Working with registry keys - PowerShell (2024)

This sample only applies to Windows platforms.

Because registry keys are items on PowerShell drives, working with them is very similar to workingwith files and folders. One critical difference is that every item on a registry-based PowerShelldrive is a container, just like a folder on a file system drive. However, registry entries and theirassociated values are properties of the items, not distinct items.

Listing all subkeys of a registry key

You can show all items directly within a registry key using Get-ChildItem. Add the optionalForce parameter to display hidden or system items. For example, this command displays the itemsdirectly within PowerShell drive HKCU:, which corresponds to the HKEY_CURRENT_USER registryhive:

Get-ChildItem -Path HKCU:\ | Select-Object Name

 Hive: Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USERName----HKEY_CURRENT_USER\AppEventsHKEY_CURRENT_USER\ConsoleHKEY_CURRENT_USER\Control PanelHKEY_CURRENT_USER\DirectShowHKEY_CURRENT_USER\dummyHKEY_CURRENT_USER\EnvironmentHKEY_CURRENT_USER\EUDCHKEY_CURRENT_USER\Keyboard LayoutHKEY_CURRENT_USER\MediaFoundationHKEY_CURRENT_USER\MicrosoftHKEY_CURRENT_USER\NetworkHKEY_CURRENT_USER\PrintersHKEY_CURRENT_USER\SoftwareHKEY_CURRENT_USER\SystemHKEY_CURRENT_USER\UninstallHKEY_CURRENT_USER\WXPHKEY_CURRENT_USER\Volatile Environment

These are the top-level keys visible under HKEY_CURRENT_USER in the Registry Editor(regedit.exe).

You can also specify this registry path by specifying the registry provider's name, followed by::. The registry provider's full name is Microsoft.PowerShell.Core\Registry, but this can beshortened to just Registry. Any of the following commands will list the contents directly underHKCU:.

Get-ChildItem -Path Registry::HKEY_CURRENT_USERGet-ChildItem -Path Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USERGet-ChildItem -Path Registry::HKCUGet-ChildItem -Path Microsoft.PowerShell.Core\Registry::HKCUGet-ChildItem HKCU:

These commands list only the directly contained items, much like using DIR in cmd.exe or lsin a UNIX shell. To show contained items, you need to specify the Recurse parameter. To list allregistry keys in HKCU:, use the following command.

Get-ChildItem -Path HKCU:\ -Recurse

Get-ChildItem can perform complex filtering capabilities through its Path, Filter,Include, and Exclude parameters, but those parameters are typically based only on name. Youcan perform complex filtering based on other properties of items using the Where-Object cmdlet.The following command finds all keys within HKCU:\Software that have no more than one subkey andalso have exactly four values:

Get-ChildItem -Path HKCU:\Software -Recurse | Where-Object {($_.SubKeyCount -le 1) -and ($_.ValueCount -eq 4) }

Copying keys

Copying is done with Copy-Item. The following example copies the CurrentVersion subkey ofHKLM:\SOFTWARE\Microsoft\Windows\ and all of its properties to HKCU:\.

Copy-Item -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion' -Destination HKCU:

If you examine this new key in the registry editor or using Get-ChildItem, you notice that youdon't have copies of the contained subkeys in the new location. In order to copy all of the contentsof a container, you need to specify the Recurse parameter. To make the preceding copy commandrecursive, you would use this command:

Copy-Item -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion' -Destination HKCU: -Recurse

You can still use other tools you already have available to perform filesystem copies. Any registryediting tools—including reg.exe, regini.exe, regedit.exe, and COM objects that supportregistry editing, such as WScript.Shell and WMI's StdRegProv class can be used from withinPowerShell.

Creating keys

Creating new keys in the registry is simpler than creating a new item in a file system. Because allregistry keys are containers, you don't need to specify the item type. Just provide an explicitpath, such as:

New-Item -Path HKCU:\Software_DeleteMe

You can also use a provider-based path to specify a key:

New-Item -Path Registry::HKCU\Software_DeleteMe

Deleting keys

Deleting items is essentially the same for all providers. The following commands silently removeitems:

Remove-Item -Path HKCU:\Software_DeleteMeRemove-Item -Path 'HKCU:\key with spaces in the name'

Removing all keys under a specific key

You can remove contained items using Remove-Item, but you will be prompted to confirm the removalif the item contains anything else. For example, if we attempt to delete the HKCU:\CurrentVersionsubkey we created, we see this:

Remove-Item -Path HKCU:\CurrentVersion

ConfirmThe item at HKCU:\CurrentVersion\AdminDebug has children and the -recurseparameter was not specified. If you continue, all children will be removed withthe item. Are you sure you want to continue?[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"):

To delete contained items without prompting, specify the Recurse parameter:

Remove-Item -Path HKCU:\CurrentVersion -Recurse

If you wanted to remove all items within HKCU:\CurrentVersion but not HKCU:\CurrentVersionitself, you could instead use:

Remove-Item -Path HKCU:\CurrentVersion\* -Recurse