Using objects correctly to compare various Registry Keys on different Servers

by Sep 4, 2014

I would like to compare two Servers registry keys to make sure they both match.

 

Something simple like this was the initial plan:

 

    $remote1 = (invoke-command -computername hostname `

    {Get-ItemProperty     "HKLM:SOFTWAREVENDORAPPSUBFOLDER"})

    $local1 = (invoke-command `

    {Get-ItemProperty  "HKLM:SOFTWAREVENDORAPPSUBFOLDER"})

 

    $compare1 = Compare-Object $local1 $remote1

 

That works great for one single specified key but I have multiple keys with sub folders. I can't provide a list of the ones I want to check (and loop round) as I want to make sure nothing new has been added. So I was drawn down this route to get all the keys under a specified branch in the Registry (to get me a list):

 

    $local1 = Get-ChildItem HKLM:SOFTWAREMICROSOFTDirectShow -Recurse `

    -ErrorAction SilentlyContinue

 

So I now have an object that will tell me all the registry SUBFOLDERS on the server and I could then loop round using $local1.PSPath to give me all the paths but I noticed something in the object that was interesting:

 

    $local1 | select -first 1 -prop *

 

This returns:

 

    Property      : {dbl3, dbl4, dbl5, dbl6…}

    PSPath        : A path 

    PSParentPath  : A Parent Path 

    PSChildName   : 0

    PSDrive       : HKLM

    PSProvider    : Microsoft.PowerShell.CoreRegistry

    PSIsContainer : True

    SubKeyCount   : 0

    View          : Default

    Handle        : Microsoft.Win32.SafeHandles.SafeRegistryHandle

    ValueCount    : 8

    Name          : A Name

 

 

So the Object member "Property" contains what looks like an array of all the keys or is it a sub Object?

 

 

If it was a sub-object does it contain the keys values that I am looking to compare?

 

I could just snatch out the $local.Name member and loop round comparing using the code above and storing any differences but I just wondered if it would be more efficient to use the data that I already have if it contains the information I need?  

 

I am hoping that someone could confirm that if I did:

 

     $local1 = Get-ChildItem HKLM:SOFTWAREMICROSOFTDirectShow -Recurse `

    -ErrorAction SilentlyContinue

 

     $remote1 (invoke-command -computername remoteserver1 `

     {Get-ChildItem HKLM:SOFTWAREMICROSOFTDirectShow -Recurse `

     -ErrorAction SilentlyContinue})

 

When I do the compare am I actually comparing the keys and values match or just that keys exist? :

 

    Compare-Object $local1 $remote1

 

To cut a long story short, I think I have all the data I need to compare that the Registry key values match (by running this):

 

    $local1

 

Returns (extract):

 

    Hive: HKEY_LOCAL_MACHINESOFTWAREMICROSOFTDirectShow

 

 

    Name                           Property                                                                                                                                                       

    —-                           ——–                                                                                                                                                       

    Debug                                                                                                                                                                                         

    DoNotUse                                                                                                                                                                                      

    DoNotUseDrivers32                                                                                                                                                                             

    Preferred                      {00001602-0000-0010-8000-00aa00389b71} : {E1F1A0B8-BEEE-490D-BA7C-066C40B5E2B9}                                                                                

                                   {e06d8032-db46-11cf-b4d1-00805f6cbbea} : {E1F1A0B8-BEEE-490D-BA7C-066C40B5E2B9}                                                                                

                                   {00000160-0000-0010-8000-00aa00389b71} : {2eeb4adf-4578-4d10-bca7-bb955f56320a}                                                                                

                                   {41564D57-0000-0010-8000-00AA00389B71} : {82d353df-90bd-4382-8bc2-3f6192b76e34}                                                                                

                                   {e06d8026-db46-11cf-b4d1-00805f6cbbea} : {212690FB-83E5-4526-8FD7-74478B7939CD} 

 

Am I correct and does anyone know how to access individual items from the $local1 object? Taking the example above, what is a Hive? Say I wanted the "00001602-0000-0010-8000-00aa00389b71" value how would I get it from the $local1 object.

 

A point to note that the servers are running Powershell 2 while I am testing on Powershell 4 (I can't test on a Production server). I mention this as running $local1 on the v2 servers I get a different output in that the properties do not seem to be in pairs.

 

    Hive: HKEY_LOCAL_MACHINESOFTWAREMICROSOFTDirectShow

 

 

    SKC  VC Name                           Property

    —  — —-                           ——–

    0   0 Debug                          {}

    0   0 DoNotUse                       {}

    0   0 DoNotUseDrivers32              {}

    0  10 Preferred                      {{00000050-0000-0010-8000-00AA00389B71}, {e436eb80-524f-11ce-9f53-0020af0ba77…

 

Is this case where the v4 objects will do what I want but the v2 won't?