Author Posts

January 23, 2018 at 5:42 pm

I've been trying to create a simple command which will look through a registry path, and return the NAME of the Key if a value's data underneath that key is "Like" a string.

I've started with:

Get-ChildItem -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ | where { $_.DisplayName -like 'symantec' }

Nothing gets returned.

IF I can get something returned, I still then need to have the result be the KEY name, which is directly under "Uninstall" and of course is different for each product.

I'm so confused 🙂 Any advice would be appreciated. I can also use a script but It would be easier with a one line command.

Thanks in advance!

January 23, 2018 at 6:03 pm

What you should looking for are item properties not items. Try something like this:

Get-ChildItem -Path "REGISTRY::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" |
    Where-Object {
        (Get-ItemProperty -Path $_.PSPath -Name DisplayName).DisplayName -like '*symantec*'
    } |
        Select-Object -Property Name

If you're using the -like operator you have to use asterisks either on one side or on both sides. Otherwise you will only find exact matches.

January 23, 2018 at 7:41 pm

I wish I could do "Get-Childitem -Recurse HKLM: | Select-String" on the registry, but that doesn't work so well with values and data. Here's a nice registry search script: