0

Trying to get a script to run across my domain to delete a registry value contained in the user's hive.

This is the path it will be located: HKCU:\Software\Microsoft\OfficeCompat\Outlook\AddinCleanLoad\
and
HKCU:\Software\Microsoft\OfficeCompat\Outlook\AddinUsage\

Obviously this will need to be changed for HKEY_USERS + SID when running as another user or remotely. But I don't to search all the existing SID.

This is the registry value that will vary per user: C:\Users\USERNAME\AppData\Roaming\ZeroSpam\adxloader.dll

So find the value within the hive I could use the $env:APPDATA variable in powershell but since i'm deleting the value, I'm going to run as admin so this is not going to work (variable will return path of admin).

So how would I go about in Powershell to search all (note wildcard in SID) HKEY_USERS\S-1-5-21-*\Software\Microsoft\OfficeCompat\Outlook\AddinCleanLoad\ and HKEY_USERS\S-1-5-21-\Software\Microsoft\OfficeCompat\Outlook\AddinUsage\ to find and delete any value of *\AppData\Roaming\ZeroSpam\adxloader.dll ? (the path before the dll is important as another in program file exists and I dont wanna delete that one)

I've tried with no luck: Get-ChildItem -Path "REGISTRY::HKEY_USERS\" -Recurse -Include *\AppData\Roaming\ZeroSpam\* -ErrorAction SilentlyContinue

JulioQc
  • 62
  • 1
  • 10
  • 2
    HKEY_USERS will not be available except for actively logged on users. You said this is a domain? Why aren’t you utilizing group policy preferences for this? It’s simple. Create a user based GPP registry item and update/delete/create/replace whatever registry keys you want. – Appleoddity May 13 '19 at 22:58
  • 1
    Agreed. Use Group Policy Preferences to target HKEY_CURRENT_USER. – joeqwerty May 14 '19 at 02:04
  • 1) I'm here because in GPO registry item it cannot be done by wildcard; confirmed by many post on stack exchange. And I cannot delete the whole key. 2) The HKEY_USERS hive is available, it's the HKCU that will not be available as you say. I'm surprise to get those comments here. Maybe my phrasing is misleading or unclear? Apologies, I'd be glad to adjust. – JulioQc May 14 '19 at 12:34

1 Answers1

2

Managed to do what I want with this: 

$path = "REGISTRY::HKEY_USERS\S-1-5-21*\Software\Microsoft\OfficeCompat\Outlook\Addin*"
$values = (Get-Item -Path $path ).GetValueNames() | Where {$_ -like "*\AppData\Roaming\ZeroSpam\*"}
Remove-ItemProperty -Path $path -Name $values[0] -ErrorAction SilentlyContinue
Remove-ItemProperty -Path $path -Name $values[1] -ErrorAction SilentlyContinue
JulioQc
  • 62
  • 1
  • 10