PowerShell Reading from the Registry

Querying data from the Windows Registry in PowerShell is handled primarily through two cmdlets: Get-Item to inspect registry keys as hierarchical container objects, and Get-ItemProperty to read specific configuration values and data payloads stored within those keys. While Get-ChildItem lists a registry key's subkeys, it doesn't display the values contained within that key. To access the actual configuration data, you need Get-ItemProperty. Meanwhile, Get-Item provides metadata about the key itself.

Inspecting Registry Keys with Get-Item

The Get-Item cmdlet targets the registry container itself, returning a Microsoft.Win32.RegistryKey object. This object provides container-level metadata, including the number of subkeys, total value count, access control lists (ACLs), and methods to read raw binary or string values.

Get-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion"

    Hive: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT


Name                           Property
----                           --------
CurrentVersion                 SystemRoot                : C:\Windows
                               BaseBuildRevisionNumber   : 1
                               BuildBranch               : vb_release
                               BuildGUID                 : ffffffff-ffff-ffff-ffff-ffffffffffff
...

where -Path is the registry key to inspect.

Inspecting Key Metadata Directly

$key = Get-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion"

[PSCustomObject]@{
    KeyName        = $key.PSChildName
    SubKeyCount    = $key.SubKeyCount
    ValueCount     = $key.ValueCount
    DirectQueryVal = $key.GetValue("ProductName")
}

where:

• Get-Item returns the target registry key container object without enumerating child keys.
• -Path the target path using the HKLM: PSDrive prefix.
• $key.PSChildName the leaf container name (CurrentVersion).
• $key.SubKeyCount total count of direct subkeys nested beneath this key.
• $key.ValueCount total count of configuration entries contained inside this key.
• $key.GetValue("ProductName") invokes the native .NET method to directly query a value name and retrieve its raw data.

./inspect-registry-key.ps1

KeyName        SubKeyCount ValueCount DirectQueryVal
-------        ----------- ---------- --------------
CurrentVersion          97         32 Windows 10 Pro

Listing Value Names with .Property

(Get-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").Property

SystemRoot
BaseBuildRevisionNumber
BuildBranch
BuildGUID
BuildLab
BuildLabEx
CompositionEditionID
CurrentBuild
...

Reading Registry Values with Get-ItemProperty

The Get-ItemProperty cmdlet retrieves the actual names and data values stored inside a registry key. PowerShell attaches each registry entry to a custom PSCustomObject as a dynamic property, allowing values to be accessed using standard dot-notation.

Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion"

ProductName               : Windows 10 Pro
ReleaseId                 : 2009
SoftwareType              : System
DisplayVersion            : 22H2
PathName                  : C:\Windows
...

where -Path is the registry key whose values you want to read.

Reading a Specific Value with -Name

Use -Name to retrieve only a single named value instead of every value in the key.

Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" -Name "ProductName"

where -Name is the specific value name to retrieve from the key.

ProductName  : Windows 10 Pro
PSPath       : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT
PSChildName  : CurrentVersion
PSDrive      : HKLM
PSProvider   : Microsoft.PowerShell.Core\Registry

Reading Multiple Specific Values

$properties = Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" `
    -Name "ProductName", "DisplayVersion", "CurrentBuild"

[PSCustomObject]@{
    OSName  = $properties.ProductName
    Release = $properties.DisplayVersion
    Build   = $properties.CurrentBuild
}

where:

• Get-ItemProperty reads the specified value properties from the targeted registry key.
• -Path the path to the registry key hosting the values.
• -Name an array of one or more specific value names to retrieve. If omitted, all values in the key are returned.
• $properties.ProductName accesses the data payload of the ProductName registry value directly via property notation.

./read-registry-value.ps1

OSName         Release Build
------         ------- -----
Windows 10 Pro 22H2    19045

Accessing a Value Directly

To extract just the raw value without the surrounding object noise, use dot notation or Select-Object -ExpandProperty.

(Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").ProductName

Windows 10 Pro

Filtering Out Provider Properties

Key Differences: Get-Item vs Get-ItemProperty

Choosing between Get-Item and Get-ItemProperty depends on whether you are managing the key container or querying the configuration data stored within it:

Handling Missing Keys and Values

Both cmdlets throw errors when the target path or value doesn't exist, so defensive checks are important in scripts.

$path = "HKCU:\Software\MyApp"

if (Test-Path -Path $path) {
    $settings = Get-ItemProperty -Path $path -ErrorAction SilentlyContinue
    Write-Output "Setting found: $($settings.ApiEndpoint)"
} else {
    Write-Output "Registry key not found: $path"
}

where:

• Test-Path verifies the key exists before attempting to read from it.
• -ErrorAction SilentlyContinue suppresses errors if an individual value is missing within an existing key.

./safe-read-registry.ps1

Registry key not found: HKCU:\Software\MyApp

Practical Usage

Reading Multiple Related Settings

A common admin task is pulling several related registry values into a single, readable report.

$path = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
$info = Get-ItemProperty -Path $path

[PSCustomObject]@{
    ProductName    = $info.ProductName
    CurrentBuild   = $info.CurrentBuild
    DisplayVersion = $info.DisplayVersion
    RegisteredOwner = $info.RegisteredOwner
}

where [PSCustomObject] reshapes the raw registry read into a clean, purpose-built object.

./get-system-info.ps1

ProductName    CurrentBuild DisplayVersion RegisteredOwner
-----------    ------------ -------------- ---------------
Windows 10 Pro 19045        22H2           Tom

Auditing Installed Software via the Registry

Administrators frequently need to inventory installed applications. In Windows, installed software packages register their metadata under the Uninstall registry keys across both 64-bit and 32-bit paths.

$uninstallPaths = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
    "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"
)

$installedApps = Get-ItemProperty -Path $uninstallPaths -ErrorAction SilentlyContinue | 
    Where-Object { $_.DisplayName -and -not $_.SystemComponent } | 
    Select-Object -Property DisplayName, DisplayVersion, Publisher, InstallDate | 
    Sort-Object -Property DisplayName

$installedApps | Select-Object -First 3 | Format-Table -AutoSize

where:

• $uninstallPaths uses wildcard syntax (\*) to instruct Get-ItemProperty to inspect every individual application subkey under both registry paths.
• HKLM:\SOFTWARE\Wow6432Node\... the registry container housing 32-bit application registrations on 64-bit Windows operating systems.
• Where-Object { $_.DisplayName -and -not $_.SystemComponent } filters out system hotfixes, patches, and entries lacking human-readable names.
• Select-Object extracts key software inventory attributes (DisplayName, DisplayVersion, Publisher, InstallDate).

./audit-installed-software.ps1

DisplayName       DisplayVersion Publisher                     InstallDate
-----------       -------------- ---------                     -----------
7-Zip 26.00 (x64) 26.00          Igor Pavlov
Copilot           154.0.4258.37  Microsoft Corporation         20260927
Git               2.53.0.2       The Git Development Community 20260328