0

I am setting up a machine for testing, and part of that is tinkering with some registry values. This is an Azure VM, and I am configuring it via Powershell.

I am noticing many differences between the Registry values returned from Get-ItemProperty (in Powershell) and the Registry values I see in regedit.exe. Below is an example of one such difference:

Get-ItemProperty:

enter image description here

regedit.exe:

enter image description here

Note DefaultUserName is set when viewed in regedit.exe

I am setting these properties using New-ItemProperty (with a -Force parameter).

Any help is appreciated.

Damien
  • 624
  • 7
  • 25
  • 2
    one of my most common mistakes is to _think_ i am working at one place when i am actually at another. so ... have you double & triple checked to make sure those are both coming from the same place? – Lee_Dailey Dec 06 '18 at 06:19
  • Did you try to run the PowerShell Console with elevated privileges? – Mötz Dec 06 '18 at 13:28
  • I was running Powershell as Administrator, yep – Damien Dec 06 '18 at 21:39
  • Could this be related? https://learn.microsoft.com/en-us/windows/desktop/sysinfo/32-bit-and-64-bit-application-data-in-the-registry – Mötz Dec 07 '18 at 05:50
  • Here the issue is the other way around. https://stackoverflow.com/questions/31549791/why-how-are-registry-entries-hidden-in-regedit-but-visible-in-powershell – Mötz Dec 07 '18 at 05:52

1 Answers1

1

I don't have an answer right now, but have some ideas you can try out.

List all keys using the commandline

reg.exe query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"

List all keys using PowerShell

(Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\").PSObject.Properties | where-object name -notlike PS* | Format-Table Name, value

That should make it easier for you to compare the results that PowerShell is generating and what the commandline is generating.

Want to count the number of entries in PowerShell

((Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\").PSObject.Properties | where-object name -notlike PS*).count

I have tested against 2 different laptops and have seen no differences.

I have tested against 4 different Azure VMs and have seen no differences.

If you are creating new registry keys, I would restart the PowerShell console before retrieving the registry keys again. Just to make sure.

Otherwise you should consider exporting the registry key from regedit.exe and look at the path generated in the file.

Mötz
  • 1,682
  • 11
  • 17
  • Nice response, thanks. `reg.exe query` & `Get-ItemProperty` have the same values in Powershell. However, the _Registry Editor_ GUI is way different. I've observed this only happens in the `latest` version of the "2016 Datacenter" Azure Image. Using the previous version, there is no issue. – Damien Dec 06 '18 at 22:22