Windows OS Hub / PowerShell / PowerShell: Get, Modify, Create, and Remove Registry Keys or Parameters
What is Windows Registry?
Let’s get our basics straight before diving in. The Windows Registry is the nerve center of your Windows operating system and the apps that call it home. It’s a database storing vital configuration info.
Meddling in the Registry without care is like juggling chainsaws — thrilling but risky!
The Registry is a maze of keys within keys, storing values with specific data types. It’s a flexible repository for system and application settings, organized into ‘hives’ — logical groupings that Windows loads during startup.
Remember the days when editing the Registry was a daredevil’s game, done through regedit.exe?
Windows NT changed the game with the reg.exe command, ushering in safer programmatic management. And let’s not forget WMI (Windows Management Instrumentation), another powerful tool for Registry wrangling.
How to Set a Registry Key with PowerShell
For IT professionals working with PowerShell, life got easier with the introduction of the Registry provider. This nifty tool simplifies Registry tasks, transforming complex chores into a walk in the park.
PowerShell could have gone the route of creating a zillion cmdlets for every data store — Registry, files, certificates, you name it.
But instead, it introduced providers, an intermediary layer that turns these data stores into something akin to a file store. You can use familiar commands across different data types, thanks to these providers.
Curious about available providers? Run the `Get-PSProvider` cmdlet. It’ll introduce you to:
- Registry: This provider deals with the Windows Registry, offering access to keys like HKLM (local machine) and HKCU (current user).
- Alias, Environment, and Function: These providers handle aliases, environment variables, and functions.
- FileSystem: This one’s for managing files and folders.
- Certificate: For working with certificates.
Registry Value Entries: The Building Blocks
Let’s explore Registry Value Entries and how they play a role in PowerShell scripting.
Think of Registry Value Entries as attributes of registry keys. PowerShell’s *-ItemProperty cmdlets are your tools for managing these.
Here’s how you can use them in real-world scenarios:
Scenario 1
Imagine creating a “Version” registry value under the key “HKCU:\Software\Test\MyKey” with a value of “12“.
You might be tempted to use the `New-ItemProperty` cmdlet like this:
$RegistryPath = 'HKCU:\Software\Test\MyKey’ $Name = 'Version' $Value = ‘12’ New-ItemProperty -Path $RegistryPath -Name $Name -Value $Value -PropertyType DWORD -Force
But if “HKCU:\Software\Test\MyKey” doesn’t exist, you’ll hit an error.
To avoid this, use Test-Path to check for the key’s existence, and New-Item to create it if needed:
New-ItemProperty : Cannot find path 'HKCU:\Software\Test\MyKey' because it does not exist.
To address this issue more gracefully, you can take a safer approach:
# Set variables to indicate value and key to set
$RegistryPath = 'HKCU:\Software\Test\MyKey’
$Name = 'Version'
$Value = '12'
# Create the key if it does not exist
If (-NOT (Test-Path $RegistryPath)) { New-Item -Path $RegistryPath -Force | Out-Null
}
# Now set the value
New-ItemProperty -Path $RegistryPath -Name $Name -Value $Value -PropertyType DWORD -ForceThis modified script first checks whether the registry key exists using `Test-Path`. If it doesn’t exist, it creates the key using `New-Item`. This way, you ensure that the required registry structure is in place before setting the value entry.
If we know that the registry key value already exists and we want to modify the value, we can use the `Set-ItemProperty` cmdlet. Think of each Registry Value Entry as an attribute of a particular registry key.
Scenario 2
Imagine you have a scenario where you want to update an existing registry value entry called “Version” under the key “HKCU:\Software\CommunityBlog\Scripts” with a new value, let’s say “13.”
You can achieve this using the `Set-ItemProperty` cmdlet. Here’s an example of how you can do it:
# Define the registry path and property name $RegistryPath = 'HKCU:\Software\Test\MyKey’ $PropertyName = 'Version' # Specify the new value $NewValue = '13' # Use Set-ItemProperty to update the registry value Set-ItemProperty -Path $RegistryPath -Name $PropertyName -Value $NewValue
By running this script, you can effectively change the “Version” value in the specified registry key to “13.”
This demonstrates how `Set-ItemProperty` can be a valuable tool for managing and updating registry values within your PowerShell scripts.
Tinkering with the registry, whether through the Registry Editor or PowerShell commands, can have serious consequences if done improperly.
Always exercise caution, back up critical data, and be certain of the changes you’re making. The power of the registry comes with the responsibility to use it wisely!
Set a registry key with PowerShell App Deployment Toolkit
Now, for the IT pros responsible for getting software up and running on a bunch of Windows computers. Sometimes, you need to tweak things behind the scenes to make sure the software behaves just right. That’s where the `Set-RegistryKey` function steps in.
This custom cmdlet makes it much easier to work with registry keys as opposed to the example we just had a look above. With this you don’t need to worry about additional checks in the registry by using Test-Path cmdlet.
This handy tool lets you tinker with the Windows Registry, a database that holds all sorts of settings for your operating system and applications. With `Set-RegistryKey`, you can make changes, create new settings, or fine-tune existing ones to match your needs.
Picture this: you’re deploying a new app, and it’s got a particular setting that needs to be just so. You can use `Set-RegistryKey` to make sure that setting is dialed in perfectly on all the computers you’re working with. No need to manually mess around in the Registry – it’s all automated.
Here’s a quick example of how you might use it:
Let’s say you’re deploying a new application, and it needs a specific registry setting to work correctly. You can use `Set-RegistryKey` to create that setting and make sure it’s set to the right value. No fuss, no manual Registry editing – it’s all taken care of.
# Set a registry value to configure application behavior Set-RegistryKey -Key 'HKLM\Software\YourApplication' -Name 'SettingName' -Value 'DesiredValue' # Create a new registry key if it doesn't exist Set-RegistryKey -Key 'HKLM\Software\YourApplication\NewKey' # Modify an existing registry value Set-RegistryKey -Key 'HKCU\Software\YourApplication' -Name 'ExistingSetting' -Value 'UpdatedValue'
Conclusion
In essence, the Set-RegistryKey cmdlet in the PowerShell Application Deployment Toolkit is your secret weapon for smooth software deployments. It’s like having a magic wand for the Windows Registry, ensuring your software runs seamlessly on every computer.
Alex Marin
Application Packaging and SCCM Deployments specialist, solutions finder, Technical Writer at Advanced Installer.
Popular Articles
Creating a Registry Value Using PowerShell
New-ItemProperty -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\MyApplication" -Name "Version" -Value "1.0"
Similarly, to create DWord or QWord values, use the “PropertyType” parameter.
New-ItemProperty -Path "HKLM:\SOFTWARE\MyApp" -Name "Enabled" -Value "1" -PropertyType DWord
Checking if a Registry Value Exists
$Value = Get-ItemProperty -Path 'HKLM:\SOFTWARE\MyApp' -Name 'Version' -ErrorAction SilentlyContinue
If ($value) { # Value exists Write-host -f Green $Value.Version
}
else { # Value does not exist Write-host -f Yellow "Value doesn't Exists!"
}In this example, we use the Get-ItemProperty cmdlet to retrieve the value of the specified registry value name. If the value exists, it will be assigned to the $value variable, allowing you to perform actions accordingly. Here is another version to check if a specific value exists in a given key in the particular hive:
$RegPath = "HKLM:\SOFTWARE\MyApp"
$RegValue = "Version"
$RegistryKey = Get-Item -Path $RegPath -ErrorAction SilentlyContinue
if ($RegistryKey.GetValueNames() -contains $RegValue) { # Value exists Write-host -f Green "Value Exists!"
}
else { # Value does not exist Write-host -f Yellow "Value Doesn't Exists!"
}Navigate the Windows Registry Like a File System with PowerShell
Working with the registry in PowerShell is similar to working with common files on a local disk. The main difference is that in this concept the registry keys are analogous to files, and the registry parameters are the properties of these files.
Display the list of available drives on your computer:
cd HKLM:\
Dir -ErrorAction SilentlyContinue
Those, you can access the registry key and their parameters using the same PowerShell cmdlets that you use to manage files and folders.
To refer to registry keys, use cmdlets with xxx-Item:
Get-Item– get a registry keyNew-Item— create a new registry keyRemove-Item– delete a registry key
Registry parameters should be considered as properties of the registry key (similar to file/folder properties). The xxx-ItemProperty cmdlets are used to manage registry parameters:
Get-ItemProperty– get the value of a registry parameterSet-ItemProperty– change the value of a registry parameterNew-ItemProperty– create registry parameterRename-ItemProperty– rename parameterRemove-ItemProperty— remove the registry parameter
You can navigate to the specific registry key (for example, to the one responsible for the settings of automatic driver updates) using one of two commands:
cd HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverSearching
or
Set-Location -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverSearching
Deleting a Registry Key Using PowerShell
Removing unnecessary or obsolete registry keys is essential for maintaining a clean and optimized system. PowerShell provides the Remove-Item cmdlet to delete a specific registry key. By specifying the path of the key, PowerShell will remove the key and all its subkeys and values.
Remove-Item -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\MyApplication" -Recurse
Query a Registry Key Using PowerShell
Retrieving the value of a registry key is often necessary for troubleshooting or verification purposes. PowerShell offers the Get-ItemProperty cmdlet to retrieve the value of a specific registry key. You can also specify the path of the key and the name of the value, PowerShell will return the corresponding value data.
Get-ItemProperty -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\MyApp"
Similarly, to get all subkeys of a specific registry key, use:
Get-ChildItem -Path "HKLM:\SOFTWARE\MyApp" -Recurse | Select PSPath, PSChildName
This command retrieves a list of subkeys in the specified Registry key.
You can also search for a specific key and filter using the registry provider and Get-ChildItem cmdlet:
CD HKCU:\SOFTWARE Get-ChildItem -Recurse -Path . | Where-Object -Property Name -Like '*Browser*' | Select-Object -Property PSPath
This script searches for a specific key in the particular registry hives using the wildcard “*browser*” on the given path.
Enumerating subkeys of a registry key
Here is the PowerShell script to enumerate the subkeys of a registry key:
$key = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer"
$subkeys = Get-ChildItem -Path $key
foreach ($subkey in $subkeys) { Write-Output "Subkey: $($subkey.Name)"
}Deleting a Registry Value Using PowerShell
In addition to deleting keys, PowerShell also provides the ability to delete specific registry values. The Remove-ItemProperty cmdlet removes a specific registry value by specifying the path of the key and the name of the value. PowerShell will then delete the value from the registry.
Remove-ItemProperty -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\MyApplication" -Name "Version"
Updating the Value of a Registry Key Using PowerShell
Modifying the value of a registry key is a common task in Windows Registry management. PowerShell provides the Set-ItemProperty cmdlet to change the value of a specific registry key. By specifying the path of the key, the name of the value, and the new value data, PowerShell will update the value accordingly.
Set-ItemProperty -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\MyApplication" -Name "Version" -Value "2.0"
Deleting a Registry Key or Parameter
The Remove-ItemProperty command is used to remove a parameter in the registry key. Let’s remove the parameter SuperParamString created earlier:
$HKCU_Desktop= "HKCU:\Control Panel\Desktop"
Remove-ItemProperty –Path $HKCU_Desktop\NewKey –Name "SuperParamString"
You can delete the entire registry key with all its contents:
Remove-Item –Path $HKCU_Desktop\NewKey –Recurse
Note. –Recurse switch indicates that all subkeys have to be removed recursively.
To remove all items in the reg key (but not the key itself):
Remove-Item –Path $HKCU_Desktop\NewKey\* –Recurse
How to Rename a Registry Key or a Parameter?
You can rename the registry parameter with the command:
Rename-ItemProperty –path ‘HKCU:\Control Panel\Desktop\NewKey’ –name "SuperParamString" –newname “OldParamString”
In the same way, you can rename the registry key:
Rename-Item -path 'HKCU:\Control Panel\Desktop\NewKey' OldKey
Setting Registry Key Permissions with PowerShell
You can get the current registry key permissions using the Get-ACL cmdlet.
$rights = Get-Acl -Path 'HKCU:\Control Panel\Desktop\NewKey'
$rights.Access.IdentityReference
Get current permissions:
$rights = Get-Acl -Path 'HKCU:\Control Panel\Desktop\NewKey'
Select access level:
Access type (Allow/Deny):
$rule = New-Object System.Security.AccessControl.RegistryAccessRule ($idRef, $regRights, $inhFlags, $prFlags, $acType)
Add a new rule to the current ACL:
Apply new permissions to the registry key:
Make sure the new group appears in the ACL of the registry key.
How to Create a New Register Key or Parameter with PowerShell?
To create a new registry key, use the New-Item command. Let’s create a new key with the name NewKey:
$HKCU_Desktop= "HKCU:\Control Panel\Desktop"
New-Item –Path $HKCU_Desktop –Name NewKey
Now let’s create a new parameter in a new registry key. Suppose we need to create a new string parameter of type REG_SZ named SuperParamString and value filetmp1.txt:
New-ItemProperty -Path $HKCU_Desktop\NewKey -Name "SuperParamString" -Value ”filetmp1.txt” -PropertyType "String"
- String (REG_SZ)
- ExpandString (REG_EXPAND_SZ)
- MultiString (REG_MULTI_SZ)
- Binary (REG_BINARY)
- DWord (REG_DWORD)
- Qword (REG_QWORD)
- Unknown (unsupported registry data type)
Make sure that the new key and parameter have appeared in the registry.
How to check if a registry key exists?
If you need to check if a specific registry key exists, use the Test-Path cmdlet:
Test-Path 'HKCU:\Control Panel\Desktop\NewKey'
Using the Copy-Item cmdlet, you can copy entries from one registry key to another:
$source='HKLM:\SOFTWARE\7-zip\'
$dest = 'HKLM:\SOFTWARE\backup'
Copy-Item -Path $source -Destination $dest -Recurse
If you want to copy everything, including subkeys, add the –Recurse switch.
Creating a Registry Key Using PowerShell
Creating a new registry key using PowerShell is a straightforward process. The New-Item cmdlet is used to create a new registry key by specifying the path of the key as the argument. PowerShell will then create the key if it does not already exist. This is particularly useful when deploying software or configuring system settings that require the creation of specific registry keys.
New-Item -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\MyApplication"
Checking if a Registry Key Exists Using PowerShell
One common task in Windows Registry management is checking if a specific registry key exists. This can be easily accomplished using PowerShell. The Test-Path cmdlet determines if a path, including a registry key path, exists. By specifying the registry path as the argument, PowerShell will return a boolean value indicating whether the key exists. This information can be used in conditional statements or as part of a larger script to perform further actions.
$Key = "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\MyApp"
If(Test-Path -Path "Registry::$Key") { Write-host -f Green "Key Exists!"
}
Else { Write-host -f Yellow "Key doesn't Exists!"
}Getting a Registry Value from a Remote Computer via PowerShell
PowerShell allows you to access the registry of a remote computer. You can connect to a remote computer either using WinRM (Invoke-Command or Enter-PSSession). To get the value of a registry parameter from a remote computer:
Or using a remote registry connection (the RemoteRegistry service must be enabled)
Tip. If you have to create/modify a certain registry parameter on multiple domain computers, it is easier to use GPO features.
So we’ve covered typical examples of using PowerShell to access and manage Windows registry entries. You can use them in your automation scripts.
Renaming a Registry Key Value Name in PowerShell
Rename-ItemProperty -Path "HKLM:\SOFTWARE\MyApp" -Name "Enabled" -NewName "IsEnabled"
This command renames the “Enabled” key value to “IsEnabled” in the HKEY_LOCAL_MACHINE\SOFTWARE\MyApp Registry key.
Deleting a Registry Key if it Exists Using PowerShell
Deleting a registry key only if it exists is a common scenario in scripting and automation. PowerShell allows for conditional deletion using the Test-Path cmdlet in conjunction with the Remove-Item cmdlet. By checking if the key exists and then deleting it, PowerShell ensures that only existing keys are removed.
if (Test-Path -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\MyApplication") { Remove-Item -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\MyApplication" -Recurse
}
else { Write-host "The Specified Registry Key doesn't exists!"
}Exporting a Registry Key Using PowerShell
We have the Reg Export built-in command to export and import the specific keys and values to a file, which can then be stored in a secure location for future use.
$RegPath = "HKLM\SOFTWARE\MyApp" # registry key to export $ExportPath = "C:\Temp\export.reg" # path to the .reg file # Export Registry Key and Values Reg export $RegPath $ExportPath
Similarly, to restore the registry backup, use:
Reg import "C:\Temp\export.reg"
Get a Registry Parameter Value via PowerShell
Please note that the parameters stored in the registry key are not nested objects, but a property of a specific registry key. Those any registry key can have any number of parameters.
List the contents of the current registry key using the command:
The command has displayed information about the nested registry keys and their properties. But didn’t display information about the SearchOrderConfig parameter, which is a property of the current key.
Use the Get-Item cmdlet to get the parameters of the registry key:
Get-Item .
Or
Get-Item –Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverSearching
As you can see, the DriverSearching key has only one parameter – SearchOrderConfig with a value of 1.
To get the value of a registry key parameter, use the Get-ItemProperty cmdlet.
$DriverUpdate = Get-ItemProperty –Path ‘HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverSearching’
$DriverUpdate.SearchOrderConfig
We got that the value of the SearchOrderConfig parameter is 1.
Table of contents
- Understanding the Windows Registry
- Benefits of Using PowerShell for Registry Management
- Creating a Registry Key Using PowerShell
- Creating a Registry Value Using PowerShell
- Renaming a Registry Key Value Name in PowerShell
- Updating the Value of a Registry Key Using PowerShell
- Query a Registry Key Using PowerShell
- Get Registry Key Value Using PowerShell
- Deleting a Registry Value Using PowerShell
- Deleting a Registry Key Using PowerShell
- Deleting a Registry Key if it Exists Using PowerShell
- Exporting a Registry Key Using PowerShell
Get Registry Key Value Using PowerShell
Querying a registry key allows you to check if a specific value exists within the key. PowerShell provides the Get-ItemPropertyValue cmdlet to query a reg key and retrieve the value of a specific value name. Specify the path of the key and the value of the key using the name parameter; PowerShell will return the corresponding value data if it exists.
Get-ItemPropertyValue -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\MyApplication" -Name "Version"
# Get registry value powershell $key = "HKCU:\Software\MyNewKey" $value = "MyValueName" $data = Get-ItemProperty -Path $key -Name $value Write-Output "The value of $value is: $($data.$value)"
To get all the values from a particular key, You can use PowerShell as:
CD HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion Get-ItemProperty .
ProgramFilesDir : C:\Program Files CommonFilesDir : C:\Program Files\Common Files ProgramFilesDir (x86) : C:\Program Files (x86) CommonFilesDir (x86) : C:\Program Files (x86)\Common Files CommonW6432Dir : C:\Program Files\Common Files DevicePath : C:\WINDOWS\inf;C:\Program Files (x86)\Samsung\ MediaPathUnexpanded : C:\WINDOWS\Media ProgramFilesPath : C:\Program Files ProgramW6432Dir : C:\Program Files SM_ConfigureProgramsName : Set Program Access and Defaults SM_GamesName : Games PSPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows PSChildName : CurrentVersion PSDrive : HKLM PSProvider : Microsoft.PowerShell.Core\Registry
Understanding the Windows Registry
Before delving into PowerShell techniques for managing the Windows Registry, it is important to have a solid understanding of its structure and organization. The Windows Registry is organized into a hierarchical structure similar to a filesystem, comprising keys, subkeys, and values. Each key represents a container that can hold subkeys and values. Subkeys are used to organize and categorize the settings further, while values store the actual data. The name of a Registry value is a string, which can be one of several data types, including strings, integers, binary data, and more.
The main registry hives in Windows are:
HKEY_LOCAL_MACHINE(HKLM): Contains configuration data for the local machine.HKEY_CURRENT_USER(HKCU): Contains configuration data for the currently logged-in user.HKEY_CLASSES_ROOT(HKCR): Contains information about registered applications.HKEY_USERS(HKU): Contains subkeys corresponding to the HKEY_CURRENT_USER keys for each user profile.HKEY_CURRENT_CONFIG(HKCC): Contains information about the current hardware profile.
Changing Registry Value with PowerShell
To change the value of the SearchOrderConfig reg parameter, use the Set-ItemProperty cmdlet:
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverSearching' -Name SearchOrderConfig -Value 0
Make sure that the parameter value has changed:
Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverSearching' -Name SearchOrderConfig
Conclusion
Now that you have gained knowledge and insights into managing the Windows Registry using PowerShell, it’s time to put your skills into practice. Remember to handle errors, specify the full registry path, and consider permissions, too. Always be cautious and make sure you understand what you’re doing before changing the registry. Happy scripting!
What is the Windows Registry?
The Windows Registry is a hierarchical database that stores configuration settings and options for the Windows operating system and installed applications. It contains information, settings, and options for both hardware and software.
How do I read a registry value using PowerShell?
You can read a registry value using the Get-ItemProperty cmdlet: Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" -Name "Desktop"
How do I create a new registry key using PowerShell?
You can create a new registry key using the New-Item cmdlet: New-Item -Path "HKCU:\Software\MyNewKey"
How do I set a registry value using PowerShell?
You can set a registry value using the Set-ItemProperty cmdlet: Set-ItemProperty -Path "HKCU:\Software\MyNewKey" -Name "MyValueName" -Value "MyValueData"
How do I delete a registry key using PowerShell?
You can delete a registry key using the Remove-Item cmdlet: Remove-Item -Path "HKCU:\Software\MyNewKey" -Recurse
How to remove a registry value using PowerShell?
To delete a registry value, use the Remove-ItemProperty cmdlet: Remove-ItemProperty -Path "HKCU:\Software\MyNewKey" -Name "MyValueName"
How do I check if a registry key or value exists using PowerShell?
You can check if a registry key exists using the Test-Path cmdlet: Test-Path -Path "HKCU:\Software\MyNewKey"
How do I back up and restore the registry using PowerShell?
You can back up the registry by exporting the keys you plan to modify: reg export HKCU\Software\MyKey "C:\path\to\backup\MyKeyBackup.reg"
To Import, use: reg import "C:\path\to\backup\MyKeyBackup.reg"
How to get all the values in a registry key?
How to Create a New Registry Entry?
To add a new registry entry named “PowerShellPath” with a specific value to the “Control” key, you can use: New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Control -Name PowerShellPath -PropertyType String -Value $PSHome
How to Rename a Registry Entry?
To rename an existing registry entry, for example, renaming “PowerShellPath” to “PSHome” in the “Control” key, you can use: Rename-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Control -Name PowerShellPath -NewName PSHome -passthru
Search Registry for Keyword Using PowerShell
To find a registry key with a specific name:
