- Article
This sample only applies to Windows platforms.
Because registry entries are properties of keys and, as such, can't be directly browsed, we need totake a slightly different approach when working with them.
Listing registry entries
There are many different ways to examine registry entries. The simplest way is to get the propertynames associated with a key. For example, to see the names of the entries in the registry keyHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
, use Get-Item
. Registry keys have aproperty with the generic name of "Property" that's a list of registry entries in the key. Thefollowing command selects the Property property and expands the items so that they're displayed in alist:
Get-Item -Path Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion | Select-Object -ExpandProperty Property
DevicePathMediaPathUnexpandedProgramFilesDirCommonFilesDirProductId
To view the registry entries in a more readable form, use Get-ItemProperty
:
Get-ItemProperty -Path Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
ProgramFilesDir : C:\Program FilesCommonFilesDir : C:\Program Files\Common FilesProgramFilesDir (x86) : C:\Program Files (x86)CommonFilesDir (x86) : C:\Program Files (x86)\Common FilesCommonW6432Dir : C:\Program Files\Common FilesDevicePath : C:\WINDOWS\infMediaPathUnexpanded : C:\WINDOWS\MediaProgramFilesPath : C:\Program FilesProgramW6432Dir : C:\Program FilesSM_ConfigureProgramsName : Set Program Access and DefaultsSM_GamesName : GamesPSPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWA RE\Microsoft\Windows\CurrentVersionPSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWA RE\Microsoft\WindowsPSChildName : CurrentVersionPSDrive : HKLMPSProvider : Microsoft.PowerShell.Core\Registry
The Windows PowerShell-related properties for the key are all prefixed with "PS", such asPSPath, PSParentPath, PSChildName, and PSProvider.
You can use the *.*
notation for referring to the current location. You can use Set-Location
tochange to the CurrentVersion registry container first:
Set-Location -Path Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
Alternatively, you can use the built-in HKLM:
PSDrive with Set-Location
:
Set-Location -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion
You can then use the .
notation for the current location to list the properties withoutspecifying a full path:
Get-ItemProperty -Path .
...DevicePath : C:\WINDOWS\infMediaPathUnexpanded : C:\WINDOWS\MediaProgramFilesDir : C:\Program Files...
Path expansion works the same as it does within the filesystem, so from this location you can getthe ItemProperty listing for HKLM:\SOFTWARE\Microsoft\Windows\Help
usingGet-ItemProperty -Path ..\Help
.
Getting a single registry entry
If you want to retrieve a specific entry in a registry key, you can use one of several possibleapproaches. This example finds the value of DevicePath inHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
.
Using Get-ItemProperty
, use the Path parameter to specify the name of the key, and theName parameter to specify the name of the DevicePath entry.
Get-ItemProperty -Path HKLM:\Software\Microsoft\Windows\CurrentVersion -Name DevicePath
DevicePath : C:\WINDOWS\infPSPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersionPSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsPSChildName : CurrentVersionPSDrive : HKLMPSProvider : Microsoft.PowerShell.Core\Registry
This command returns the standard Windows PowerShell properties as well as the DevicePathproperty.
Note
Although Get-ItemProperty
has Filter, Include, and Exclude parameters, they can'tbe used to filter by property name. These parameters refer to registry keys, which are itempaths and not registry entries, which are item properties.
Another option is to use the reg.exe
command line tool. For help with reg.exe
, type reg.exe /?
at a command prompt. To find the DevicePath entry, use reg.exe
as shown in the followingcommand:
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion /v DevicePath
! REG.EXE VERSION 3.0HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion DevicePath REG_EXPAND_SZ %SystemRoot%\inf
You can also use the WshShell COM object to find some registry entries, although this methoddoesn't work with large binary data or with registry entry names that include characters such asbackslash (\
). Append the property name to the item path with a \
separator:
(New-Object -ComObject WScript.Shell).RegRead("HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DevicePath")
%SystemRoot%\inf
Setting a single registry entry
If you want to change a specific entry in a registry key, you can use one of several possibleapproaches. This example modifies the Path entry under HKEY_CURRENT_USER\Environment
. ThePath entry specifies where to find executable files.
- Retrieve the current value of the Path entry using
Get-ItemProperty
. - Add the new value, separating it with a
;
. - Use
Set-ItemProperty
with the specified key, entry name, and value to modify the registryentry.
$value = Get-ItemProperty -Path HKCU:\Environment -Name Path$newpath = $value.Path += ";C:\src\bin\"Set-ItemProperty -Path HKCU:\Environment -Name Path -Value $newpath
Note
Although Set-ItemProperty
has Filter, Include, and Exclude parameters, theycan't be used to filter by property name. These parameters refer to registry keys—which are itempaths—and not registry entries—which are item properties.
Another option is to use the Reg.exe command line tool. For help with reg.exe, type reg.exe /?
ata command prompt.
The following example changes the Path entry by removing the path added in the example above.Get-ItemProperty
is still used to retrieve the current value to avoid having to parse the stringreturned from reg query
. The SubString and LastIndexOf methods are used to retrieve thelast path added to the Path entry.
$value = Get-ItemProperty -Path HKCU:\Environment -Name Path$newpath = $value.Path.SubString(0, $value.Path.LastIndexOf(';'))reg add HKCU\Environment /v Path /d $newpath /f
The operation completed successfully.
Creating new registry entries
To add a new entry named "PowerShellPath" to the CurrentVersion key, use New-ItemProperty
withthe path to the key, the entry name, and the value of the entry. For this example, we will take thevalue of the Windows PowerShell variable $PSHome
, which stores the path to the installationdirectory for Windows PowerShell.
You can add the new entry to the key using the following command, and the command also returnsinformation about the new entry:
New-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion -Name PowerShellPath -PropertyType String -Value $PSHome
PSPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersionPSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsPSChildName : CurrentVersionPSDrive : HKLMPSProvider : Microsoft.PowerShell.Core\RegistryPowerShellPath : C:\Program Files\Windows PowerShell\v1.0
The PropertyType must be the name of a Microsoft.Win32.RegistryValueKind enumeration memberfrom the following table:
PropertyType Value | Meaning |
---|---|
Binary | Binary data |
DWord | A number that's a valid UInt32 |
ExpandString | A string that can contain environment variables that are dynamically expanded |
MultiString | A multiline string |
String | Any string value |
QWord | 8 bytes of binary data |
You can add a registry entry to multiple locations by specifying an array of values for the Pathparameter:
New-ItemProperty -Name PowerShellPath -PropertyType String -Value $PSHome ` -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion, HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion
You can also overwrite a pre-existing registry entry value by adding the Force parameter to anyNew-ItemProperty
command.
Renaming registry entries
To rename the PowerShellPath entry to "PSHome," use Rename-ItemProperty
:
Rename-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion -Name PowerShellPath -NewName PSHome
To display the renamed value, add the PassThru parameter to the command.
Rename-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion -Name PowerShellPath -NewName PSHome -passthru
Deleting registry entries
To delete both the PSHome and PowerShellPath registry entries, use Remove-ItemProperty
:
Remove-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion -Name PSHomeRemove-ItemProperty -Path HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion -Name PowerShellPath