?
Solved

How i search all values and/or registry keys of a term with powershell to do mass deletion ou replacement?

Posted on 2011-05-07
7
Medium Priority
?
683 Views
Last Modified: 2012-05-11
How i search a term, like "nvidia" inside registry with powershell to delete or replace all related values and keys with another one like "nvidia2"?
.
.
Thanks Experts.
0
Comment
Question by:DUX_NEKRON
  • 3
  • 3
7 Comments
 
LVL 13

Expert Comment

by:soostibi
ID: 35713359
This is my prototype. If you like it, I can make a function form it, so that it's easier to use.

You can set the $search and $root to test it.
$search = "arial"
$root = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'

Get-childItem $root -Recurse -ErrorAction silentlycontinue | %{
    if($_.name -match $search){
        New-Object -TypeName PSObject -Property @{
                    Path = $_.name
                    Name = $null
                    Value = $null
                    Type = $null
                }
            }
    else{
        $key = $_
        $key.getvaluenames() | %{
            if($_ -match $search){New-Object -TypeName PSObject -Property @{
                    Path = $key.name
                    Name = $_
                    Value = $key.getvalue($_)
                    Type = $key.getvaluekind($_)
                }
            }
        }
    }
} | Select-Object path,name, value, type

Open in new window

0
 
LVL 13

Accepted Solution

by:
soostibi earned 1700 total points
ID: 35713471
This is a complete solution.
function SearchRegistry ([string] $search, [string] $root, [bool] $recurse=$true) {
Get-childItem $root -Recurse:$recurse -ErrorAction silentlycontinue | %{
    if($_.name -match $search){
        New-Object -TypeName PSObject -Property @{
                    Path = $_.pspath
                    Name = $null
                    Value = $null
                    Type = $null
                    ObjType = "Key"
                }
            }
    else{
        $key = $_
        $key.getvaluenames() | %{
            if($_ -match $search){New-Object -TypeName PSObject -Property @{
                    Path = $key.pspath
                    Name = $_
                    Value = $key.getvalue($_)
                    Type = $key.getvaluekind($_)
                    ObjType = "Value"
                }
            }
        }
    }
} | Select-Object path, name, value, type, ObjType
}

Filter RenameRegistry ($newname){
    if($_.ObjType -eq "Key"){
        Rename-Item -path $_.path -NewName $newname
        write-host "Replaced keyname $($_.path)"
    }
    elseif($_.ObjType -eq "Value"){
        Rename-ItemProperty -Path $_.path -NewName $newname -Name $_.name
        write-host "Replaced valuename at $($_.path)"
    }    
}

Open in new window


If you just want to use it for searching, deep under the HKeyLocalMachine hive:
SearchRegistry -search YourSearchExpression -root hklm:

Open in new window


Search in HKeyCurrentUser for Microsoft, just one level under Software, getting the result in table format:
SearchRegistry -search Microsoft -root HKCU:\Software -recurse $false | Format-Table

Open in new window


Search for the expression "YourExpression" under HKeyCurrentUser deep, and replace all occurances to 'YourNewName'
SearchRegistry -search YourExpression -root hkcu: | RenameRegistry -newname YourNewName

Open in new window

0
 

Author Comment

by:DUX_NEKRON
ID: 35713719
Wonderful soostibi!!!

How can i save and call the SearchRegistry function ?

Thank you
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
LVL 5

Assisted Solution

by:Alok-Agarwal
Alok-Agarwal earned 300 total points
ID: 35714010
Hi,

You need to copy the code given by soostibi into notepad. Save the file in your  preferred directory say C:\myscripts as your preferred file name say "Test.ps1". Please note two things

1) While saving the contents of Notepad, put the double quotes around file name so that file is saved as ps1 file and not as txt file.
2) To execute you need to run the Test.ps1 file on PowerShell prompt as shown below
ps > .\C:\myscripts\Test.ps1
3) Once command 2 is executed successfullly you are ready to use the function SearchRegistry

PS > SearchRegistry....

Please note that you cannot run powershell script with a double click. Also you may need to first digitally sign the script before execution

Alternatively you can copy paste the complete contents given by soostibi on the powershell prompt

PS> Just paste the entire contents here.

HTH
0
 

Author Comment

by:DUX_NEKRON
ID: 35715944
It didint worked.

Let's describe my steps:

(enable custom scripts)
1 - PS E:\> set-executionpolicy unrestricted

(the complete script solution)
2 - PS E:\> .\11scr.ps1

(for test)
3 - PS E:\> SearchRegistry -search Microsoft -root HKCU:\Software -recurse $false | Format-Table

Bad result, the log:

PS E:\> get-help set-executionpolicy
PS E:\> set-executionpolicy unrestricted

Execution Policy Change
The execution policy helps protect you from scripts that you do not trust. Changing the execution policy might expose you to the security risks described in the about_Execution_Policies
help topic. Do you want to change the execution policy?
[Y] Yes  [N] No  [S] Suspend  [?] Help (default is "Y"): y
PS E:\> .\11scr.ps1
PS E:\> SearchRegistry -search Microsoft -root HKCU:\Software -recurse $false | Format-Table
The term 'SearchRegistry' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the p
ath is correct and try again.
At line:1 char:15
+ SearchRegistry <<<<  -search Microsoft -root HKCU:\Software -recurse $false | Format-Table
    + CategoryInfo          : ObjectNotFound: (SearchRegistry:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException

PS E:\>

Open in new window

0
 
LVL 13

Assisted Solution

by:soostibi
soostibi earned 1700 total points
ID: 35716163
You should call the script in "dot sourced" mode (extra dot followed by a space):

. .\11scr.ps1

And of course the 11scr.ps1 is under E:\ root in your example above.
0
 

Author Closing Comment

by:DUX_NEKRON
ID: 35716214
Thank you soostibi, wonderful script and explanation, it worked like a charm, and Alok-Agarwal too to how proceed with powershell scripts
Cheers
DUX_NEKRON
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This month, Experts Exchange’s free Course of the Month is focused on CompTIA IT Fundamentals.
Transferring FSMO roles is done when an admin wants to split roles between certain Domain Controllers or the Domain Controller holding the Roles has been forcefully demoted using dcpromo / forceremoval
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…

840 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question