CODEWITHSUNDEEP
powershellregistry
ryanmaddock
ryanmaddock

Reputation: 134

Query a single registry subkey using PowerShell?

I have created a script which will search for the following registry value HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperationsand if it is present, delete it.

However, I am struggling to query the single value I want to delete rather than all values within ..\Session Manager\. I have the following code:

$reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey(‘LocalMachine’, $computer)
$regKey = $reg.OpenSubKey(“SYSTEM\\CurrentControlSet\\Control\\Session Manager\\”,$true )

foreach ($key in $regKey.GetValueNames()) {

if ($key -eq “PendingFileRenameOperations”)
  {
    $regKey.DeleteValue($key)
    Write-Host "PendingFileRenameOperations key deleted successfully" -ForegroundColor Green
  }
else
  {
    Write-Host "Key does not exist. Please assign to Second Line for further investigation" -ForegroundColor Red
  }
}

Which outputs the following:

Key does not exist. No further action required
Key does not exist. No further action required
Key does not exist. No further action required
Key does not exist. No further action required
Key does not exist. No further action required
Key does not exist. No further action required
Key does not exist. No further action required
Key does not exist. No further action required
Key does not exist. No further action required
Key does not exist. No further action required
Key does not exist. No further action required
Key does not exist. No further action required
Key does not exist. No further action required
Key does not exist. No further action required
Key does not exist. No further action required
PendingFileRenameOperations key deleted successfully

Is it possible to just output either Key does not exist. No further action required or PendingFileRenameOperations key deleted successfully rather than querying every single value?

Upvotes: 1

Views: 1052

Answers (1)

Maximilian Burszley
Maximilian Burszley

Reputation: 19644

To expound on my comment:

$ErrorActionPreference = 'SilentlyContinue'
$Path = 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager'
$Name = 'PendingFileRenameOperations'
If (Get-ItemProperty -Path $Path -Name $Name)
{
    Remove-ItemProperty -Path $Path -Name $Name
    "Property '$Name' removed."
}
Else
{
    "Property '$Name' did not exist."
}

For your specific question, create a flag variable:

$Flag = $True
foreach ($property in $regKey.GetValueNames())
{
  if ($property -eq 'PendingFileRenameOperations')
  {
    $regKey.DeleteValue($property)
    Write-Host "PendingFileRenameOperations key deleted successfully" -ForegroundColor Green
    $Flag = $False
    break
  }
}
if ($Flag)
{
  Write-Host 'Property does not exist. Please assign to Second Line for further investigation' -ForegroundColor Red
}

And with respect to @EBGreen's suggestion:

If ($regKey.GetValue('PendingFileRenameOperations'))
{
    $regKey.DeleteValue('PendingFileRenameOperations')
    Write-Host 'PendingFileRenameOperations property deleted successfully' -ForegroundColor Green
}
Else
{
    Write-Host 'Property does not exist. Please assign to Second Line for further investigation' -ForegroundColor Red
}

Upvotes: 3

Related Questions