Does anyone know how to read out registry key values in PowerShell? The equivalent request in CMD can be seen on the picture.

3 Answers

Get-ChildItem is the one to use, and a quickie would be:

Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion'

More examples here:

If you want to get a specific key value:

$val = (Get-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName').ComputerName

And how to set/edit appropriately

Get-ItemPropertyValue

For registry operations, use:

• Get-ItemProperty and Get-ItemPropertyValue to read registry values and data
• Get-Item to get registry keys and sub-keys (but not to read registry values and data)
• Get-ChildItem to list sub-keys within keys and hives
• Optionally, use New-PSDrive to make registry drives (only HKCU and HKLM exist by default). Note you can also use long form without mounting (more details below)

For more information, see Registry Provider.

Example

Using your example as a starting point, which is using the HKEY_USERS registry root key, I'm going to lookup the MenuBar color, since the key you had was not available on my system.

CMD

reg query "HKEY_USERS\.DEFAULT\Control Panel\Colors" /v MenuBar

PowerShell

Using Get-ItemPropertyValue:

PS C:\> Get-ItemPropertyValue 'Registry::HKEY_USERS\.DEFAULT\Control Panel\Colors' -Name MenuBar
240 240 240

Using Get-ItemProperty:

PS C:\> (Get-ItemProperty 'Registry::HKEY_USERS\.DEFAULT\Control Panel\Colors').MenuBar
240 240 240

Using New-PSDrive to mount HKEY_USERS as HKU:

PS C:\> New-PSDrive -PSProvider Registry -Root HKEY_USERS -Name HKU
Name Used (GB) Free (GB) Provider Root
---- --------- --------- -------- ----
HKU Registry HKEY_USERS
PS C:\> Get-ItemPropertyValue 'HKU:\.DEFAULT\Control Panel\Colors' -Name MenuBar
240 240 240
PS C:\>

Documentation

From Registry Provider:

The registry is divided into keys, subkeys, and entries. For more information about registry structure, see Structure of the Registry.

In a Registry drive, each key is a container. A key can contain any number of keys. A registry key that has a parent key is called a subkey. You can use Get-ChildItem to view registry keys and Set-Location to navigate to a key path.

Registry values are attributes of a registry key. In the Registry drive, they are called Item Properties. A registry key can have both children keys and item properties.

...

Each registry key can also have subkeys. When you use Get-Item on a registry key, the subkeys are not displayed. The Get-ChildItem cmdlet will show you children items of the "Spooler" key, including each subkey's properties. The parent keys properties are not shown when using Get-ChildItem.

From Get-Item:

This command shows the contents of the Microsoft.PowerShell registry key. You can use this cmdlet with the PowerShell Registry provider to get registry keys and subkeys, but you must use the Get-ItemProperty cmdlet to get the registry values and data.

This format, while very similar can also be used:

$username = Get-ItemProperty -path "HKCU:\Volatile Environment"

Which creates an object. The properties can be called using:

$username.username