trim input from reg query - powershell

Question

Windows XP machine:
reg query "\\COMPUTER_NAME\HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\WinLogon" /v DefaultUserName
output of: DefaultUserName REG_SZ ajstepanik
.
Windows 7 machine
reg query "\\COMPUTER_NAME\HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI" /v LastLoggedOnUser
output of: LastLoggedOnUser REG_SZ GHS_NTDOMAIN\ajstepanik
.
.
I was wondering if it were possible to trim this down so I would be left with GHS_NTDOMAIN\ajstepanik ... or even better, if I could just get the username which in this example, is ajstepanik
The reason for pulling the name and storing it, is that I can take that and plug it into other commands.
.
.
EDIT for additional help (win7):
$reg1 = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', $tag1)
$key1 = $reg1.OpenSubKey('Microsoft\Windows\CurrentVersion\Authentication\LogonUI')
$user1 = $key1.GetValue('LastLoggedOnUser') -replace '^.*?\\'
echo $user1
returns error:
You cannot call a method on a null-valued expression.
At C:\Users\ajstepanik\Desktop\test.ps1:30 char:1
+ $user1 = $key1.GetValue('LastLoggedOnUser') -replace '^.*?\\'
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [], RuntimeException
+ FullyQualifiedErrorId : InvokeMethodOnNull

Answer 1

I'd drop reg.exe entirely and read the remote registry like this:
$rhost = 'COMPUTER_NAME'
$reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', $rhost)
$key = $reg.OpenSubKey('SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon')
$user = $key.GetValue('DefaultUserName') -replace '^.*?\\'
It's a cleaner approach, since GetValue already produces the actual value. You don't have to parse it out of some other string before you can do things with it.

Answer 2

Seems simple enough:
(reg query "\\%tag%\HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI" /v LastLoggedOnUser).split('\')[1]
It's giving you back a string. Just split it at the backslash. and take the second element.

Answer 3

You can use Microsoft .NET Framework types to query the registry remotely, and get an object result. Check out the Remote Registry module for PowerShell: http://archive.msdn.microsoft.com/PSRemoteRegistry
That being said, you can parse the output of your command above, like so:
$Output = reg query "\\%tag%\HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI" /v LastLoggedOnUser
$Output -join '' -match '\w+\\\w+$';
$matches[0];
If you want to take it one step further, you can parse the domain and username via regex "named groups" like so:
$output -join '' -match '(?<domain>\w+)\\(?<username>\w+)$';
$matches.username;
$matches.domain;