One-liner PowerShell command to search entire Windows registry for a keyword

Question

I'm trying to search the entire Windows registry for a specific keyword using PowerShell. I've tried various commands, but they either throw errors or run indefinitely without returning results. I need a one-liner that I can run in an elevated PowerShell terminal to find all traces of a specific keyword in the registry.

My attempts so far haven't been successful. For example:

Get-ChildItem HKLM:,HKCU: -Recurse -ErrorAction SilentlyContinue | Where-Object {$_.Property} | ForEach-Object { try { Get-ItemProperty $_.PSPath -ErrorAction Stop | ForEach-Object { $_ | Get-Member -MemberType NoteProperty | Where-Object { $_.Definition -match 'MyKeyword' } | ForEach-Object { [PSCustomObject]@{Path=$_.PSPath; Name=$_.Name; Value=$_."$($_.Name)"} } } } catch {} }

and

Get-ChildItem -Path HKLM:\,HKCU:\ -Recurse -ErrorAction SilentlyContinue | ForEach-Object { 
    try { 
        Get-ItemProperty -Path $_.PSPath -ErrorAction SilentlyContinue 
    } catch {} 
} | Select-String -Pattern "MyKeyword"

These commands run without errors but never complete or return results.

What's an efficient one-liner PowerShell command to search the entire Windows registry for a specific keyword and return all matches?

Answer 1

$ErrorActionPreference = 'SilentlyContinue'
Get-ChildItem HKLM:,HKCU: -Recurse |
Get-ItemProperty |
Where-Object { $_.PSObject.Properties.Value -like "*MyKeyword*" } |
ForEach-Object {
    $property = $_.PSObject.Properties.Where({$_.Value  -like "*MyKeyword*" })
    [PSCustomObject]@{ Path = $_.PSPath -replace '^.*Registry::', '' ; Name = $Property.Name ; Value = $property.Value }
}

In my test it takes about 10 minutes.

You can put in one line like this:

$ErrorActionPreference='SilentlyContinue';Get-ChildItem HKLM:,HKCU: -Recurse|Get-ItemProperty|Where-Object{$_.PSObject.Properties.Value-like"*MyKeyword*"}|ForEach-Object{$property=$_.PSObject.Properties.Where({$_.Value-like"*MyKeyword*"});[PSCustomObject]@{Path=$_.PSPath-replace'^.*Registry::','';Name=$Property.Name;Value=$property.Value }}