Author Posts

April 17, 2016 at 8:40 am

How would one get to the HKEY_Users key in the registry using powershell? I am seeing that it would have to be possible to look it up by the .net classes.

One example I see is

$Reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', 'computername')

Would the key be users in this case?
The key that I am looking for is

HKEY_Users\.DEFAULT\Control Panel\International and the LocalName value.

Many thanks,

Wei-Yen

April 17, 2016 at 12:57 pm

Simple, try this:

Set-Location -Path HCKU:

EDIT: I was too quick with answering. Be aware that you need to script this. There's no native way (besides using .NET, as you already figured out), to access the .DEFAULT hive.

Check this: https://www.sepago.com/blog/2007/11/19/why-is-almost-everybody-wrong-about-hkudefault
And this: http://stackoverflow.com/questions/11013466/loading-ntuser-dat-with-powershell

April 17, 2016 at 1:23 pm

I've tried posting this a few times, but it has not shown up for some reason. Here it is again without the source reference which appears to be what it causing it to not display.

Get-ItemProperty -Path "Registry::\HKEY_USERS\.DEFAULT\Control Panel\International"

April 17, 2016 at 1:28 pm

I take my words back. Curtis is the man! _0_

April 17, 2016 at 1:36 pm

Thanks Richard.

April 17, 2016 at 1:38 pm

You could use Invoke-Command for that.

April 17, 2016 at 2:14 pm

You could create a PSDrive using the Registry provider:

New-PSDrive HKU -Root HKEY_Users -PSProvider Registry
Get-ChildItem HKU:\.default

April 17, 2016 at 2:36 pm

Thanks guys, you have given a bit more perspective

June 27, 2017 at 9:17 pm

from cmd console:
powershell -command "& Get-ChildItem -Path Registry::HKU | where {$_.Name -match 'Classes'} | Select-Object -ExpandProperty PSChildName | Out-File .\default_HKU.txt"

from PS console:
Get-ChildItem -Path Registry::HKU | where {$_.Name -match 'Classes'} | Select-Object -ExpandProperty PSChildName | Out-File .\default_HKU.txt