Get-ItemProperty with Get-ChildItem

Combining Get-ChildItem and Get-ItemPropertyGet-ItemProperty ImagePath Registry

It can be tricky to get a list of values from the registry using PowerShell.

The secret is to combine two cmdlets, Get-ChildItem and Get-ItemProperty.

How to View Registry Values with PowerShell


Scenario: View the Registry Values

The problem with using Get-ChildItem to interrogate the registry is that you cannot view the values of a particular key.

The solution is to create an object with Get-ChildItem, and then use Get-ItemProperty to display the values.

To help understand the problem and its solution I recommend opening Regedit and navigating to ControlSet001\services.

Part 1 – List the Windows Services

My sole objective in Part 1 is to enumerate the services from information stored in the registry.

# PowerShell Script to list the services
$Keys = Get-ChildItem HKLM:\System\ControlSet001\services
$Keys | Format-Table Name, ValueCount -AutoSize

Note 1: Observe the colon in the syntax.  HKLM:\
The colon here mimics calling the physical drive C:\

Part 2 – List the ImagePath Values for the Services

This is the full script; using the combination of Get-ChildItem and Get-ItemProperty we can list the data for all the services in the registry held by the held by ImagePath value.

# PowerShell Script to find services and their image files
$Keys = Get-ChildItem HKLM:\System\ControlSet001\services
$Items = $Keys | Foreach-Object {Get-ItemProperty $_.PsPath }
ForEach ($Item in $Items) {
"{0,-35} {1,-10} " -f $Item.PSChildName, $Item.ImagePath

Note 2: Observe the two uses of PowerShell’s ForEach.

Note 3: The formatting command, -f, helps to tabulate the output tidily.

Guy Recommends:  A Free Trial of the Network Performance Monitor (NPM)Review of Orion NPM v11.5 v11.5

SolarWinds’ Network Performance Monitor will help you discover what’s happening on your network.  This utility will also guide you through troubleshooting; the dashboard will indicate whether the root cause is a broken link, faulty equipment or resource overload.

What I like best is the way NPM suggests solutions to network problems.  Its also has the ability to monitor the health of individual VMware virtual machines.  If you are interested in troubleshooting, and creating network maps, then I recommend that you try NPM now.

Download a free trial of Solarwinds’ Network Performance Monitor

Remember Get-Member

As usual with PowerShell, if you pipe an object into Get-Member then you can research all the available methods and properties.

# Get-Member reveals more properties
$Keys = Get-ChildItem HKLM:\System\ControlSet001\services
$Items = $Keys | Foreach-Object {Get-ItemProperty $_.PsPath }
$Items | Get-Member

Note 4: This was one way I discovered the ImagePath value; the other way was to examine this part of the registry with regedit.


Set-ItemPropertyRegistry PowerShell ItemProperty

If necessary, you can change registry values with Set-ItemProperty.

Here is an example using Set-ItemProperty to change the value of PaintDesktopVersion.

More Research on ItemProperty

ItemProperty is useful noun for interrogating the objects in the registry.  The classic PowerShell verbs are get and set, this is how to list the family members:

Get-Command -Noun ItemProperty

Expected Results

Summary of Combining Get-ChildItem and Get-ItemProperty

PowerShell can find it difficult to access values in the registry.  My technique is to combine two cmdlets, Get-ChildItem and Get-ItemProperty.

If you like this page then please share it with your friends


See more Microsoft PowerShell file tutorials:

PowerShell Home   • Add-Content   • Get-Content   • Set-Content  • PowerShell -Filter   • Test-Path

PowerShell Get-ChildItem   • Get-ChildItem -Include   • Get-ChildItem -Exclude   • Compare-Object

PowerShell Registry  • Get-Credential  • PowerShell ItemProperty  • PowerShell ItemPropery GCI

Please email me if you have a better example script. Also please report any factual mistakes, grammatical errors or broken links, I will be happy to correct the fault.