Hey im trying to enumerate URL schemes in the registry but unfortunetly this is bit harder than i thought
So first of all
New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT
$REGPATH = "HKCR:\"
Get-ChildItem "$REGPATH"
Hive: HKEY_CLASSES_ROOT
Name Property
---- --------
* AlwaysShowExt :
ConflictPrompt : prop:System.ItemTypeText;System.Size;System.Date
Modified;System.DateCreated
ContentViewModeForBrowse : prop:~System.ItemNameDisplay;System.ItemTypeText
;~System.LayoutPattern.PlaceHol
der;~System.LayoutPattern.PlaceHolder;System.Dat
eModified;System.Size
ContentViewModeForSearch :
[....]
ss
AcroAccess.AcrobatAccess.1 (default) : AcrobatAccess Class
acrobat URL Protocol :
(default) : URL:Acrobat Protocol
acrobat2018 URL Protocol :
(default) : URL:Acrobat Protocol
I tried to filter it out to just get only custom schemes but with no good result:
New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT
$REGPATH = "HKCR:\"
Get-ChildItem "$REGPATH" | Where-Object {$_.Property -Match "^(default) : URL:.*"}
at this point i think it is the easiest way:
New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT
$REGPATH = "HKCR:\"
Get-ChildItem "$REGPATH" >> temp.txt
Select-String -Path .\tmp.txt -Pattern 'URL:'
Related
I am trying to search the HKLM hive for the key driverdesc that contains the value -like "*Ethernet*"
I can retrieve all the keys with driverdesc, however I cannot filter for the one containing Ethernet and then add the REG_DWORD 'PNPCapabilities' to that key.
Here's how I am searching the registry:
Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}" -Recurse -ErrorAction SilentlyContinue | foreach {$_.GetValue("Driverdesc")} | Out-String $Items
$items
You could use my function Search-Registry for this.
Search the registry like this:
Search-Registry -KeyPath 'HKLM:\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}' -Pattern "*Ethernet*" -SearchPropertyValue -Recurse
This will return an array of objects with the following properties (example):
ComputerName : YOURMACHINE
Hive : LocalMachine
HiveName : HKEY_LOCAL_MACHINE
HiveShortName : HKLM
Path : HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0007
SubKey : SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0007
ItemType : RegistryProperty
DataType : REG_SZ
ValueKind : String
PropertyName : DriverDesc
PropertyValue : Realtek RTL8168D/8111D Family PCI-E Gigabit Ethernet NIC (NDIS 6.20)
PropertyValueRaw : Realtek RTL8168D/8111D Family PCI-E Gigabit Ethernet NIC (NDIS 6.20)
Using these properties (most likely Path) it should be easy enough to add a new DWord value. So in your case:
$value = 1234
$items = Search-Registry -KeyPath 'HKLM:\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}' -Pattern "*Ethernet*" -SearchPropertyValue -Recurse -Verbose
$items | Where-Object { $_.PropertyName -eq 'DriverDesc' } | ForEach-Object {
# New-ItemProperty either wants the shortpath notation 'HKLM:\path'
# or uses the 'Registry::HKEY_LOCAL_MACHINE\path' notation
$path = $_.HiveShortName + ':\' + $_.SubKey
New-ItemProperty -Path $path -Name 'PNPCapabilities' -Value $value -PropertyType DWORD -Force| Out-Null
}
This script is supposed to create some new drives but after i run it they dont exist, any ideas why? totally stuck....
Thanks in advance
Function New-Drives {
Param()
New-PSDrive -Name AppData -PSProvider FileSystem -Root $env:Appdata
New-PSDrive -Name Temp -PSProvider FileSystem -Root $env
$env:TEMP=Join-Path -Path C:\Windows\Temp
$mydocs=Join-Path -Path $env:userprofile -ChildPath Documents
New-PSDrive -Name Docs -PSProvider FileSystem -Root $mydocs
}
DIR temp: | measure-object –property length -sum
New-Drives
you need to add the -Persist parameter to your New-PSDrive calls. otherwise it will only create the drive within your powershell session.
I tried running this script using the ISE, and I also tried to run it on the command line as administrator. It freezes at the "Remove-ItemProperty" line. I've tried to remove that step, but then it freezes at the next step "Set-ItemProperty". It looks like the New-Item lines are working fine.
if (Test-path "HKCR:\")
{
}
else
{
New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT
}
Add-Type -AssemblyName System.IO.Compression.FileSystem
function Unzip
{
param([string]$zipfile, [string]$outpath)
[System.IO.Compression.ZipFile]::ExtractToDirectory($zipfile, $outpath)
}
Unzip "npp.6.7.5.bin.zip" “C:\Notepad++”
New-Item -Type String "HKCR:\*\shell\Open With Notepad++"
New-Item -Type String "HKCR:\*\shell\Open With Notepad++\command"
Remove-ItemProperty "HKCR:\*\shell\Open With Notepad++\command" -name "(Default)"
Set-ItemProperty "HKCR:\*\shell\Open With Notepad++\command" -name "(Default)" -value "C:\\Notepad++\\notepad++.exe %1"
Any suggestions?
When using ItemProperty commands it interprets * as a wildcard. It's not freezing, it's searching every subkey of HKCR for "shell\Open With..." etc.
To force it to interpret the whole thing as a string path you need to use the -LiteralPath switch:
New-Item -Type String "HKCR:\*\shell\Open With Notepad++"
New-Item -Type String "HKCR:\*\shell\Open With Notepad++\command"
Set-ItemProperty -LiteralPath "HKCR:\*\shell\Open With Notepad++\command" -name "(Default)" -value "C:\\Notepad++\\notepad++.exe %1"
I can get registry elements like this:
PS> $Registry_Key = "HKLM:\SOFTWARE\Wow6432Node\Lenovo\Access Connections\Locations\*\*\*"
PS> Get-ItemProperty -path $Registry_Key -name m_bSetBrowserPxySettings -ErrorAction SilentlyContinue
PSPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Lenovo\Access Connections\Locations\BMZ-GmbH\AdptList\Adpt00
PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Lenovo\Access Connections\Locations\BMZ-GmbH\AdptList
PSChildName : Adpt00
PSDrive : HKLM
PSProvider : Microsoft.PowerShell.Core\Registry
m_bSetBrowserPxySettings : 1
PSPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Lenovo\Access Connections\Locations\BMZ-GmbH\AdptList\Adpt01
PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Lenovo\Access Connections\Locations\BMZ-GmbH\AdptList
PSChildName : Adpt01
PSDrive : HKLM
PSProvider : Microsoft.PowerShell.Core\Registry
m_bSetBrowserPxySettings : 1
But now I want to delete m_bSetBrowserPxySettings completely, or change the value to "0" for every match in this search. Change or delete doesn't matter. What do I have to add to my script to achieve this?
You can do it as follows:
$Registry_Key = "HKLM:\SOFTWARE\Wow6432Node\Lenovo\Access Connections\Locations\*\*\*"
Get-ItemProperty -path $Registry_Key -name m_bSetBrowserPxySettings -ErrorAction SilentlyContinue | % { Set-ItemProperty -path $_.PSPath -name m_bSetBrowserPxySettings "0" }
You need pipe the Get-ItemProperty command to:
% { Set-ItemProperty -path $_.PSPath -name m_bSetBrowserPxySettings "0" }
% represents the ForEach-Object cmdlet. What it will do is iterate over each item in the collection you get out of the Get-ItemProperty command. $_ represents the object in the pipeline, so this will change to the new item on each iteration.
$_.PSPath is the path to the registry key of the item. You can see this printed in the table in your question. You can use this value to pass to Set-ItemProperty along with your name and then set the value to whatever you want.
If you wanted to remove the item altogether, pipe to the following instead:
% { Remove-ItemProperty -path $_.PSPath -name m_bSetBrowserPxySettings }
Rather than working with the path all the time you can just work on the item itself:
$Registry_Key = "HKLM:\SOFTWARE\Wow6432Node\Lenovo\Access Connections\Locations\*\*\*"
$item = Get-Item $Registry_Key
$item | Get-ItemProperty -name m_bSetBrowserPxySettings -ErrorAction SilentlyContinue
Then to set it to 0:
$item | Set-ItemProperty -name m_bSetBrowserPxySettings "0"
Or to delete it:
$item | Remove-ItemProperty -name m_bSetBrowserPxySettings
The following code will copy files to remote_computer if I use its IP address 10.10.10.10
$j = "remote_computer"
New-PSDrive -Name Z -PSProvider FileSystem -Root \\$j\share -Credential $credentials -ErrorAction Stop
Copy-Item -Path D:\ps_*able.ps1 -Destination \\10.10.10.10\share
Remove-PSDrive -name Z
This script will NOT copy over files if I use Z, the psdrive
$j = "remote_computer"
New-PSDrive -Name Z -PSProvider FileSystem -Root \\$j\share -Credential $credentials -ErrorAction Stop
Copy-Item -Path D:\ps_*able.ps1 -Destination Z
Remove-PSDrive -name Z
How to fix?
"Z" is not a valid path
Copy-Item -Path D:\ps_*able.ps1 -Destination Z:\