PowerShell注册表操作命令总结

你可以像导航文件系统那样来访问注册表，powershell把文件系统和注册表都当作层次信息系统来处理。注册表中的键对应于文件系统的目录，但是键对应的值和文件系统中的文件不是非常类似。相反的，它们显示在属性栏，被以键的属性来管理。

ps c:\> cd hkcu:
ps hkcu:\> dir

    hive: hkey_current_user

name                           property
----                           --------
appevents
console                        colortable00           : 0
                               colortable01           : 8388608
                               colortable02           : 32768
                               colortable03           : 8421376
                               colortable04           : 128
                               colortable05           : 8388736
                               colortable06           : 32896
                               colortable07           : 12632256
                               colortable08           : 8421504
                               colortable09           : 16711680
                               colortable10           : 65280
                               colortable11           : 16776960
                               colortable12           : 255
                               colortable13           : 16711935
                               colortable14           : 65535
                               colortable15           : 16777215
                               cursorsize             : 25
                               enablecolorselection   : 0
                               extendededitkey        : 0
                               extendededitkeycustom  : 0
                               fontfamily             : 0
                               fontsize               : 0
                               fontweight             : 0
                               fullscreen             : 0
                               historybuffersize      : 50
                               historynodup           : 0
                               insertmode             : 1
                               loadconime             : 1
                               numberofhistorybuffers : 4
                               popupcolors            : 245
                               quickedit              : 0
                               screenbuffersize       : 19660880
                               screencolors           : 7
                               trimleadingzeros       : 0
                               windowsize             : 1638480
                               worddelimiters         : 0
                               currentpage            : 0
control panel
environment                    temp : c:\users\mosser\appdata\local\temp
                               tmp  : c:\users\mosser\appdata\local\temp
eudc
identities                     identity ordinal : 1
                               migrated7        : 1
                               last username    : main identity
                               last user id     : {563ed914-095c-4b36-9d01-743d0c2af679}
                               identity login   : 622675
                               default user id  : {563ed914-095c-4b36-9d01-743d0c2af679}
keyboard layout
network
printers
software
system
volatile environment           logonserver   : \\dc.pstips.net
                               userdnsdomain : pstips.net
                               userdomain    : pstips.net
                               username      : mosser
                               userprofile   : c:\users\mosser
                               homepath      : \users\mosser
                               homedrive     : c:
                               appdata       : c:\users\mosser\appdata\roaming
                               localappdata  : c:\users\mosser\appdata\local

下面的列出了访问注册表所需的所有命令。

命令                 描述
dir, get-childitem 列出键的内容
cd, set-location 更改当前（键）目录
hkcu:, hklm:         预定义的两个重要注册表根目录虚拟驱动器
get-itemproperty 读取键的值
set-itemproperty 设置键的值
new-itemproperty 给键创建一个新值
clear-itemproperty 删除键的值内容
remove-itemproperty 删除键的值
new-item, md         创建一个新键
remove-item, del 删除一个键
test-path         验证键是否存在

注意：注册表几乎存储了windows的核心配置。所以这也是它为什么成为我们用来读取和更改windows配置的重要位置。因此乱搞或者误删非常危险，可能造成windows不能启动。

文章出处：http://www.pstips.net/the-registry.html