none
Remote registry: OpenRemoteBaseKey not working RRS feed

  • Question

  • Hi

    I'm trying to read a remote registry key. I have the Remote Registry service running on on the target machine, and I can read the key using `reg query`. In all honesty, this is good enough for my purposes.

    PS C:\> reg query "\\remote-machine\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer" /v Version

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer    Version    REG_SZ    9.11.9600.17420

    However, I'm curious to know why I can't do this with Powershell and OpenRemoteBaseKey. I've tried the following steps from here:

    PS C:\> $remote = "remote-machine"

    PS C:\> $type = [Microsoft.Win32.RegistryHive]::LocalMachine PS C:\> $reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey($type, $remote ) PS C:\> $regpath = "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer" PS C:\> $productkey = $reg.OpenSubKey($regpath) PS C:\> $productkey.getvalue("Version") You cannot call a method on a null-valued expression. At line:1 char:1 + $productkey.getvalue("Version") + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (:) [], RuntimeException + FullyQualifiedErrorId : InvokeMethodOnNull

    Inspecting the values produced, $productkey is null, and $reg appears to be empty:

    PS C:\> $reg
    
    Name                           Property
    ----                           --------
    
    
    
    PS C:\> $reg.GetType()
    
    IsPublic IsSerial Name                                     BaseType
    -------- -------- ----                                     --------
    True     False    RegistryKey                              System.MarshalByRefObject
    
    
    PS C:\>

    So, why would `reg query` work, while `OpenRemoteBaseKey()` does not? I can use `reg query` well enough in my scripts, but I'd prefer something a little more Powershell-y.

    Cheers

    Tuesday, December 9, 2014 11:04 AM

Answers

  • Try this:

    $reg=[Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine','omega')
    $key = $reg.OpenSubKey('SOFTWARE\Microsoft\Internet Explorer')
    $key.getvalue('Version')


    ¯\_(ツ)_/¯

    • Proposed as answer by jrv Tuesday, December 9, 2014 4:04 PM
    • Unproposed as answer by Bill_StewartModerator Tuesday, December 9, 2014 4:08 PM
    • Marked as answer by blaffoy Tuesday, December 9, 2014 4:23 PM
    Tuesday, December 9, 2014 4:04 PM

All replies

  • Note that the Version subkey doesn't really tell you the actual IE version that's installed. Look here:

    http://support.microsoft.com/kb/969393

    There is a little note hidden in that article with a major caveat:

    Note The version string value for Internet Explorer 10 is 9.10.9200.16384, and the svcVersion string value is 10.0.9200.16384.

    So I don't think that your code path is going to get you what you're looking for even if it works correctly.


    -- Bill Stewart [Bill_Stewart]

    Tuesday, December 9, 2014 3:48 PM
    Moderator
  • Try this:

    $reg=[Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine','omega')
    $key = $reg.OpenSubKey('SOFTWARE\Microsoft\Internet Explorer')
    $key.getvalue('Version')


    ¯\_(ツ)_/¯

    • Proposed as answer by jrv Tuesday, December 9, 2014 4:04 PM
    • Unproposed as answer by Bill_StewartModerator Tuesday, December 9, 2014 4:08 PM
    • Marked as answer by blaffoy Tuesday, December 9, 2014 4:23 PM
    Tuesday, December 9, 2014 4:04 PM
  • Careful. The 'Version' value doesn't tell you the actual version of IE that's really installed.

    -- Bill Stewart [Bill_Stewart]

    Tuesday, December 9, 2014 4:08 PM
    Moderator
  • Thanks! Yeah, I was aware of that. Really, I want to confirm that the same version is available on all the machines in the domain, so the subkey version string should be sufficient. I think.
    Tuesday, December 9, 2014 4:10 PM
  • That won't help, because on newer OSes you could have a newer version of IE installed, but the 'Version' value will still report an older version.


    -- Bill Stewart [Bill_Stewart]

    Tuesday, December 9, 2014 4:12 PM
    Moderator
  • Try this:

    $reg=[Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine','omega')
    $key = $reg.OpenSubKey('SOFTWARE\Microsoft\Internet Explorer')
    $key.getvalue('Version')


    ¯\_(ツ)_/¯

    Yep. That did it. So I don't need to specify "HKEY_LOCAL_MACHINE"? Makes sense.

    Thanks!

    Tuesday, December 9, 2014 4:23 PM
  • Careful. The Version value doesn't tell you the IE version that's actually installed.


    -- Bill Stewart [Bill_Stewart]

    Tuesday, December 9, 2014 4:24 PM
    Moderator
  • That won't help, because on newer OSes you could have a newer version of IE installed, but the 'Version' value will still report an older version.


    -- Bill Stewart [Bill_Stewart]


    Oh, I must have misunderstood. So, if all of the machines report the Version in the registry as "9.11.9600.17420", does that not mean that they are all running the same version of IE?
    Tuesday, December 9, 2014 4:27 PM
  • When you update IE, it does not necessarily update the 'Version' value in the registry.

    -- Bill Stewart [Bill_Stewart]

    Tuesday, December 9, 2014 4:38 PM
    Moderator
  • When you update IE, it does not necessarily update the 'Version' value in the registry.

    -- Bill Stewart [Bill_Stewart]

    Okay. Are you referring to what is stated in the following paragraph from the same page you linked before?

    Internet Explorer 3.x does not add the version value to the registry. Instead, it adds a "build" value to the same registry key and updates the "IVer" string value to "103." For backward compatibility, Internet Explorer 4.0 and later versions change or add the build value. For Internet Explorer 3.x, the build value is a string that contains the four-character build number. (For example, "1300" is the build value for Internet Explorer 3.02). For Internet Explorer 4.0 and later versions, the build value is a string that contains a five-character value, followed by a period and four more characters, in the following format:
    If so, I think it does not apply after IE4. In which case, as all the machines on my domain are Windows 7 or Server 2008 installs, I don't think it's likely that they have such an old version installed.
    Tuesday, December 9, 2014 4:47 PM
  • I think what you are looking for is svcVersion and not Version.  svcVersion is available on Vitsa and later.  Vresion reports only V9 of IE and pushes actual version forwards.

    On WIndows 7 Version reports "9.11.9600.17420" for IE 11 and svcVersion reports "11.0.9600.17420".


    ¯\_(ツ)_/¯


    • Edited by jrv Tuesday, December 9, 2014 5:18 PM
    Tuesday, December 9, 2014 5:15 PM
  • Sometimes svcVersion is not present.

    I prefer to get the version information directly from iexplore.exe. Simple WMI example:


    $computerName = "computer"
    $iePath = "C:\\Program Files\\Internet Explorer\\iexplore.exe"
    $dataFile = [WMI] "\\$computerName\root\CIMV2:CIM_DataFile.Name='$iePath'"
    "The IE version on {0} is {1}" -f $computerName,$dataFile.Version
    


    -- Bill Stewart [Bill_Stewart]

    Tuesday, December 9, 2014 5:28 PM
    Moderator