none
how to get registry key lastwritetime using batch/powershell RRS feed

  • Question

  • Hello,

    I want to get a registry key's LastWriteTime using batch/powershell.  These are what i have tried..

    1. Launch regedit and manually export the key using the UI, this gives me the lastwritetime, but I need a commandline version of this.  regedit /e only exports the key and value data.

    2. dir HKLM:\software\mykey

    nothing returned

    3. Get-ChildItem HKLM:\software\mykey |  Select-Object *

    nothing returned

    4. Get-ItemProperty HKLM:\software\mykey | Select-Object *

    LastWriteTime not returned; other values are returned

    5. (Get-Item HKLM:\software\mykey).LastWriteTime

    Nothing is returned

    Is the only way to do this by using pinvoke with RegQueryInfoKey? 

    Thanks in advance


    ss883r



    • Edited by srrs Wednesday, February 5, 2014 9:28 PM
    Wednesday, February 5, 2014 9:26 PM

Answers

  • Thanks that worked!  I am curious about the proxy function for Get-ChildItem that you mentioned in a v2 setting.  Appreciate any info on that! 

    ss883r

    • Marked as answer by srrs Wednesday, February 5, 2014 10:03 PM
    Wednesday, February 5, 2014 10:03 PM

All replies

  • AFAIK, the last write time of a registry subkey is not available through any script API.

    Bill

    Wednesday, February 5, 2014 9:42 PM
    Moderator
  • There a few different ways to do this here. What version of PowerShell are you using? If version 3 or higher, I suggest method 3 on that page (run the 'UpdateTypeData_PSv3_and_higher.ps1' script). That will make it so that any registry key object has the property automatically added to it.

    Let me know if you have any questions.

    Wednesday, February 5, 2014 9:44 PM
  • Thanks for your responses. I have Powershell v2.0.

    ss883r

    Wednesday, February 5, 2014 9:48 PM
  • The .zip on the repository will still work for version 2. Basically, you'll get a definition for a function called 'Add-RegKeyMember'. You can dot source the provided script, or you can copy the function definition into your own script. You would use it like this:

    # Using Get-Item: 
    PS> Get-Item HKLM:\SOFTWARE | Add-RegKeyMember | select Name, LastWriteTime, ClassName  
    
    # Using Get-ChildItem: 
    PS> Get-ChildItem HKLM:\SOFTWARE | Add-RegKeyMember | select Name, LastWriteTime, ClassName  
    
    # Passing a path: 
    PS> Add-RegKeyMember HKLM:\SOFTWARE | select Name, LastWriteTime, ClassName 

    There's also a proxy function for Get-ChildItem that will automatically add the property anytime you use Get-ChildItem (dir, ls, gci) on a registry path. The PSv3 only method I was talking about simply updates the type data to automatically call the function on any RegistryKey object. You can actually set version 2 up to do that, but it requires an XML file.

    Wednesday, February 5, 2014 9:55 PM
  • Thanks that worked!  I am curious about the proxy function for Get-ChildItem that you mentioned in a v2 setting.  Appreciate any info on that! 

    ss883r

    • Marked as answer by srrs Wednesday, February 5, 2014 10:03 PM
    Wednesday, February 5, 2014 10:03 PM
  • This ZIP contains a script called 'GetChildItemProxyFunction.ps1'. Dot source that (or copy the definition into another script) and it should automatically work (Make sure that the Add-RegKeyMember function has also been defined). Any time you're using Get-ChildItem, it's using the proxy function. You can see more info on this HSG article.
    Wednesday, February 5, 2014 10:08 PM
  • Thank you!

    ss883r

    Wednesday, February 5, 2014 10:10 PM