Using Remote Registry in Powershell

I have searched in Google and tried several examples from Stackoverflow and other websites. While I can use the commands in the solutions to get registry settings for some things, I cannot get the information from the path below.

HKCU:\Software\Interwoven\WorkSite\8.0\EMM\Config

I know this path is valid because I can pull it up in the registry and can pull it up using remote registry outside of Powershell. The command I'm using is below.

Invoke-Command –ComputerName ABC-V-12345 -Credential: 'domain\username' {Get-ItemProperty -Path 'HKCU:\Software\Interwoven\WorkSite\8.0\EMM\Config'}

The error I get is as follows:

Cannot find path 'HKCU:\SOFTWARE\Interwoven\WorkSite' because it does not exist. + CategoryInfo : ObjectNotFound: (HKCU:\SOFTWARE\Interwoven\WorkSite:String) [Get-ItemProperty], ItemNotFoundException + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetItemPropertyCommand + PSComputerName : ABC-V-12345

How can I get the return data from this command?

Below is a screenshot of the commands and errors messages received from each command.

2 Answers

Without using Invoke-Command, you can get this info using [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey() on the HKEY_USERS registry hive.
For this, you need to know the (string) user SID which is obtained easily enough using the Get-ADUser cmdlet.

The below code assumes you want to get this registry info for the user that is currently logged on the remote computer:

Import-Module ActiveDirectory
$computerName = 'ABC-V-12345'
# get the domain\username of the user currently logged in to the computer
$user = (Get-CimInstance -ClassName Win32_ComputerSystem -ComputerName $computerName).UserName
# get the SID for that user
$sid = (Get-ADUser -Identity $(($user -split '\\', 2)[0])).SID
if (!$sid) { Throw "Could not determine the SID for user '$user'"
}
# read the values in registry key 'HKEY_USERS\$sid\Software\Interwoven\WorkSite\8.0\EMM\Config'
$hive = [Microsoft.Win32.RegistryHive]::Users
$path = "$sid\Software\Interwoven\WorkSite\8.0\EMM\Config"
try { $base = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey($hive, $computerName) $key = $base.OpenSubKey($path) if (!$key) { Write-Warning "Registry key '$path' does not exist" } else { $result = foreach ($ValueName in $key.GetValueNames()) { [PsCustomObject]@{ 'ValueName' = if (!$ValueName -or $ValueName -eq '@') { "(Default)" } else { $ValueName } 'ValueData' = $key.GetValue($ValueName) 'ValueKind' = $key.GetValueKind($ValueName) } } }
}
catch { Throw
}
finally { if ($key) { $key.Close() } if ($base) { $base.Close() }
}
# output on screen
$result | Sort-Object ValueName
# or output to CSV file
$result | Sort-Object ValueName | Export-Csv -Path 'X:\output.csv' -NoTypeInformation

P.S. If you are not on an ActiveDirectory domain, you can get the SID for the user with below function:

function Get-UserSID { param ( [Parameter(ValuefromPipeline = $true, Position = 0)] [Alias('Account', 'User')] [string]$UserName = $env:USERNAME, [string]$Domain = $env:USERDOMAIN ) if ($UserName.Contains("\")) { $Domain, $UserName = $UserName -split '\\', 2 } #"# split on the backslash try { $objUser = New-Object System.Security.Principal.NTAccount($Domain, $UserName) $strSID = $objUser.Translate([System.Security.Principal.SecurityIdentifier]) $strSID.Value } catch [System.Security.Principal.IdentityNotMappedException] { Write-Warning "User '$UserName' does not exist in '$Domain'" } catch { throw }
}

Use this with:

$user = (Get-CimInstance -ClassName Win32_ComputerSystem -ComputerName $computerName).UserName
$sid = Get-UserSID $user

There are 3 cmdlets on this space. So, which aspect of the hives will determine which to use. DO, you get not found for all three?

Get-Item Gets the item at the specified location.

Invoke-Command –ComputerName 'ABC-V-12345' -ScriptBlock {Get-Item -Path 'HKCU:\Software\Interwoven\WorkSite\8.0\EMM\Config'} -Credential 'domain\username'

Get-ItemProperty Gets the properties of a specified item.

Invoke-Command –ComputerName 'ABC-V-12345' -ScriptBlock {Get-ItemProperty -Path 'HKCU:\Software\Interwoven\WorkSite\8.0\EMM -Name Config'} -Credential 'domain\username' 

Get-ItemPropertyValueGets the value for one or more properties of a specified item.

Invoke-Command –ComputerName 'ABC-V-12345' -ScriptBlock {Get-ItemPropertyValue -Path 'HKCU:\Software\Interwoven\WorkSite\8.0\EMM -Name Config'} -Credential 'domain\username'

If you just did this...

Invoke-Command –ComputerName 'ABC-V-12345' -ScriptBlock {Get-ChildItem -Path 'HKCU:\Software\Interwoven\WorkSite\8.0\EMM' -Recurse} -Credential 'domain\username'

... do you also get back not found or nothing?

Update as per your request moving my comment to here

@postnote This worked. Please edit the answer to show this and I will accept it. However, when I got to 8.0 the EMM name wasn't there. I put it in the path manually and it came back with the cannot find the path error. I tried another computer the same way that I knew all the keys were on and I found it. This worked while in the interactive session. Thank you. "Get-ChildItem -Path 'HKCU:\Software\Interwoven\WorkSite\8.0'"

In the interactive session, don't use the invoke, just use the GCI as normal to see what comes back. So, GCI to only interwoven, then WorkSite, etc... Anytime you see this ...Name[0]... it means you did not pass in all the params needed. Yet, based on what you are doing, that should not be a thing. So, do a GCI one path at a time and see what comes back.

No worries, and glad this got you your result. Yet, anything in an interactive session should work in an implicit remote session / using Invoke. So, as you found out, some systems may not have this, so, change your code to have an if/then or try/catch to deal with that.

Something along the lines of this...

Invoke-Command –ComputerName 'ABC-V-12345' -ScriptBlock {
Try { Get-ChildItem -Path 'HKCU:\Software\Interwoven\WorkSite\8.0' -Recurse}
Catch {Write-Warning -Message "The registry path / key / value was not found on $env:ComputerName"}
} -Credential 'domain\username'