", "HKUS", "HKCC")]            
 [string]$hive,            
            
 [parameter(Mandatory=$true)]            
 [string]$key,            
            
 [parameter(Mandatory=$true)]            
 [string]$value,            
            
 [parameter(Mandatory=$true)]            
 [string]            
 [Validateset("DWORD", "EXPANDSZ", "MULTISZ", "QWORD", "SZ")]            
 $type,            
            
  [parameter(ValueFromPipeline=$true,            
   ValueFromPipelineByPropertyName=$true)]            
 [parameter(ParameterSetName="UseComputer")]             
 [string]$computer="$env:COMPUTERNAME",            
             
 [parameter(ValueFromPipeline=$true,            
   ValueFromPipelineByPropertyName=$true)]            
 [parameter(ParameterSetName="UseCIMSession")]             
 [Microsoft.Management.Infrastructure.CimSession]$cimsession            
             
)             
BEGIN{}#begin             
PROCESS{            
            
switch ($hive){            
"HKCR" { [uint32]$hdkey = 2147483648} #HKEY_CLASSES_ROOT            
"HKCU" { [uint32]$hdkey = 2147483649} #HKEY_CURRENT_USER            
"HKLM" { [uint32]$hdkey = 2147483650} #HKEY_LOCAL_MACHINE            
"HKUS" { [uint32]$hdkey = 2147483651} #HKEY_USERS            
"HKCC" { [uint32]$hdkey = 2147483653} #HKEY_CURRENT_CONFIG            
}            
            
switch ($type) {            
"DWORD"     {$methodname = "GetDwordValue"}            
"EXPANDSZ"  {$methodname = "GetExpandedStringValue"}            
"MULTISZ"   {$methodname = "GetMultiStringValue"}            
"QWORD"     {$methodname = "GetQwordValue"}            
"SZ"        {$methodname = "GetStringValue"}            
}            
$arglist = @{hDefKey = $hdkey; sSubKeyName = $key; sValueName = $value}            
            
switch ($psCmdlet.ParameterSetName) {            
 "UseComputer"    {$result = Invoke-CimMethod -Namespace "root\cimv2" -ClassName StdRegProv -MethodName $methodname  -Arguments $arglist -ComputerName $computer}            
 "UseCIMSession"  {$result = Invoke-CimMethod -Namespace "root\cimv2" -ClassName StdRegProv -MethodName $methodname  -Arguments $arglist -CimSession $cimsession }            
 default {Write-Host "Error!!! Should not be here" }            
}            
            
switch ($type) {            
"DWORD"     {$result | select -ExpandProperty uValue}            
"EXPANDSZ"  {$result | select -ExpandProperty sValue}            
"MULTISZ"   {$result | select -ExpandProperty sValue}            
"QWORD"     {$result | select -ExpandProperty uValue}            
"SZ"        {$result | select -ExpandProperty sValue}            
}            
             
}#process             
END{}#end            
            
<# 
.SYNOPSIS
Displays a registry value

.DESCRIPTION
Displays a registry value using WSMAN or DCOM 
to access remote machines 

.PARAMETER  hive
Hive Name. One of "HKCR", "HKCU", "HKLM", "HKUS" or "HKCC"
The name is validated against the set

.PARAMETER  key
The registry key - without the hive name e.g.
"SYSTEM\CurrentControlSet\Services\BITS"

.PARAMETER value
The specific registry value to return for the 
given key

.PARAMETER  type
The type of registry value to return.
Must be one of
"DWORD", "EXPANDSZ", "MULTISZ", "QWORD", "SZ"

.PARAMETER  computer
Name of a remote computer. Connectivity will be by WSMAN.

.PARAMETER  cimsession
An object representing a cimsession. Connectivity is controlled 
by the CIM session and can be WSMAN or DCOM

.EXAMPLE                                                                                       
get-CIMRegValue -hive HKLM -key "SYSTEM\CurrentControlSet\services\BITS" -value DelayedAutoStart -type DWORD

.EXAMPLE
get-CIMRegValue -hive HKLM -key "SYSTEM\CurrentControlSet\services\BITS" -value ObjectName -type SZ  

.EXAMPLE
get-CIMRegValue -hive HKLM -key "SYSTEM\CurrentControlSet\services\BITS" -value DependOnService -type MULTISZ 

.EXAMPLE
get-CIMRegValue -hive HKLM -key "SYSTEM\CurrentControlSet\services\BITS" -value ImagePath -type EXPANDSZ

.EXAMPLE
get-CIMRegValue -hive HKLM -key "SYSTEM\CurrentControlSet\services\BITS" -value DelayedAutoStart -type DWORD -computer "."

.EXAMPLE
$cs = New-CimSession -ComputerName Win7test  
get-CIMRegValue -hive HKLM -key "SYSTEM\CurrentControlSet\services\BITS" -value DelayedAutoStart -type DWORD -cimsession $cs   

.EXAMPLE
$opt = New-CimSessionOption -Protocol Dcom                                                                                                          
$csd = New-CimSession -ComputerName server02 -SessionOption $opt                                                                                    
get-CIMRegValue -hive HKLM -key "SYSTEM\CurrentControlSet\services\BITS" -value DelayedAutoStart -type DWORD -cimsession $csd

.NOTES


.LINK

#>            
            
}

Parameters define the hive, key, value to be read and the type of value.

Registry values come in a number of types:

• DWORD and QWORD are 32 & 64 bit numbers
• SZ is a string
• EXPANDSZ is a string containing environmental variables that gets expanded
• MULTISZ is a multi-valued string

Parameters to define a computer name or CIM Session are also present

The numeric value for the hive is set in a switch statement. The data type is used to define the method name – each data type has its own method.

The argument list is populated and the method is invoked using a computer name or CIM session as appropriate

The results are decoded according to type.

Full help is provided on the function.

function set-regkeyowner {            
[CmdletBinding()]            
param (            
 [parameter(Mandatory=$true)]            
 [string]            
 [Validateset(“HKCR”, “HKCU”, “HKLM”, "HKUS", "HKCC")]            
  $hive,            
            
 [parameter(Mandatory=$true)]            
 [string]$key            
)              
PROCESS {             
Write-Verbose "Set Hive"            
switch ($hive){            
 “HKCR” {$reg = [Microsoft.Win32.Registry]::ClassesRoot}            
 “HKCU” {$reg = [Microsoft.Win32.Registry]::CurrentUser}            
 “HKLM” {$reg = [Microsoft.Win32.Registry]::LocalMachine}            
 "HKUS" {$reg = [Microsoft.Win32.Registry]::Users}            
 "HKCC" {$reg = [Microsoft.Win32.Registry]::CurrentConfig}            
}            
            
$permchk = [Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree            
$regrights = [System.Security.AccessControl.RegistryRights]::ChangePermissions            
            
Write-Verbose "Open Key and get access control"            
$regkey = $reg.OpenSubKey($key, $permchk, $regrights)            
$rs = $regkey.GetAccessControl()            
            
Write-Verbose "Create security principal"            
$user = New-Object -TypeName Security.Principal.NTaccount -ArgumentList "Administrators"            
            
$rs.SetGroup($user)             
$rs.SetOwner($user)             
$regkey.SetAccessControl($rs)            
}            
}

Take a hive and key as parameters. Use a switch to set the Registry enumeration and then set the permissions and rights we want. Open the key and get the access controls.

Create a security principal for the Administrators group and set the group and owner in the access control. Use SetAccessControl to change the permissions

Wireless LAN adapter Wireless Network Connection:

   Connection-specific DNS Suffix  . : tiscali.co.uk
   Link-local IPv6 Address . . . . . : fe80::6d95:b824:6a72:a0a9%11
   IPv4 Address. . . . . . . . . . . : 192.168.1.2
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.1.1

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::4547:ee51:7aac:521e%10
   IPv4 Address. . . . . . . . . . . : 10.10.54.202
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . :

Notice that the IPv6 addresses have a % sign followed by a number.  This is the device id of the network adapter

If we modify our get-IPAddress function to output the adapter’s deviceid (Index on Win32_NetworkAdapterConfiguration class)

function get-IPAddress {            
[CmdletBinding()]            
 param (            
  [string]$computer="$env:COMPUTERNAME"            
 )            
  Get-WmiObject -Class Win32_NetworkAdapterConfiguration -ComputerName $computer | where {$_.IPAddress} |             
  foreach {            
  $address = $_.IPAddress[1]            
              
  Write-Debug "Test for ::"            
  if ($_.IPAddress[1].Contains("::")){            
   $blocks = $_.IPAddress[1] -split ":"            
   $count = $blocks.Count            
   $replace = 8 - $count + 1            
   for ($i=0; $i -le $count-1; $i++){            
    if ($blocks[$i] -eq ""){            
      $blocks[$i] = ("0000:" * $replace).TrimEnd(":")            
    }            
   }            
   $address = $blocks -join ":"            
  }            
            
  Write-Debug "Check leading 0 in place"            
  $blocks = $address -split ":"            
  for ($i=0; $i -le $blocks.Count-1; $i++){            
    if ($blocks[$i].length -ne 4){            
      $blocks[$i] = $blocks[$i].Padleft(4,"0")            
    }            
   }            
   $address = $blocks -join ":"            
            
   $ipconfig = New-Object -TypeName PSObject -Property @{            
     Description = $($_.Description)            
     IPv4Address = $($_.IPAddress[0])            
     IPv4Subnet = $($_.IPSubnet[0])            
     IPv6Address = $address            
     IPv6Subnet = $($_.IPSubnet[1])            
     DeviceId =  $($_.Index)            
   } | select Description, IPv4Address, IPv4Subnet, IPv6Address, IPv6Subnet, DeviceId            
   $ipconfig             
  }              
}

we get this output

PS> get-IPAddress

Description : NVIDIA nForce 10/100/1000 Mbps Networking Controller

IPv4Address : 10.10.54.202

DeviceId    : 7

Description : Atheros AR5007 802.11b/g WiFi Adapter

IPv4Address : 192.168.1.2

DeviceId    : 11

These device ids don’t match – whats going on.

If we use the MSNdis_EnumerateAdapter and MSNdis_EnumerateAdapterEX classes as in this function from http://msmvps.com/blogs/richardsiddaway/archive/2011/08/25/network-adapter-details.aspx

We can get the adapter details stored in the registry which uses a different set of indexes!!!

function get-adapter {            
param(            
 [string]$computer="."            
)            
Get-WmiObject -Namespace root\wmi -Class MSNdis_EnumerateAdapter `
-ComputerName $computer |            
foreach {            
 $nic = Get-WmiObject -Namespace root\wmi -Class MSNdis_EnumerateAdapterEx `
-ComputerName $computer -Filter "InstanceName = '$($_.InstanceName)'"            
            
$header = $nic.EnumerateAdapter.Header            
            
 New-Object -TypeName PSobject -Property @{            
  Computer = $_.__SERVER            
  Adapter = $_.InstanceName            
  Device = $_.DeviceName            
  Active = $_.Active            
  Index = $($nic.EnumerateAdapter.IfIndex)            
  NetLuid = $($nic.EnumerateAdapter.NetLuid)            
  Revision = $header.Revision            
  Size = $header.Size            
  Type = $header.Type            
 }            
}            
}

get-adapter | sort Index | Format-Table adapter, Index –AutoSize

produces (truncated output of)

Adapter                                               Index

——-                                               —–

Atheros AR5007 802.11b/g WiFi Adapter                    11

which matches the ipconfig results of

Ethernet adapter Local Area Connection:

Link-local IPv6 Address . . . . . : fe80::4547:ee51:7aac:521e%10

Wireless LAN adapter Wireless Network Connection:

   Link-local IPv6 Address . . . . . : fe80::6d95:b824:6a72:a0a9%11

We can test the relationship between the registry and WMI device Ids

function resolve-deviceID {            
[CmdletBinding()]            
 param (            
  [string]$computer="$env:COMPUTERNAME"            
 )            
  Get-WmiObject -Class Win32_NetworkAdapterConfiguration -ComputerName $computer |             
  where {$_.IPAddress} |             
  foreach {            
   $nic = Get-WmiObject -Namespace root\wmi -Class MSNdis_EnumerateAdapterEx `
  -ComputerName $computer -Filter "InstanceName = '$($_.Description)'"            
               
   New-Object -TypeName PSObject -Property @{            
    Name = $($_.Description)            
    WMI_Index = $($_.Index)            
    Reg_Index = $($nic.EnumerateAdapter.IfIndex)            
   }             
 }            
}

Which produces this out put

PS> resolve-deviceid | ft -a

Name                                                  Reg_Index WMI_Index

—-                                                  ——— ———

Active Directory synchronises the computer clock times. To know what server is being used

function get-timeserver{             
[CmdletBinding(SupportsShouldProcess=$true)]             
param (             
[parameter(Position=0,            
   Mandatory=$true,            
   ValueFromPipeline=$true,             
   ValueFromPipelineByPropertyName=$true)]            
   [string]$computer             
)             
BEGIN{            
 $HKLM = 2147483650            
}#begin             
            
PROCESS{            
 $reg = [wmiclass]"\\$computer\root\default:StdRegprov"            
            
 $key = "SYSTEM\CurrentControlSet\Services\W32Time\Parameters"            
             
 switch ($computer){            
   "."         {$computername = $env:COMPUTERNAME}            
   "localhost" {$computername = $env:COMPUTERNAME}            
   default     {$computername = $computer}            
 }            
             
 $value = "NtpServer"            
 $server = $reg.GetStringValue($HKLM, $key, $value)  ## REG_SZ            
 $server.sValue -split ","            
              
}#process             
END{}#end            
            
}

Read the "SYSTEM\CurrentControlSet\Services\W32Time\Parameters" key for the Ntpserver value.  Its a string so use GetstringValue(). It is possible to define multiple time servers so split the string on “,”

Ignore the final value of 0×9

One point I didn’t cover in my series on working with the registry was how to get the type of a registry value.

The easiest way is to use the EnumValues() method.  This returns integer values for the type.

Define a hash table that contains the integer and its meaning. Define the hive and the key. Create an instance of StdRegProv and invoke the EnumValues method. Loop through the returned values and use a formatted string to display the results

The slides and the demo script are available from

http://cid-43cfa46a74cf3e96.office.live.com/browse.aspx/PowerShell%20User%20Group/2010%20July

The recording is available

Richard Siddaway has invited you to view a Microsoft Office Live Meeting recording.
View Recording
Recording Details
    Subject: PowerShell and the Registry
    Recording URL: https://www.livemeeting.com/cc/usergroups/view
    Recording ID: CB99JS
    Attendee Key: mm$2!",$G

Full details from

http://msmvps.com/blogs/richardsiddaway/archive/2010/07/20/july-2010-ug-meeting-registry.aspx