- Article
This sample only applies to Windows platforms.
Because registry keys are items on PowerShell drives, working with them is very similar to workingwith files and folders. One critical difference is that every item on a registry-based PowerShelldrive is a container, just like a folder on a file system drive. However, registry entries and theirassociated values are properties of the items, not distinct items.
Listing all subkeys of a registry key
You can show all items directly within a registry key using Get-ChildItem
. Add the optionalForce parameter to display hidden or system items. For example, this command displays the itemsdirectly within PowerShell drive HKCU:
, which corresponds to the HKEY_CURRENT_USER
registryhive:
Get-ChildItem -Path HKCU:\ | Select-Object Name
Hive: Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USERName----HKEY_CURRENT_USER\AppEventsHKEY_CURRENT_USER\ConsoleHKEY_CURRENT_USER\Control PanelHKEY_CURRENT_USER\DirectShowHKEY_CURRENT_USER\dummyHKEY_CURRENT_USER\EnvironmentHKEY_CURRENT_USER\EUDCHKEY_CURRENT_USER\Keyboard LayoutHKEY_CURRENT_USER\MediaFoundationHKEY_CURRENT_USER\MicrosoftHKEY_CURRENT_USER\NetworkHKEY_CURRENT_USER\PrintersHKEY_CURRENT_USER\SoftwareHKEY_CURRENT_USER\SystemHKEY_CURRENT_USER\UninstallHKEY_CURRENT_USER\WXPHKEY_CURRENT_USER\Volatile Environment
These are the top-level keys visible under HKEY_CURRENT_USER
in the Registry Editor(regedit.exe
).
You can also specify this registry path by specifying the registry provider's name, followed by::
. The registry provider's full name is Microsoft.PowerShell.Core\Registry
, but this can beshortened to just Registry
. Any of the following commands will list the contents directly underHKCU:
.
Get-ChildItem -Path Registry::HKEY_CURRENT_USERGet-ChildItem -Path Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USERGet-ChildItem -Path Registry::HKCUGet-ChildItem -Path Microsoft.PowerShell.Core\Registry::HKCUGet-ChildItem HKCU:
These commands list only the directly contained items, much like using DIR
in cmd.exe
or ls
in a UNIX shell. To show contained items, you need to specify the Recurse parameter. To list allregistry keys in HKCU:
, use the following command.
Get-ChildItem -Path HKCU:\ -Recurse
Get-ChildItem
can perform complex filtering capabilities through its Path, Filter,Include, and Exclude parameters, but those parameters are typically based only on name. Youcan perform complex filtering based on other properties of items using the Where-Object
cmdlet.The following command finds all keys within HKCU:\Software
that have no more than one subkey andalso have exactly four values:
Get-ChildItem -Path HKCU:\Software -Recurse | Where-Object {($_.SubKeyCount -le 1) -and ($_.ValueCount -eq 4) }
Copying keys
Copying is done with Copy-Item
. The following example copies the CurrentVersion
subkey ofHKLM:\SOFTWARE\Microsoft\Windows\
and all of its properties to HKCU:\
.
Copy-Item -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion' -Destination HKCU:
If you examine this new key in the registry editor or using Get-ChildItem
, you notice that youdon't have copies of the contained subkeys in the new location. In order to copy all of the contentsof a container, you need to specify the Recurse parameter. To make the preceding copy commandrecursive, you would use this command:
Copy-Item -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion' -Destination HKCU: -Recurse
You can still use other tools you already have available to perform filesystem copies. Any registryediting tools—including reg.exe
, regini.exe
, regedit.exe
, and COM objects that supportregistry editing, such as WScript.Shell and WMI's StdRegProv class can be used from withinPowerShell.
Creating keys
Creating new keys in the registry is simpler than creating a new item in a file system. Because allregistry keys are containers, you don't need to specify the item type. Just provide an explicitpath, such as:
New-Item -Path HKCU:\Software_DeleteMe
You can also use a provider-based path to specify a key:
New-Item -Path Registry::HKCU\Software_DeleteMe
Deleting keys
Deleting items is essentially the same for all providers. The following commands silently removeitems:
Remove-Item -Path HKCU:\Software_DeleteMeRemove-Item -Path 'HKCU:\key with spaces in the name'
Removing all keys under a specific key
You can remove contained items using Remove-Item
, but you will be prompted to confirm the removalif the item contains anything else. For example, if we attempt to delete the HKCU:\CurrentVersion
subkey we created, we see this:
Remove-Item -Path HKCU:\CurrentVersion
ConfirmThe item at HKCU:\CurrentVersion\AdminDebug has children and the -recurseparameter was not specified. If you continue, all children will be removed withthe item. Are you sure you want to continue?[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"):
To delete contained items without prompting, specify the Recurse parameter:
Remove-Item -Path HKCU:\CurrentVersion -Recurse
If you wanted to remove all items within HKCU:\CurrentVersion
but not HKCU:\CurrentVersion
itself, you could instead use:
Remove-Item -Path HKCU:\CurrentVersion\* -Recurse