Grab a remote users HKLM using Powershell

Question

Is there a way to get another machine on your networks HKLM ? I imagine you would use a pdrive for this but I was unable to get a command working successfully

Answer 1

There are a few ways to do it but how you do it depends on the environment you have.

1) Probably the easiest way is to use invoke-command

Ex.
Invoke-command -computer RemoteComputerName {Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\run}

This would work if you have sufficient permission on the remote machine, WinRM is configured for you to connect to it.

2) You can use .net registry classes See this link: http://msdn.microsoft.com/en-us/library/microsoft.win32.registrykey.aspx

$registry = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', 'RemoteComputerName')
$registryKey= $registry.OpenSubKey("Software")

3) You use PSDrive as shown in the Scripting Guy blog http://blogs.technet.com/b/heyscriptingguy/archive/2012/05/07/use-the-powershell-registry-provider-to-simplify-registry-access.aspx

4) You can use WMI Registry http://itknowledgeexchange.techtarget.com/powershell/wmi-and-the-registry/