Using the Get-ItemProperty Cmdlet

Listing the Values in a Registry Key

If you want to return a list of all the files in a folder you can simply call the Get-ChildItem cmdlet. For example, this command returns all the files in the folder C:\Scripts:

Get-ChildItem c:\scripts

That might lead you to believe that you can use Get-ChildItem to retrieve the child objects found in any location. For example, suppose you want to enumerate all the values in a registry key. This command looks like it should work:

Get-ChildItem "hklm:\software\microsoft\windows\currentversion\uninstall\windows media player"

Technically the command does work; it just doesn’t return the data you might expect. Rather than returning information about all registry values in this registry key, it only returns information about any subkeys found in that location. That’s definitely not the same thing; it’s equivalent to running Get-ChildItem against C:\Scripts and only getting back information about subfolders found in that directory. Get-ChildItem can return information about the files in a folder because it has been specially designed to do so when working with the file system. When it comes to other namespaces (such as the registry) you will often need to use the Get-ItemProperty cmdlet to get back the desired information.

This command is probably more what you had in mind:

Get-ItemProperty "hklm:\software\microsoft\windows\currentversion\uninstall\windows media player"

As you can see, the returned data includes the registry values found in the Windows Media Player registry key:

DisplayName       : Windows Media Player 10
UninstallString   : "C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
DisplayIcon       : C:\Program Files\Windows Media Player\wmplayer.exe
ParentKeyName     : OperatingSystem
ParentDisplayName : Windows Updates

Here’s a handy little command that uses Get-ChildItem to return a collection of all the subkeys found in the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CyrrentVersion\Uninstall registry key. That collection of subkeys is then passed to the ForEach-Object cmdlet. In turn, ForEach-Object calls the Get-ItemProperty cmdlet for each subkey. When the smoke clears, this command will have returned all the registry values for all the subkeys in the Uninstall registry key.

Here’s what the command looks like:

Get-ChildItem hklm:\software\microsoft\windows\currentversion\uninstall | ForEach-Object {Get-ItemProperty $_.pspath}

Related Links

• More Cmdlets