Get remote registry value

Question

I have the below script that I want it to go out to multiple servers and get the value of a registry. Unfortunately it is currently just posting back the local registry value of the machine that I am running the script on.

How do I get the script to run against remote registry?

SCRIPT:

clear
#$ErrorActionPreference = "silentlycontinue"

$Logfile = "C:\temp\NEWnetbackup_version.log"

Function LogWrite
{
    param([string]$logstring)

    Add-Content $Logfile -Value $logstring
}

$computer = Get-Content -Path c:\temp\netbackup_servers1.txt

foreach ($computer1 in $computer){

$Service = Get-WmiObject Win32_Service -Filter "Name = 'NetBackup Client Service'" -ComputerName $computer1

    if (test-connection $computer1 -quiet) 
    {
            $NetbackupVersion1 = $(Get-ItemProperty hklm:\SOFTWARE\Veritas\NetBackup\CurrentVersion).PackageVersion

            if($Service.state -eq 'Running')
            {
                LogWrite "$computer1 STARTED $NetbackupVersion1"
            }
            else
            {
                LogWrite "$computer1 STOPPED $NetbackupVersion1"
            }
    }
    else 
    {
        LogWrite "$computer1 is down" -foregroundcolor RED
    }
}

score 51 · Accepted Answer · answered Feb 25 '13 at 14:44

51

You can try using .net:

$Reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', $computer1)
$RegKey= $Reg.OpenSubKey("SOFTWARE\\Veritas\\NetBackup\\CurrentVersion")
$NetbackupVersion1 = $RegKey.GetValue("PackageVersion")

answered Feb 25 '13 at 14:44

CB.

58,865
9
159
159

Thanks - this works; how do I incorporate this into the LogWrite that I want the value to be outputted to the logfile I have? – lara400 Feb 25 '13 at 15:01
1

@lara400 As you 're doing in your code: `LogWrite "$computer1 STARTED $NetbackupVersion1"`. But maybe I didn't understood your question... – CB. Feb 25 '13 at 15:05
1

If you want to set a value, use `$RegKey= $Reg.OpenSubKey("SOFTWARE\\Veritas\\NetBackup\\CurrentVersion",$true)` then `regkey.setvalue("Name","Myvalue")` – Loïc MICHEL Nov 22 '16 at 13:55
Is there an option on this to invoke it using a specific credential? Looks like it expects the current credential to have sufficient permissions. – Jim Oct 23 '18 at 17:51

score 15 · Answer 2 · answered Feb 25 '13 at 14:49

15

Try the Remote Registry Module, the registry provider cannot operate remotely:

Import-Module PSRemoteRegistry
Get-RegValue -ComputerName $Computer1 -Key SOFTWARE\Veritas\NetBackup\CurrentVersion -Value PackageVersion

answered Feb 25 '13 at 14:49

Shay Levy

121,444
32
184
206

oh I didn't know this existed! neat-o – jbockle Feb 25 '13 at 14:53
@shaylevy You did a great job with this module! – CB. Feb 25 '13 at 15:00
Thanks guys, glad you liked it :) – Shay Levy Feb 28 '13 at 10:38
@ShayLevy, The link https://archive.codeplex.com/?p=psremoteregistry does not host MSI or zip for install. Do you have another link for download? Thanks. – HappyTown Jun 11 '18 at 21:19
1

@ShayLevy, Found that it is now available through `PowerShellGet` at https://www.powershellgallery.com/packages/PSRemoteRegistry/1.0.0.0 – HappyTown Jun 11 '18 at 21:41
1

For those of you reading this thread, this module was unpublished from the gallery. I did see the following module that was based on a fork of Shay's work [PoshRegistry](https://www.powershellgallery.com/packages/PoshRegistry/0.0.2) – Jim Oct 23 '18 at 17:48

score 6 · Answer 3 · answered Feb 25 '13 at 14:46

6

If you have Powershell remoting and CredSSP setup then you can update your code to the following:

$Session = New-PSSession -ComputerName $Computer1 -Authentication CredSSP
$NetbackupVersion1 = Invoke-Command -Session $Session -ScriptBlock { $(Get-ItemProperty hklm:\SOFTWARE\Veritas\NetBackup\CurrentVersion).PackageVersion}
Remove-PSSession $Session

answered Feb 25 '13 at 14:46

Musaab Al-Okaidi

3,734
22
21

If you have remoting and don't want to use third-party modules, use this. It's much easier to read than direct method calls. Is CredSSP a double-hop thing? I didn't need it for this. Thanks! – Iain Samuel McLean Elder May 05 '14 at 18:07

score 3 · Answer 4 · answered Feb 05 '18 at 03:51

3

another option ... needs remoting ...

(invoke-command -ComputerName mymachine -ScriptBlock {Get-ItemProperty HKLM:\SOFTWARE\VanDyke\VShell\License -Name Version }).version

answered Feb 05 '18 at 03:51

Straff

5,499
4
33
31

score 2 · Answer 5 · answered Feb 25 '13 at 14:50

For remote registry you have to use .NET with powershell 2.0

$w32reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine',$computer1)
$keypath = 'SOFTWARE\Veritas\NetBackup\CurrentVersion'
$netbackup = $w32reg.OpenSubKey($keypath)
$NetbackupVersion1 = $netbackup.GetValue('PackageVersion')

score 2 · Answer 6 · edited May 07 '15 at 19:38

If you need user's SID and browse remote HKEY_USERS folder, you can follow this script :

<# Replace following domain.name with yours and userAccountName with remote username #>
$userLogin = New-Object System.Security.Principal.NTAccount(“domain.name“,”userAccountName“)
$userSID = $userLogin.Translate([System.Security.Principal.SecurityIdentifier])

<# We will open HKEY_USERS and with accurate user’s SID from remoteComputer #>
$remoteRegistry = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey(‘Users’,”remoteComputer“)

<# We will then retrieve LocalName value from Control Panel / International subkeys #>

$key = $userSID.value+”\Control Panel\International”
$openKey = $remoteRegistry.OpenSubKey($key)

<# We can now retrieve any values #>

$localName = $openKey.GetValue(‘LocaleName’)

Source : http://techsultan.com/how-to-browse-remote-registry-in-powershell/

Get remote registry value

6 Answers6

Linked