CODEWITHSUNDEEP
windowspowershellregistry
Guy Thomas
Guy Thomas

Reputation: 933

How to get PowerShell to display registry Data values

Take the Winlogon registry section, I would like PowerShell to display the Data value for DefaultUserName.

This is as far as I have got:

Stage 1

get-itemproperty -path "hklm:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\"

Stage 2

I can append:

-Name DefaultUserName

But this won't return a value.

Also other Names, despite being visible in regedit, don't show in PowerShell, for example AutoAdminLogon.

Question: how can make PowerShell display what I can see with regedit?

Upvotes: 0

Views: 16694

Answers (5)

must21
must21

Reputation: 21

even simpler:

gp "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\").DefaultUserName

Upvotes: 2

Massimo
Massimo

Reputation: 3470

A late followup.

As suggested by Frank, REG.EXE works fine.

However a small C function fail to read this specific DefaultUserName : the API RegQueryValueExA doesn't return error, but a size of 1 bytes !

Under the same branch, I can read Shell.

With REGEDIT.EXE I check the permissions, for both values they are

Administrators : Full, Users : Read.

OS : Windows 7 home premium - 64 bit

DWORD RegGetValueA( HKEY hTree, LPCSTR lpSubKey, LPCSTR lpValueName, LPDWORD lpdwType, LPVOID lpData, LPDWORD lpdwSize )
{
    #define KEY_WOW64_32KEY     0x0200      // on 64-bit Windows should operate on the 32-bit registry view ( HKLM\SOFTWARE\Wow6432Node\... )
    #define KEY_WOW64_64KEY     0x0100      // on 64-bit Windows should operate on the 64-bit registry view
    DWORD   ret, dwAlter = 0;
    HKEY    hKey;

retry:
    ret = RegOpenKeyExA( hTree, lpSubKey, 0, KEY_READ | dwAlter, &hKey );
    if ( ret != ERROR_SUCCESS )
        return  ret;

    ret = RegQueryValueExA( hKey, lpValueName, NULL, lpdwType, lpData, lpdwSize );
    RegCloseKey( hKey );

    if ( ret != ERROR_SUCCESS && dwAlter == 0 )
    {
        dwAlter = KEY_WOW64_64KEY;
//      printf( "retry... %d\r\n", dwAlter );
        goto retry;
    }

    return  ret;
}

Upvotes: 0

rerun
rerun

Reputation: 25505

Does 

Get-ItemProperty -path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" |% {$_.DefaultUserName}

Work for you

Upvotes: 1

Guy Thomas
Guy Thomas

Reputation: 933

I tried the very same commands on another machine, they worked perfectly, as expected. Thus my original machine must have a faulty registry, or at the least, weird permissions.

Upvotes: 0

Frank Bollack
Frank Bollack

Reputation: 25196

You can try the standard command line:

reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName

Upvotes: 2

Related Questions