Tuesday, January 16, 2018

Powershell script to find startup registries

$pcs = Get-ADComputer -Filter "Name -like '*'" | select-object name
$strRegType = [Microsoft.Win32.RegistryHive]::LocalMachine
foreach ($pc in $pcs) {
    $computername = $pc.name
    if(Test-Connection -ComputerName $computername -Count 1 -Quiet){
        Try
        {
            $strRegKey  = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey($strRegType, $computername)
            $strKeyGroup = "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"
            #$strKeyGroup = $strSID + "\Software\Microsoft\Windows\CurrentVersion\RunOnce\"
            #$strKeyGroup = $strSID + "\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\"
            #$strKeyGroup = $strSID + "\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\"
            $strRegSubKey  = $strRegKey.OpenSubKey($strKeyGroup)
            $names = $strRegSubKey.GetValueNames()
            foreach( $name in $names) {
                $value = $strRegSubKey.GetValue($name)
                $str = $computername + "," + $name + "," + $value
                Write-Host $str
            }
            $strRegKey.Close()
        }
        Catch
        {
            $str = $computername + "," + ","
            Write-Host $str
        }
    }
    else{
        $str = $computername + "," + ","
        Write-Host $str
    }

}

No comments:

Post a Comment