Script to read Registry key value

[fiza]

Is there a way to interrogate a remote machine for a particular registry key value and then pipe this out to a text file along with the name of the machine? Edited February 24, 2017 by fiza

[fredbayker]

I think you can do this with powershell or use WMI functionality within a VBscript. I'll see if I can dig out an example.

[Sephiroth]

Are you looking for the contents of a key or a value within a key?

[fiza]

Are you looking for the contents of a key or a value within a key?

 

value within a key. If the key doesnt exist I dont want the script to error out, just continue to the next remote machine.

[fiza]

I think you can do this with powershell or use WMI functionality within a VBscript. I'll see if I can dig out an example.

 

I have an example powershell script which works on my machine but I need to enable remote registry before I can connect to remote machines. I have tried to find the powershell command to enable remote registry on a machine but I cant find it.

[Sephiroth]

To enable remote registry, I would recommend Group Policy:

 

1. Computer Configuration > Policies > Windows Settings > Security Settings > System Services
   
2. Find the Remote Registry item and change the Service startup mode to Automatic
   
3. Reboot the clients
   

 

Then this PS script should work:

$ComputerName = 'RemotePCName'
$Hive = [Microsoft.Win32.RegistryHive]::LocalMachine
$KeyPath = 'Path\To\Key'
$Value = 'ValueInKey'

$reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey($Hive, $ComputerName)
$key = $reg.OpenSubKey($KeyPath)

$Result = $key.GetValue($Value)
$Txt = "$ComputerName - $Result"
$Txt >> C:\textdoc.txt

[fiza]

To enable remote registry, I would recommend Group Policy:

 

 

We normally have it as default disabled. Is it safe to have it set to start automatically?

[fiza]

To enable remote registry, I would recommend Group Policy:

 

1. Computer Configuration > Policies > Windows Settings > Security Settings > System Services
   
2. Find the Remote Registry item and change the Service startup mode to Automatic
   
3. Reboot the clients
   

 

Then this PS script should work:

$ComputerName = 'RemotePCName'
$Hive = [Microsoft.Win32.RegistryHive]::LocalMachine
$KeyPath = 'Path\To\Key'
$Value = 'ValueInKey'

$reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey($Hive, $ComputerName)
$key = $reg.OpenSubKey($KeyPath)

$Result = $key.GetValue($Value)
$Txt = "$ComputerName - $Result"
$Txt >> C:\textdoc.txt

 

$Value what goes in here? Its the existing value in the key that I need to get

 

I get it now! I put the key name in there. The output works but I just need to be able to enable the remote registry temporarily until next boot.

Edited February 24, 2017 by fiza

[fiza]

ok so how can I get the script to read from either AD or from a text file with a list of machine names in?

Also what happens if that path doesn't exist on the remote machine?

[Sephiroth]

I do. I can't say that it's secure or best practice though. You could try running the following at the beginning and end of the run for each remote machine:

Start-Service RemoteRegistry



Stop-Service RemoteRegistry

I don't know that it'll work properly, but as far as I can tell, it should.

[fiza]

I do. I can't say that it's secure or best practice though. You could try running the following at the beginning and end of the run for each remote machine:

Start-Service RemoteRegistry



Stop-Service RemoteRegistry

I don't know that it'll work properly, but as far as I can tell, it should.

 

Thanks. Doesnt the command need to know which machine to start the remote registry on?

[Sephiroth]

Would look something like this:

$Computers = @("RemotePCName1","RemotePCName2")
$Hive = [Microsoft.Win32.RegistryHive]::LocalMachine
$KeyPath = 'Path\to\reg\key'
$Value = 'ValueInKey'

Foreach ($Computer in $Computers) {
   Get-Service -Name RemoteRegistry -ComputerName $Computer | Set-Service -Status Running
   $reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey($Hive, $Computer)
   $key = $reg.OpenSubKey($KeyPath)

   If ($key.GetValue($Value)) {
       $Result = $key.GetValue($Value)
       $Txt = "$ComputerName - $Result"
       $Txt >> C:\textdoc.txt
   }
   Get-Service -Name RemoteRegistry -ComputerName $Computer | Set-Service -Status Stopped
}

 

I've added in checking if the value exists. The if statement will error if the value doesn't exist, but should just carry on without printing to the file.

Edited February 24, 2017 by Sephiroth
Stupidly missed an important bit!

[fiza]

Would look something like this:

$Computers = @("RemotePCName1","RemotePCName2")
$Hive = [Microsoft.Win32.RegistryHive]::LocalMachine
$KeyPath = 'Path\to\reg\key'
$Value = 'ValueInKey'

Foreach ($Computer in $Computers) {
   Get-Service -Name RemoteRegistry -ComputerName $Computer | Set-Service -Status Running
   $reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey($Hive, $ComputerName)
   $key = $reg.OpenSubKey($KeyPath)

   If ($key.GetValue($Value)) {
       $Result = $key.GetValue($Value)
       $Txt = "$ComputerName - $Result"
       $Txt >> C:\textdoc.txt
   }
   Get-Service -Name RemoteRegistry -ComputerName $Computer | Set-Service -Status Stopped
}

 

I've added in checking if the value exists. The if statement will error if the value doesn't exist, but should just carry on without printing to the file.

 

Little lost now! Is the variable $computername still valid?

 

Just tried running it and I get an error

 

Get-Service : Cannot find any service with service name 'RemoteRegistry'.

At C:\dnavalues3.ps1:7 char:16

+ Get-Service <<<< -Name RemoteRegistry -ComputerName $Computer | Set-Service -Status Running

+ CategoryInfo : ObjectNotFound: (RemoteRegistry:String) [Get-Service], ServiceCommandException

+ FullyQualifiedErrorId : NoServiceFoundForGivenName,Microsoft.PowerShell.Commands.GetServiceCommand

Edited February 24, 2017 by fiza

[Sephiroth]

Sorry, no. Should be $Computer. Corrected on my post.

 

That's what the service is on all my clients, supported by searching online... can you run the script on localhost?

Forgive me potentially asking stupid questions, but have you changed $Computers to contain valid pc names?

[HPlum78]

### This script is used to check the registry for a key and value from a list of remote servers.

### Build list of remote servers from AD - the following pulls out all server that are server 2008 R2.

Get-ADComputer -filter {operatingSystemVersion -like "*6.1*" -and operatingSystem -like "Windows Server*"} | % {

 

### Pipe the Server name to test connect before we try to connect to the reg

if (Test-Connection -ComputerName $_.Name -Count 1 -Quiet) {

### if the connection can be made connect to the reg and check if the key existis if so get the value of the key

$Reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', $_.Name)

$RegKey= $Reg.OpenSubKey("SYSTEM\\CurrentControlSet\Control")

$RegVal = $RegKey.GetValue("ServicesPipeTimeout")

### write the value of the key and the value to the console

Write-Output "The computer $($_.Name) has the following value for ServicePipeTimeout $($RegVal)"

}

### if we cannot connect to a server we end up here

else{

### write the name of the server that cannot be connected to to the console

Write-Host -fore "Magenta" Unable to connect to $_.Name

}

}

Edited March 1, 2017 by HPlum78

[HPlum78]

A starter for 10 and to be honest checking that the remote reg service like in previous posts could also be done and is probably a good idea. The write-output can be changed to out-file and the horrid write-host that I have put at the end can also go (try not to use write-host in your PS code) again out to a file.... I am sure you see what I am getting at, its just to help get you on your way.