PowerShell Deleting from the Registry

Removing registry entries in PowerShell requires distinguishing between registry keys (containers, like folders) and registry values (data properties inside a key). The Remove-Item cmdlet deletes entire registry keys and their nested subkeys, while the Remove-ItemProperty cmdlet deletes specific named values within a key while leaving the parent key intact. A third cmdlet, Clear-ItemProperty, resets a value's data without removing the value itself.

Deleting a Key with Remove-Item

The Remove-Item cmdlet deletes a registry key, just as it does for files and folders on the file system. If the key contains nested subkeys, the -Recurse switch parameter is required to delete the entire tree.

Remove-Item -Path "HKCU:\Software\MyApp"

where -Path is the registry key to delete.

Deleting a Key with Subkeys

If the target key contains subkeys, Remove-Item fails unless -Recurse is specified.

Remove-Item -Path "HKCU:\Software\MyApp" -Recurse

where -Recurse deletes the key along with all of its subkeys and their values.

Remove-Item : Item has children and the Recurse parameter was not specified...

Confirming Before Deletion

Remove-Item -Path "HKCU:\Software\MyApp" -Recurse -Confirm

Confirm
Are you sure you want to perform this action?
Performing the operation "Remove Key" on target "HKEY_CURRENT_USER\Software\MyApp".
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"):

where -Confirm forces an interactive confirmation prompt before deletion, even in scripts where confirmation is normally suppressed.

Previewing with -WhatIf

Remove-Item -Path "HKCU:\Software\MyApp" -Recurse -WhatIf

What if: Performing the operation "Remove Key" on target "HKEY_CURRENT_USER\Software\MyApp".

Complete Key Deletion Example

Remove-Item -Path "HKCU:\Software\CorpApp" -Recurse -Force -Verbose

Test-Path -Path "HKCU:\Software\CorpApp"

where:

• Remove-Item deletes the target container object from the registry provider.
• -Path is the hierarchical path to the registry key using the HKCU: or HKLM: drive prefix.
• -Recurse directs PowerShell to delete the specified key and all child subkeys underneath it.
• -Force overrides permissions restrictions on subkeys where possible.
• -Verbose outputs real-time notifications detailing the removal operation.
• Test-Path returns $false when the key is successfully deleted.

./delete-registry-key.ps1

VERBOSE: Performing the operation "Remove-Item" on target "Item: HKEY_CURRENT_USER\Software\CorpApp".
False

Deleting a Value with Remove-ItemProperty

The Remove-ItemProperty cmdlet deletes a single named value from a key, leaving the key itself and its other values intact.

Remove-ItemProperty -Path "HKCU:\Software\MyApp" -Name "Debug"

where:

• -Path is the registry key containing the value.
• -Name is the specific value name to remove.

Removing Multiple Values

-Name accepts an array of value names to delete several at once.

Remove-ItemProperty -Path "HKCU:\Software\MyApp" -Name "Debug", "TempFlag"

Complete Value Deletion Example

Remove-ItemProperty -Path "HKCU:\Software\CorpApp\Settings" `
    -Name "LoggingLevel" `
    -Verbose

$key = Get-Item -Path "HKCU:\Software\CorpApp\Settings"
$key.Property -contains "LoggingLevel"

where:

• Remove-ItemProperty removes the specified value entry from a registry key.
• -Path is the path to the registry key hosting the value.
• -Name is the exact name of the value property to delete.
• $key.Property is the enumerable collection of value names remaining on the key.
• -contains is the relational operator returning $false if the deleted property name is absent from the collection.

./delete-registry-property.ps1

VERBOSE: Performing the operation "Remove Property" on target "Item: HKEY_CURRENT_USER\Software\CorpApp\Settings Property: LoggingLevel".
False

Key vs. Value Deletion Comparison

Choosing the incorrect cmdlet can accidentally delete unintended configuration data:

Practical Usage

Cleaning Up Application Settings on Uninstall

A common uninstall script removes an application's entire configuration key, but only after confirming it exists and logging the action.

$keyPath = "HKCU:\Software\MyApp"

if (Test-Path -Path $keyPath) {
    Write-Output "Removing registry key: $keyPath"
    Remove-Item -Path $keyPath -Recurse -Force
    Write-Output "Cleanup complete."
} else {
    Write-Output "No registry key found at $keyPath. Nothing to clean up."
}

where:

• Test-Path avoids an error by confirming the key exists before attempting deletion.
• -Force suppresses confirmation prompts for unattended execution.

./uninstall-cleanup.ps1

Removing registry key: HKCU:\Software\MyApp
Cleanup complete.

Safe Deprecation and Pruning of Run Keys

Administrators often need to clean up obsolete or unauthorized persistence entries under the Windows Run key. Using the -WhatIf parameter allows testing the deletion to verify target keys and property names before executing changes.

$runPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
$targetEntry = "LegacyAppUpdater"

if (Test-Path -Path $runPath) {
    $key = Get-Item -Path $runPath
    if ($key.Property -contains $targetEntry) {
        Write-Output "Found target startup entry: $targetEntry. Testing removal with -WhatIf..."
        
        Remove-ItemProperty -Path $runPath -Name $targetEntry -WhatIf
        
        Remove-ItemProperty -Path $runPath -Name $targetEntry -Confirm:$false
        Write-Output "Successfully removed $targetEntry."
    }
    else {
        Write-Output "Entry '$targetEntry' does not exist in $runPath."
    }
}

where:

• Test-Path confirms the registry path exists before querying its properties.
• $key.Property -contains $targetEntry confirms the specific property exists prior to issuing removal commands.
• -WhatIf displays what action would occur without committing changes to the registry.
• -Confirm:$false suppresses any interactive confirmation dialogs during automation runs.

./prune-startup-entry.ps1

Found target startup entry: LegacyAppUpdater. Testing removal with -WhatIf...
What if: Performing the operation "Remove-ItemProperty" on target "Item: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, Property: LegacyAppUpdater".
Successfully removed LegacyAppUpdater.