Take the Winlogon registry section, I would like PowerShell to display the Data value for DefaultUserName.
This is as far as I have got:
Stage 1
get-itemproperty -path "hklm:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\"
Stage 2
I can append:
-Name DefaultUserName
But this won't return a value.
Also other Names, despite being visible in regedit, don't show in PowerShell, for example AutoAdminLogon.
Question: how can make PowerShell display what I can see with regedit?
You can try the standard command line:
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName
even simpler:
gp "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\").DefaultUserName
Does
Get-ItemProperty -path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" |% {$_.DefaultUserName}
Work for you
I tried the very same commands on another machine, they worked perfectly, as expected. Thus my original machine must have a faulty registry, or at the least, weird permissions.
A late followup.
As suggested by Frank, REG.EXE works fine.
However a small C function fail to read this specific DefaultUserName : the API RegQueryValueExA doesn't return error, but a size of 1 bytes !
Under the same branch, I can read Shell.
With REGEDIT.EXE I check the permissions, for both values they are
Administrators : Full, Users : Read.
OS : Windows 7 home premium - 64 bit
DWORD RegGetValueA( HKEY hTree, LPCSTR lpSubKey, LPCSTR lpValueName, LPDWORD lpdwType, LPVOID lpData, LPDWORD lpdwSize )
{
#define KEY_WOW64_32KEY 0x0200 // on 64-bit Windows should operate on the 32-bit registry view ( HKLM\SOFTWARE\Wow6432Node\... )
#define KEY_WOW64_64KEY 0x0100 // on 64-bit Windows should operate on the 64-bit registry view
DWORD ret, dwAlter = 0;
HKEY hKey;
retry:
ret = RegOpenKeyExA( hTree, lpSubKey, 0, KEY_READ | dwAlter, &hKey );
if ( ret != ERROR_SUCCESS )
return ret;
ret = RegQueryValueExA( hKey, lpValueName, NULL, lpdwType, lpData, lpdwSize );
RegCloseKey( hKey );
if ( ret != ERROR_SUCCESS && dwAlter == 0 )
{
dwAlter = KEY_WOW64_64KEY;
// printf( "retry... %d\r\n", dwAlter );
goto retry;
}
return ret;
}
