Delete registry string that contains specific value - powershell

Question

I am trying to delete registry string that contains value “Palo Alto Networks”
Path: HKEY_USERS\S-1-5-21-484763869-1659004503-1644491937-15773\Software\Microsoft\Windows\CurrentVersion\UFH\SHC
String: 61
Value: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Palo Alto Networks\GlobalProtect\GlobalProtect.lnk
C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe
/noshrink
I want the script to delete string “61” if it detects value “Palo Alto Networks” in it.
This is the code that I think close to what I aim.
Get-ItemProperty -Path $SearchBase |
Where-Object {
$_.$RegKeyValueName -match $RegKeyValueDataPattern
} |
Remove-ItemProperty -Name $RegKeyValueName
However, $RegKeyValueName is random. It could be other than 61.
My aim is if $RegKeyValueDataPattern match, it will delete the $RegKeyValueName

Answer 1

OK I'm not completely sure what exactly you like to delete. It might help you for the next time when you take a look at the following Info: Structure of the Registry.
If you like to get the registry key values and you know the name you can use following syntax:
$SearchBase = 'REGISTRY::HKEY_USERS\S-1-5-21-484763869-1659004503-1644491937-15773\Software\Microsoft\Windows\CurrentVersion\UFH\SHC'
$RegKeyValueName = '61'
$RegKeyValueDataPattern = 'Palo Alto Networks'
Get-ItemProperty -Path $SearchBase
If you're looking for a specific value you can either specify the name ...
Get-ItemProperty -Path $SearchBase -Name $RegKeyValueName
... or filter the output with a Where-Object ...
Get-ItemProperty -Path $SearchBase |
Where-Object {
$_.$RegKeyValueName -match $RegKeyValueDataPattern
}
If you like to delete only the data of the value you can use Set-ItemProperty and provide an empty string ...
Get-ItemProperty -Path $SearchBase |
Where-Object {
$_.$RegKeyValueName -match $RegKeyValueDataPattern
} |
Set-ItemProperty -Name $RegKeyValueName -Value ''
.... or if you like to delete the complete value you can use Remove-ItemProperty ...
Get-ItemProperty -Path $SearchBase |
Where-Object {
$_.$RegKeyValueName -match $RegKeyValueDataPattern
} |
Remove-ItemProperty -Name $RegKeyValueName
.... and if you don't know the name of the value you like to delete you can use the following code scnippet:
Get-Item -Path $SearchBase |
Select-Object -ExpandProperty Property |
Where-Object {
(Get-ItemProperty -Path $SearchBase -Name $_ ) -match $RegKeyValueDataPattern
} |
ForEach-Object {
Remove-ItemProperty -Path $SearchBase -Name $_
}