Searching and deleting registry entries using wildcards

Question

Is it possible to search for a wildcard - example *WAAgent* or *WAHost* and delete every registry key that references that wildcard statement above?

Answer 1

If you are searching for a property value instead of a key value (and delete the relative key) you can use something like this:

gci HKLM: -rec -ea SilentlyContinue | % { if((get-itemproperty -Path $_.PsPath) 
    -match "WAAGent") { $_.PsPath} } | Remove-Item  

Like for the @Graimer's answer, BE CAREFULL!!!

Answer 2

You may try something like:

Get-ChildItem -Path HKLM:\ -Recurse -Include *WAAgent* -ErrorAction SilentlyContinue | Remove-Item
Get-ChildItem -Path HKLM:\ -Recurse -Include *WAHost* -ErrorAction SilentlyContinue | Remove-Item

You have to specify in -Path if they are location in HKLM(local machine) or HKCU(current user), as they are two different drives. This has to be run as admin, and will give lots of errors(that's why I used -ErrorAction SilentlyContinue to hide them).

CAUTION: Personally I don't think it's smart to be using wildcards in registry though since it may delete something you didn't know about that could crash the system. My recommendation would be to compile a list of paths to the keys you want to remove and loop through it with foreach to delete one by one. Again, wildcards are DANGEROUS in registry.

Answer 3

As all have already suggested, use this with extremely caution!! The following will go through all registry hives. Keep in mind that a matching key found can have a deep structure underneath it and you're deleting it all. Remove the WhatIf switch to actually delete the keys.

Get-ChildItem Microsoft.PowerShell.Core\Registry:: -Include *WAAgent*,*WAHost* -Recurse |
Remove-Item -Recurse -Force -WhatIf