Discussion
While the Windows Registry Editor is useful for searching the registry, it sometimes may not provide the power you need. For example, the registry editor does not support searches with wildcards or regular expressions.
In the filesystem, we have the SelectString cmdlet to search files for content. PowerShell does not have that for other stores, but we can write a script to do it. The key here is to think of registry key values like you think of content in a file:
- Directories have items; items have content.
- Registry keys have properties; properties have values.
Example 184 goes through all registry keys (and their values) for a search term and returns information about the match.
Example 184. SearchRegistry.ps1
############################################################################## ## ## SearchRegistry.ps1 ## ## Search the registry for keys or properties that match a specific value. ## ## ie: ## ## PS >SetLocation HKCU:\Software\Microsoft\ ## PS >SearchRegistry Run ## ##############################################################################
param([string] $searchText = $(throw "Please specify text to search for."))
## Helper function to create a new object that represents ## a registry match from this script function NewRegistryMatch {
param( $matchType, $keyName, $propertyName, $line )
$registryMatch = NewObject PsObject $registryMatch | AddMember NoteProperty MatchType $matchType $registryMatch | AddMember NoteProperty KeyName $keyName $registryMatch | AddMember NoteProperty PropertyName $propertyName $registryMatch | AddMember NoteProperty Line $line
$registryMatch }
## Go through each item in the registry foreach($item in GetChildItem Recurse ErrorAction SilentlyContinue) {
## Check if the key name matches if($item.Name match $searchText) {
NewRegistryMatch "Key" $item.Name $null $item.Name }
## Check if a key property matches foreach($property in (GetItemProperty $item.PsPath).PsObject.Properties) {
## Skip the property if it was one PowerShell added if(($property.Name eq "PSPath") or ($property.Name eq "PSChildName")) {
continue }
## Search the text of the property $propertyText = "$($property.Name)=$($property.Value)" if($propertyText match $searchText) {
Example 184. SearchRegistry.ps1 (continued)
NewRegistryMatch "Property" $item.Name $property.Name $propertyText } } }
