asked on

Find and delete regitry settings

I am looking for a way to delete all entries in a particular registry location with the the word apple.

Thus far I have enabled the drive

$null = New-PSDrive -Name HKU   -PSProvider Registry -Root Registry::HKEY_USERS

Open in new window

but I can't seem to figure out how to get a list of results based on a search.

I want to delete all the key with the word apple out of
Get-Item -Path 'HKU:\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices'

However filters don't work and I am at a bit of a loss.

Scottyworld

Hi Brittony,

Try the following code, it will also recurse through the sub-keys too

Get-ChildItem -recurse 'HKU:\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices' | Where-Object {$_.PSChildName -like '*apple*'} | remove-item -force

Open in new window

brittonv

ASKER

It ran, but it didn't delete anything, and yes I am running Powershell as Administrator

brittonv

ASKER

Also when I run:
Get-ChildItem -recurse 'HKU:\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices'

The output is blank? Even though I have a lot of things in there....

brittonv

ASKER

Here is the output of a couple commands, I don't get why I am not getting results:

PS C:\> Get-ChildItem 'HKU:\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\'


    Hive: HKEY_USERS\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion


SKC  VC Name                           Property
---  -- ----                           --------
  0 234 Devices                        {Microsoft XPS Document Writer, Microsoft XPS Document Writer (from domain-110...
  0   0 EFS                            {}
  1   0 MsiCorruptedFileRecovery       {}
  0 235 PrinterPorts                   {Microsoft XPS Document Writer, Microsoft XPS Document Writer (from domain-110...
  0   1 SoftwareProtectionPlatform     {VLRenewalSchedule}
  0   2 Windows                        {UserSelectedDefault, Device}
  0   1 Winlogon                       {ExcludeProfileDirs}


PS C:\> Get-ChildItem 'HKU:\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices'
PS C:\>

Open in new window

Scottyworld

OK, so are you looking for Keys or Values? (you said keys in your original question)

CurrentVersion and Devices are Keys
Everything in Devices is a String Value - is this where you are searching for 'apple" ?

brittonv

ASKER

Yes, I am sorry! I want to find apple in the string!

ASKER CERTIFIED SOLUTION

Scottyworld

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

brittonv

ASKER

Thanks for trying