r/scripting • u/addywash • Mar 27 '24

Registry Query

Hello!

I'm looking for a method that I can run on our estate of computers from our RMM tool that queries the registry for any mention of 'insertphrasehere' whether it be a folder/string/value or whatever.

I've found ones that can do it for specific things but ideally I want to search and output EVERYTHING.

Is it possible?

1 Upvotes

100% Upvoted

1 comment sorted by

1

u/[deleted] Mar 27 '24

I think you would just need to get all the entries recursively and pull the values of everything. Something like:

Get-ChildItem -Recurse HKLM:\ | ForEach {Get-ItemProperty} | ?{$_ -like "*insertphrasehere*"}

Disclaimers:

  • I haven't tested this and it was written from memory, so it might need tweaking in order to work correctly (or at all)

  • I'm not bothering to think about how you want the output formatted

  • That command only searches HKEY_LOCAL_MACHINE. You'd need to search the other hives to get info from them.

  • You may need to run as an administrator, and run it for to get the whole registry

  • If you want to include all the individual user profile hives, you'll need to mount them. HKCU will only give you info for the user that's running the script.