Pages

Monday, 17 June 2024

User registry through PS

 New-PSDrive HKU Registry HKEY_USERS | Out-Null

$user = Get-WmiObject -Class Win32_ComputerSystem | Select-Object -ExpandProperty Username
$sid = (New-Object System.Security.Principal.NTAccount($user)).Translate([System.Security.Principal.SecurityIdentifier]).Value
$key = "HKU:\$sid\Software\Test"
$reg = Get-Item -Path $key -ErrorAction SilentlyContinue

if (-not $reg) {
    Write-Host "Registry key didn't exist, creating it now"
    New-Item -Path "HKU:\$sid\Software" -Name "Test" -Force | Out-Null
}

if (-not $reg) {
    Write-Host "Registry key didn't exist, creating it now"
    New-ItemProperty -Path "HKU:\$sid\Software\Test" -Name "Testing" -Value "working" -PropertyType String | Out-Null
} else {
    Write-Host "Registry key changed to 1"
    Set-ItemProperty -Path "HKU:\$sid\Software\Test" -Name "Testing" -Value "working" | Out-Null
}

No comments:

Post a Comment

User based detection

function getloggedindetails () {     ##Find logged in username     $user = Get-WmiObject Win32_Process - Filter "Name='explorer...

Search This Blog