Skip to content
Tutorial Reference

PowerShell Providers and PSDrives

How PowerShell Providers (PSProviders) unify file systems, registry, environment variables, and certificates into navigable drives using familiar cmdlets like Get-ChildItem, Set-Location, and New-PSDrive.

PowerShell Providers (or PSProviders) are built-in .NET components that present different data stores, such as the file system, the Windows Registry, environment variables, digital certificates, and even session memory, through a single, unified interface. Each data store is exposed as a navigable drive (a PSDrive), letting you use familiar commands like Get-ChildItem, Set-Location, Get-Item, and New-Item on virtually anything.

This design is a direct extension of PowerShell's object-based philosophy: rather than exposing the registry through a separate GUI tool and environment variables through yet another mechanism, everything becomes a drive you can cd into and list with Get-ChildItem.

What Are PS Providers?

A PS Provider is a .NET component that makes a specific data store accessible using the same cmdlets you'd use to browse the file system. Instead of learning a separate tool for the registry or environment variables, you navigate them exactly like folders.

Provider Drive Exposes
FileSystem C:\, D:\, etc. Files and folders, network shares
Registry HKLM:\, HKCU:\ Windows Registry keys and values
Environment Env:\ Environment variables
Certificate Cert:\ Installed certificates and certificate stores
Function Function:\ Currently loaded functions in the session
Variable Variable:\ Currently defined variables in the session
Alias Alias:\ Currently defined aliases in the session

Get-PSProvider

Get-PSProvider lists all providers currently registered in the session.

Consolepowershell
Get-PSProvider
Outputplaintext
Name                 Capabilities                                                        Drives
----                 ------------                                                        ------
Registry             ShouldProcess, Transactions                                         {HKLM, HKCU}
Alias                ShouldProcess                                                       {Alias}
Environment          ShouldProcess                                                       {Env}
FileSystem           Filter, ShouldProcess, Credentials                                  {C, A, D}
Function             ShouldProcess                                                       {Function}
Variable             ShouldProcess                                                       {Variable}
Certificate          ShouldProcess                                                       {Cert}

where:

  • Name identifies the provider.
  • Capabilities shows supported operations, such as ShouldProcess (supports -WhatIf/-Confirm).
  • Drives lists which drive letters/names are currently mapped to that provider.

Get-PSDrive

Get-PSDrive lists all drives currently mounted in the session, including both traditional file system drives and provider-based drives. While traditional operating system drives are identified by single letters (C:, D:), PSDrives can use descriptive names (Env:, Cert:, HKLM:).

Consolepowershell
Get-PSDrive
Outputplaintext
Name           Used (GB)     Free (GB) Provider      Root
----           ---------     --------- --------      ----
Alias                                  Alias
C                  353.49        123.45 FileSystem    C:\
Cert                                   Certificate   \
Env                                    Environment
Function                               Function
HKCU                                   Registry      HKEY_CURRENT_USER
HKLM                                   Registry      HKEY_LOCAL_MACHINE
Variable                               Variable

where:

  • Name is the drive identifier used with cd or Set-Location (e.g., HKLM:).
  • Provider shows which PS Provider backs that drive.
  • Root shows the underlying data source the drive maps to.

Because registry keys, environment variables, certificates, and other provider data are exposed as drives, you can navigate them using the exact same commands used for folders: Set-Location (aliased cd) and Get-ChildItem (aliased ls/dir).

The Registry provider exposes registry hives as directory structures:

Consolepowershell
cd HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion
Get-ChildItem | Select-Object -First 3
Outputplaintext
    Hive: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion

Name                           Property
----                           --------
AccountPicture
ActionCenter
App Management

To read registry values (which are stored as properties on the registry key rather than separate items), use Get-ItemProperty:

Consolepowershell
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" -Name "ProductName"
Outputplaintext
ProductName  : Windows 10 Pro
PSPath       : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT
PSChildName  : CurrentVersion
PSDrive      : HKLM
PSProvider   : Microsoft.PowerShell.Core\Registry

The Env: PSDrive exposes process environment variables as virtual files:

Consolepowershell
cd Env:\
Get-ChildItem | Select-Object -First 3
Outputplaintext
Name                           Value
----                           -----
ALLUSERSPROFILE                C:\ProgramData
APPDATA                        C:\Users\Tom\AppData\Roaming
ChocolateyInstall              C:\ProgramData\chocolatey

Accessing a specific environment variable works the same way as accessing a file:

Consolepowershell
Get-Content Env:\COMPUTERNAME
Outputplaintext
WEB01

On Windows, the Cert: drive lets you inspect SSL/TLS certificates and root authorities:

Consolepowershell
Get-ChildItem -Path "Cert:\LocalMachine\Root" | Select-Object -First 2 -Property Thumbprint, Subject
Outputplaintext
Thumbprint                               Subject
----------                               -------
CDD4EEAE6000AC7F40C3802C171E30148030C072 CN=Microsoft Root Certificate Authority, ...
A4348F58344A70D14E359E798771A9B923141C52 CN=Microsoft Root Authority, OU=Microso...

Creating Custom PSDrives

New-PSDrive lets you create your own shortcuts to frequently accessed locations, whether a deep folder path, a network share, or a specific registry key. This is useful for creating short path shortcuts to deep folder structures, remote network shares, or complex registry paths.

Syntax

New-PSDrive -Name <String> -PSProvider <String> -Root <String> [-Description <String>]

Mounting a Shortcut to a Deep Folder

Consolepowershell
New-PSDrive -Name "Logs" -PSProvider FileSystem -Root "C:\Data\Application\Logs"

where:

  • -Name "Logs" defines the new drive name, accessible as Logs:.
  • -PSProvider FileSystem specifies which provider backs the new drive.
  • -Root specifies the actual target path the drive maps to.
Consolepowershell
cd Logs:\
Get-ChildItem
Outputplaintext
    Directory: C:\Data\Application\Logs

Mode                  LastWriteTime         Length Name
----                  -------------         ------ ----
-a---           3/14/2026   8:30 AM          10240 app.log
-a---           3/13/2026   6:15 PM           8192 error.log

Mounting a Shortcut to a Deep Registry Path

Consolepowershell
New-PSDrive -Name "WinUninstall" -PSProvider "Registry" -Root "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
Outputplaintext
Name           Used (GB)     Free (GB) Provider      Root
----           ---------     --------- --------      ----
WinUninstall                           Registry      HKEY_LOCAL_MACHINE\SOFTWARE\M...

Once mounted, you can navigate and query it directly using its shortcut name:

Consolepowershell
Set-Location WinUninstall:\
Get-ChildItem | Select-Object -First 2

Removing a Custom PSDrive

When a virtual drive is no longer needed, unmount it using Remove-PSDrive:

Consolepowershell
Set-Location C:\
Remove-PSDrive -Name "WinUninstall"

Practical Example: Auditing Installed Software via a Custom PSDrive

The following script creates a temporary PSDrive pointing to the Windows Uninstall registry hive, queries installed software packages, extracts their versions and publishers, and cleans up the PSDrive afterward:

audit-installed-software.ps1powershell
$DriveName = "AppRegistry"
$TargetHive = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"

$null = New-PSDrive -Name $DriveName -PSProvider Registry -Root $TargetHive

try {
    $Apps = Get-ChildItem -Path "$($DriveName):\" | ForEach-Object {
        $props = Get-ItemProperty -Path $_.PSPath
        
        if ($props.DisplayName) {
            [PSCustomObject]@{
                ApplicationName = $props.DisplayName
                Version         = $props.DisplayVersion
                Publisher       = $props.Publisher
                InstallDate     = $props.InstallDate
            }
        }
    }

    $Apps | Sort-Object ApplicationName | Select-Object -First 3
}
finally {
    Set-Location "$env:SystemDrive\"
    Remove-PSDrive -Name $DriveName -ErrorAction SilentlyContinue
}

where:

  • New-PSDrive -Name $DriveName -PSProvider Registry -Root $TargetHive creates a virtual drive pointing directly to the target registry key.
  • Get-ChildItem -Path "$($DriveName):\" lists the registry subkeys using standard drive path syntax.
  • Get-ItemProperty -Path $_.PSPath reads values from each subkey.
  • finally { Remove-PSDrive ... } guarantees the custom drive is unmounted when the script finishes.

Execute the script from the console:

Consolepowershell
pwsh ./audit-installed-software.ps1
Outputplaintext
ApplicationName   Version  Publisher                     InstallDate
---------------   -------  ---------                     -----------
7-Zip 26.00 (x64) 26.00    Igor Pavlov
Git               2.53.0.2 The Git Development Community 20260328
GPL Ghostscript   10.07.0  Artifex Software Inc.
Navigation