Explaining Jason Stangroome's "PowerShell Registry Find and Replace" article

On 2007-08-02, Jason Stangroome posted a blog article "PowerShell Registry Find and Replace" at URL http://blog.stangroome.com/2007/08/02/powershell-registry-find-and-replace/ . The article is still there, however the PowerShell code is presented without a examples or a usage statement. Hence I am re-posting his content here, reformatted for legibility and with an example.

PowerShell function Find-RegistryValue requires one parameter, -seek, of type string. The string should be wrapped in single or double quotes and contain appropriate character escapes; for example use '\\' versus '\'.

The -regpath parameter is automatically populated by Get-Location, do not attempt to provide it as a string.  Instead use Set-Location Registry::[...] first to provide the proper context before running Find-RegistryValue.

function Find-RegistryValue (
[string] $seek = $(throw “seek required.”),
[System.Management.Automation.PathInfo] $regpath = (Get-Location)
){
if ($regpath.Provider.Name -ne “Registry”) {
throw “regpath required.”
}
$keys = @(Get-Item $regpath -ErrorAction SilentlyContinue)
$keys += @(Get-ChildItem -recurse $regpath -ErrorAction SilentlyContinue)
$results = @();
foreach ($key in $keys) {
foreach ($vname in $key.GetValueNames()) {
$val = $key.GetValue($vname);
if ($val -match $seek) {
$r = @{};
$r.Key = $key;
$r.ValueName = $vname;
$r.Value = $val;
$results += $r;
}
}
}
$results;
}


A series of examples

• Command Find-RegistryValue -seek \VisualStudio\ fails because the current location is not a registry path; run Set-Location Registry::[...]

> Find-RegistryValue -seek \VisualStudio\
regpath required.
At Find-RegistryValue:6 char:3
+         throw “regpath required.”
+         ~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OperationStopped: (regpath required.:String) [], RuntimeException
    + FullyQualifiedErrorId : regpath required.

• Command Find-RegistryValue -seek \Microsoft\ fails because the '\' character is interpreted as escaping the next character 'M'; replace all '\' with '\\' and wrap the string in quotes (single or double) if the string contains any spaces.

> Set-Location Registry::HKCU

> Find-RegistryValue -seek \Microsoft\
[...]
parsing "\Microsoft\" - Unrecognized escape sequence \M.
At Find-RegistryValue:15 char:8
+             if ($val -match $seek) {
+                 ~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OperationStopped: (:) [], ArgumentException
    + FullyQualifiedErrorId : System.ArgumentException

parsing "\Microsoft\" - Unrecognized escape sequence \M.

• Command Find-RegistryValue -seek '\\Microsoft\\' succeeded and produced results.

> Find-RegistryValue -seek '\\Microsoft\\'
[...]
ValueName 192
Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\[...]
Value {C:\ProgramData\Microsoft\Windows\Start Menu\Programs\[...].lnk, C:\Program Files\Microsoft\[...].exe}

PowerShell function Replace-RegistryValue requires two parameters, -seek and  -swap, both of type string.  Running Find-RegistryValue first is highly recommended as it is only reads.


function Replace-RegistryValue (
[string] $seek = $(throw “seek required.”),
[string] $swap = $(throw “swap required.”),
[System.Management.Automation.PathInfo] $regpath = (Get-Location)
){
$find = Find-RegistryValue -seek $seek -regpath $regpath;
$results = @();

foreach ($target in $find) {
$nval = $target.Value -replace $seek, $swap;
$r = @{};
$r.Key = $target.Key;
$r.ValueName = $target.ValueName;
$r.OldValue = $target.Value;
$r.NewValue = $nval;
$results += $r;
$wKey = (Get-Item $r.Key.PSParentPath).OpenSubKey($r.Key.PSChildName, “True”);
$wKey.SetValue($target.ValueName, $nval);
}
$results;
}

Microsoft have issued the following warning with respect to the Windows Registry:

"Modifying the Windows Registry incorrectly can cause serious, system-wide problems that may require you to re-install Windows to correct them. Microsoft cannot guarantee that any problems resulting from the use of Registry Editor can be solved. Use this tool at your own risk."

Note: What you see when opening the registry editor or backing it up, may vary slightly according to your operating system.

Additional disclaimer: 

This information is provided "as is", without warranty of any kind, express or implied, including, but not limited, to the warranties of merchantability, fitness for a particular purpose, and non-infringement.

In no event shall the authors be liable for any claim, damages or other liability, whether in an action of contract, tort or otherwise, arising from, out of or in connection with the software or the use or other dealings in the software.