working on a specific registry entry

I like:

Getting a Single Registry Entry

If you wish to retrieve a specific entry in a registry key, you can
use one of several possible approaches. This example finds the value
of DevicePath in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
\CurrentVersion.

Using Get-ItemProperty, use the Path parameter to specify the name of
the key, and the Name parameter to specify the name of the DevicePath
entry.

PS> Get-ItemProperty -Path HKLM:\Software\Microsoft\Windows
\CurrentVersion -Name DevicePath


PSPath       : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE
\Software\
               Microsoft\Windows\CurrentVersion
PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE
\Software\
               Microsoft\Windows
PSChildName  : CurrentVersion
PSDrive      : HKLM
PSProvider   : Microsoft.PowerShell.Core\Registry
DevicePath   : C:\WINDOWS\inf

This command returns the standard Windows PowerShell properties as
well as the DevicePath property.


 http://www.**--****.com/ 



How would this be combined with the REG QUERY command to find and echo
each entry which has references "foo.dll"?


thanks,

Thufir

[...]

something along the lines of:

 http://www.**--****.com/ 

but returning the entries which are found by searching through the
regedit GUI for "foo.dll" which will find the entries one at a time.



thanks,

Thufir

Not sure exactly what you're after, but possibly something like

$key = Get-Item "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs"
$key.GetValueNames() | `
where {([io.path]::GetFileName($_)).Contains('mscor')}

-- 
Jon

$key = all the SharedDLL's, or just one?



this returns the file info of the SharedDLL's?



thanks,

Thufir

All the shared DLLs. Everything you see in the right pane when clicking the 
key in the left pane within regedit.


It returns those entries there containing 'mscor' in their name.

It doesn't actually touch the file itself. It just parses the path like a 
string, and examines the relevant info - in this particular case the 
filename.




-- 
Jon

Ok, I understand.  What I wanted to do was to go at it from the
opposite direction, to each entry which has "foo.dll" in the entry.

Ok, I understand.  What I wanted to do was to go at it from the
opposite direction, to find each entry which has "foo.dll" in the
entry.

[...]

What I wanted to do was to go at it from the opposite direction, to
find each entry which has "foo.dll" in the entry. Rather than:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion

how could all of the hives, in their entirety, be searched?



thanks,

Thufir

To process the data in the entry, you could use something like ....

#-------------------
$key = Get-Item "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs"

foreach ($ValueKey in $key.GetValueNames()) {
 if ($Key.GetValue($ValueKey) -eq 4096) {$ValueKey}
}
#-------------------

There are better tools around to search all the hives in their entirety. 
You'd be sitting there a long time otherwise I would suspect. I wouldn't 
personally recommend Powershell for that.

This is one such tool, which is pretty good...

RegScanner
 http://www.**--****.com/ 


-- 
Jon

"Jon"


Well if one is going to run and learn another
process well then perhaps try the free IIS's
Microsoft's (local or remote) data parser,
Log Parser 2.2 (with built-in Microsoft
ChartSpace chart maker)!

Log Parser parses almost anything in
almost any Windows language. If Log
Parse doesn't parse what one needs
(either via the Log Parser's command
line usage or by Log Parser's scripting
each parsed line field by field) well then
one can add into Log Parser their needed
parsing!

As for the registry:

LogParser.exe -h -i:reg

Input format: REG (Registry properties)
Returns properties of registry keys and values

Notice: IIS does not need to be running
or installed in order to use Log Parser
for either data parsing or chart making.

Search the Internet
(and this newsgroup)
for usage of:

Microsoft's Log Parser
command line usage,
or fully script enabled
either in COM or .NET
(from the IIS group)

Remember, ever since PowerShell
added HTTP / HTTPS usage (like IIS)
Log Parser became PowerShell's data
parser (like Log Parser is for IIS) too!

Nice plug. Are those flowering weeds legal?

-- 
Jon