Accessing the Windows Registry from PowerShell

PowerShell’s Registry provider exposes the registry as a navigable drive — you can cd into hives and treat keys like directories:

cd HKLM:\            # HKEY_LOCAL_MACHINE
cd HKCU:\            # HKEY_CURRENT_USER

Only two drives are mapped by default (HKLM:, HKCU:), but any hive is reachable via the provider-qualified path syntax, e.g. Registry::HKEY_USERS\.DEFAULT, or by mounting additional drives with New-PSDrive -PSProvider Registry -Root HKEY_CLASSES_ROOT -Name HKCR.

The five major hives:

Hive	Short	Contents
HKEY_CLASSES_ROOT	HKCR	File associations, COM registrations
HKEY_CURRENT_USER	HKCU	Per-user settings for the loaded profile
HKEY_LOCAL_MACHINE	HKLM	Machine-wide config: services, SAM (protected), software
HKEY_USERS	HKU	All loaded user hives (HKCU + others)
HKEY_CURRENT_CONFIG	HKCC	Current hardware profile

Keys vs. values — the gotcha

The provider treats registry keys as items (directories) and registry values as properties of those keys. Different cmdlets for each:

Get-ChildItem HKLM:\SOFTWARE\Microsoft\Windows            # list subkeys
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion"   # read values
(Get-ItemProperty "...").ProductName                      # one value
New-Item -Path "HKCU:\Software\MyKey"                     # create a key
New-ItemProperty -Path "HKCU:\Software\MyKey" -Name Flag -Value 1 -PropertyType DWORD
Set-ItemProperty -Path "HKCU:\Software\MyKey" -Name Flag -Value 0
Remove-ItemProperty -Path "HKCU:\Software\MyKey" -Name Flag

Operational relevance

• Reading HKLM:\SYSTEM\CurrentControlSet\Services\<svc> is how you enumerate service configuration (ImagePath, ObjectName) — see windows-services.
• Registry writes are the substrate of countless post-exploitation tweaks, e.g. enabling RDP Restricted Admin mode via New-ItemProperty.
• Credential hunting includes registry queries for application-stored secrets — see putty-saved-sessions (MITRE T1552.002, Credentials in Registry).
• Alternative access: reg.exe (reg query/add/delete) works from cmd and PowerShell alike and survives in environments where the provider is awkward (remote, constrained); see windows-reconnaissance-commands.

Tracking registry changes over time

To diff the registry (spot what an installer, update, or piece of malware changed), snapshot before/after and compare. The practical method from the field: export the two states with reg export (or copy keys via the provider), then diff the resulting .reg files — or, staying in PowerShell, snapshot the keys’ value sets and compare objects:

$before = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*"
# ... make the change / let the installer run ...
$after  = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*"
Compare-Object $before $after -Property PSChildName, DisplayName, DisplayVersion

This is a handy blue-team diagnostic for spotting persistence keys (see registry-run-keys-and-startup-folder) and a red-team check for what footprints a payload leaves.

Related

• putty-saved-sessions — concrete credential-hunting example under HKCU\Software\SimonTatham
• windows-services — service config lives under HKLM\SYSTEM\CurrentControlSet\Services
• rdp-restricted-admin-mode — a registry value that unlocks PtH-over-RDP
• windows-reconnaissance-commands — reg query for discovery (T1012)

Sources

• Microsoft Learn — about_Registry_Provider
• Microsoft Learn — about_Providers
• BleepingComputer — Track Windows Registry changes with PowerShell