Powershell to work on Remote Registery

Working on Remote Registry is always challenging. If you are administrator, I am sure you would have come across various times that you wanted to update registry of the computer and you have to login to the each server and apply the registry. Powershell has made most of our administrator’s life easier. Let’s understand how we can access and edit registry of remote computer using powershell

Let’s understand code with example. Below Script take the list of server name in CSV file and reads each server name one by one and opens the registry Key and prints the value. In this fashion you can get any key and get the value. In the below script I am trying to get the value of HKEY_CurrentUsers. This is the reason current in OpenRemoteBaseKey. If you Access keys of HKEY_Localmachine and use LocalMachine

$csv = Import-Csv "C:\Server.csv"foreach($line in $csv){ $strComputer = $line.CMSName $curreg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('CurrentUser', $strComputer) $curkey="Software\Microsoft\Windows\CurrentVersion\Wintrust\Trust Providers\Software Publishing" $curregKey = $curreg.OpenSubKey($curkey) $curregkey.GetValue('State')} 

If you wanted to get the list of subfolder under the folder in the registry then use the below code. This will get list of all the subfolder MSExchangeIS\Clustername. Getsubkeynames() does this.

<strong>$csv = Import-Csv "C:\Server.csv"foreach($line in $csv) { $cmsName = $line.Node $reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', $strComputer) $key="SYSTEM\CurrentControlSet\Services\MSExchangeIS\$cmsName" $regKey = $reg.OpenSubKey($key) foreach($Rkey in $regKey.getsubkeynames())  {  $Rkey   } }

If you wanted to write or edit the remote registry then below code will help. This code will create the new key if the key does not exist else it will edit the existing key to the required value. Below code will create the Dword key if key does not exit there else it will edit the existing key to the required value on the entire computer mentioned in the CSV file.

$csv = Import-Csv "C:\Server.csv"foreach($line in $csv){ $strComputer = $line.Node $curreg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('CurrentUser', $strComputer) $curkey="Software\Microsoft\Windows\CurrentVersion\Wintrust\Trust Providers\Software Publishing" $curregKey = $curreg.OpenSubKey($curkey,$True) $curregkey.SetValue('State','100234','Dword')}

VB Script to Modify Folder NTFS Security and Share Permission

Below is the VBscript to Modify Folder NTFS Security and Share permission. It is using Cacls.exe and Rmtshare.exe to modify the permission. Cacls.exe can be used to modify Folder NTFS security Permission and  rmtshare.exe modifies Share Permission.  Below script removes all the existing permission NTFS Permission and Provides domain\accountname Full access and remove Inheritance check box and provide domain\accountname read share permission and remove all the other share permission. You can modify the script to suite your requirement

Set WshNetwork = WScript.CreateObject(“WScript.Network”)
strFolderName = Installerpath(WshNetwork.ComputerName)
Set objShell = CreateObject(“Wscript.Shell”)
intRunError = objShell.Run(“%COMSPEC% /c Echo Y| cacls ” & strFolderName & ” /c /g domain\accountname:F”, 2, True)
intRunError = objShell.Run(“F:\Krishna\Rmtshare.exe \\Servername\Sharename /remove”)
intRunError = objShell.Run(“F:\Krishna\Rmtshare.exe \\Servername\Sharename /grant “”domain\accountname””:read”)
intRunError = objShell.Run(“F:\Krishna\Rmtshare.exe \\Servername\Sharename /remove everyone”)

Function Installerpath(compname)
strPath = “\\” &  compname & “\Sharename”
strPath = Replace(strPath, “\\”, “”)
arrPath = Split(strPath, “\”)
strComputer = arrPath(0)
strShare = arrPath(1)
Set objWMIService = GetObject(“winmgmts:\\” & strComputer & “\root\cimv2”)
Set colItems = objWMIService.ExecQuery(“Select * From Win32_Share Where Name = ‘” & strShare & “‘”)

For Each objItem in colItems
strFolderName = objItem.Path
Next
Installerpath = strFolderName

End Function

Executing the script :

Save the file as .vbs and you can execute locally or user psexec.exe to execute script remotely. Below is the psexec command to run remotely.

Psexec.exe \\servername cscript C:\Securitymodify.vbs

You can find the copy of the code in the below link

http://powershell.com/cs/members/smtpport25.wordpress/files/ModifySecuritySharePermission.txt.aspx