Query value in HKCU

This topic contains 2 replies, has 2 voices, and was last updated by  Craig Larkin 2 years, 4 months ago.

  • Author
  • #25958

    Craig Larkin


    I'm a new PowerShell user, I've spent alot of time searching but not been able to find the answer [that I understand] to my questions below.

    We have an application that defines a user home folder in this path HKEY_CURRENT_USER\Software\Objective\Client\ObjectiveHome\Preferences

    I can use this command to find this value

    PS HKCU:\> Get-Item 'HKCU:\Software\Objective\Client\Preferences' | Get-ItemProperty

    which returns

    DefaultHome : C:\Users\username\OBJECTIVE\%OBJSERVER%-%OBJPORT%\%OBJUSER%
    ShowRowGuides : Y
    EvenRowColor : 255,255,255
    PSPath : Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USER\Software\Objective\Client\Pref
    PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USER\Software\Objective\Client
    PSChildName : Preferences
    PSProvider : Microsoft.PowerShell.Core\Registry

    My Questions are

    1. Can I adjust my Powershell string to just return the value of the DefaultHome key only? I've tried a variety of options but got nothing to work
    2. Can I then use this to query this value on remote machines?
    3. If the answer to 2 is Yes what would be the best way to achieve this?

    Thanks, Craig

  • #25972

    Peter Jurgens

    You can use Select-Object, or use property expansion if you just need a single value.

    Get-ItemProperty -Path 'HKCU:\Software\Objective\Client\Preferences' | Select-Object -Property DefaultHome
    $(Get-ItemProperty -Path 'HKCU:\Software\Objective\Client\Preferences').DefaultHome

    You can use Invoke-Command to query these properties on remote machines, as long as they have PSRemoting enabled and you have administrative access to the machines.

    Invoke-Command -ComputerName Computer01 -ScriptBlock {Get-ItemProperty -Path 'HKCU:\Software\Objective\Client\Preferences'} | Select-Object PSComputerName,DefaultHome

    The above command will list the results of the registry query along with the name of the computer that value was retrieved from.

    HOWEVER: You are trying to access the HKCU registry hive for information. Unfortunately (for this specific case, I presume), PSRemoting connects with the credentials of the current user, therefore value retrieved will be the value as is set in your own user profile on the remote machine.

    To get the value from other users on the remote machine, you'd have to first connect to the HKU registry hive, then search it and identify which root belongs to whom, etc.

  • #26191

    Craig Larkin

    Thanks for your response Peter, I've gone with the first suggestion you made. You are correct in your assumption that I would like to run this against remote machines.

    I'm currently trying to understand the process I need to follow further, but I think I need to first identify the SID of the users profile that I want to check, and then run the query against this value

    Can anyone point me in the right direction of a good resource that explains the process I should be following?

You must be logged in to reply to this topic.