Powershell: Cannot read a specific Registry-Value

Question

I am struggling to read this REG-value via Powershell 5:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\SWD\DAFWSDProvider\urn:uuid:cfe92100-67c4-11d4-a45f-0026abfabc42/uri:urn:uuid:cfe92100-67c4-11d4-a45f-0026abfabc42/01]
"Driver"="{6bdd1fc6-810f-11d0-bec7-08002be2092f}\\0000"

Even the autocomplete-function in Powershell showing me the REG-path to that key is not working properly. Why is it failing? How can I get this value?

This is the code which is surprisingly NOT working as expected:

$sub = 'urn:uuid:cfe92100-67c4-11d4-a45f-0026abfabc42/uri:urn:uuid:cfe92100-67c4-11d4-a45f-0026abfabc42/01'
get-Item -literalPath "HKLM:\SYSTEM\CurrentControlSet\Enum\SWD\DAFWSDProvider\$sub"

Here a screenshot of the subkey that I cannot read:

I could now drill it down to this situation:

subkey 'urn:uuid:cfe92100-67c4-11d4-a45f-0026abfabc42' -> OK
subkey 'uuid:cfe92100-67c4-11d4-a45f-0026abfabc42/u' -> OK
subkey 'urn:uuid:cfe92100-67c4-11d4-a45f-0026abfabc42/u' -> fail!
subkey 'urn:uuid:cfe92100-67c4-11d4-a45f-0026abfabc42/u' under HKLM:\Software -> OK

Also, registry values are not obtainable with Get-ChildItem, that works only for subkeys. You must use Get-ItemProperty for values. — Tomalak
– Tomalak, Commented Jan 20, 2021 at 10:29
@Tomalak Thank you for the input, but that is not the origin of the problem. Its the subkey wich seems to block any reg-command here. That includes get-item, get-childitem, get-itemproperty and get-itempropertyvalue. — Carsten
– Carsten, Commented Jan 20, 2021 at 11:28
What if you escape the : and slashes in the key name by prefixing them with a backtick "`" ? Did you check permissions on that key ? — Theo
– Theo, Commented Jan 20, 2021 at 15:33

Tomalak · Accepted Answer · 2021-01-22 18:57:45Z

2

Using Sysinternals Process Explorer, I've discovered what happens.

PowerShell replaces the forward slashes in the path unconditionally with backslashes, even when you use -LiteralPath.

That's clearly a bug.

To work around it, you can use the PSPath of the registry key, apparently PowerShell leaves those alone. For the local registry, the PSPath always starts like this:

Microsoft.PowerShell.Core\Registry::

and after that goes on with the regular key name as it would appear in RegEdit.

$path = "Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\SWD\DAFWSDProvider\urn:uuid:e3248000-80ce-11db-8000-30055c83410f/uri:e3248000-80ce-11db-8000-30055c83410f/PrinterService"

Get-Item $path

PSPaths are an integral part of anything that Powershell treats as one of its drives. You can select them, or access the .PSPath property:

$path = "Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\SWD\DAFWSDProvider"

Get-ChildItem $path | Select -ExpandProperty PSPath

(Get-Item C:\).PSPath

answered Jan 22, 2021 at 18:57

Tomalak

339k68 gold badges547 silver badges635 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Carsten Over a year ago

We both posted a solution in parallel ;-) Many thanks for your great support!

Shaqil Ismail · Accepted Answer · 2021-01-20 11:26:59Z

1

From Microsoft's PowerShell documentation, you can decide if you would like to view the entries as a list or to retrieve a single registry key.

https://learn.microsoft.com/en-us/powershell/scripting/samples/working-with-registry-entries?view=powershell-7.1

answered Jan 20, 2021 at 11:26

Shaqil Ismail

1,9891 gold badge7 silver badges6 bronze badges

2 Comments

Shaqil Ismail Over a year ago

I have read about if you are using a 32 bit version of PowerShell. You may have problems accessing 64 bit registry keys. If the following webpage applies, stackoverflow.com/questions/630382/…

Carsten Over a year ago

Nope. Also, as mentioned above, if I rename the subkey a bit I can read it, but not with the name as it is right now.

Carsten · Accepted Answer · 2021-01-22 19:19:24Z

1

At the end it turns out, that I had to use a different Syntax for the REG-Path to make the call work - very strange!

See this code:

$prefix1 = "Registry::HKEY_LOCAL_MACHINE"
$prefix2 = "HKLM:"
$subDir = "urn:uuid:cfe92100-67c4-11d4-a45f-0026abfabc42/uri:urn:uuid:cfe92100-67c4-11d4-a45f-0026abfabc42/01"
get-item "$prefix1\SYSTEM\CurrentControlSet\Enum\SWD\DAFWSDProvider\$subDir"
get-item "$prefix2\SYSTEM\CurrentControlSet\Enum\SWD\DAFWSDProvider\$subDir"

The first "get-item" call using prefix1 is working fine while the second one is not returning anything back.

Lession learned: Better use the longer REG-Prefix like in the original PSPATH to avoid any unexpected side-effects.

edited Jan 22, 2021 at 19:19

answered Jan 22, 2021 at 19:10

Carsten

2,3411 gold badge24 silver badges42 bronze badges

Collectives™ on Stack Overflow

Powershell: Cannot read a specific Registry-Value

3 Answers 3

1 Comment

2 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related