Unable to pipe file path in registry item in powershell - HKCU PSDrive

Question

First post here!

I am fairly new to powershell and have been trying to write a few scripts.

Currently I am trying to write a powershell script (PSVersion 5.1.15063.502) to search through the registry in Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders to find any entries pointing to a specified file path. So that I can then change these if required. Using the Set-ItemProperty function.

Ideally I would like to search the "Data" part of User Shell Folders (see picture).

Now when I run the Get-ItemProperty function - I get output of folders such as the following:

PS C:\WINDOWS\system32> Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"


*AppData                                : C:\Users\RD\AppData\Roaming
Cache                                  : C:\Users\RD\AppData\Local\Microsoft\Windows\INetCache
Cookies                                : C:\Users\RD\AppData\Local\Microsoft\Windows\INetCookies
Desktop                                : C:\Users\RD\Desktop
Favorites                              : C:\Users\RD\Favorites
History                                : C:\Users\RD\AppData\Local\Microsoft\Windows\History
Local AppData                          : C:\Users\RD\AppData\Local
My Music                               : C:\Users\RD\Music
My Pictures                            : C:\Users\RD\Pictures
My Video                               : C:\Users\RD\Videos
NetHood                                : C:\Users\RD\AppData\Roaming\Microsoft\Windows\Network Shortcuts
Personal                               : C:\Users\RD\Documents
PrintHood                              : C:\Users\RD\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
Programs                               : C:\Users\RD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
Recent                                 : C:\Users\RD\AppData\Roaming\Microsoft\Windows\Recent
SendTo                                 : C:\Users\RD\AppData\Roaming\Microsoft\Windows\SendTo
Start Menu                             : C:\Users\RD\AppData\Roaming\Microsoft\Windows\Start Menu
Startup                                : C:\Users\RD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Templates                              : C:\Users\RD\AppData\Roaming\Microsoft\Windows\Templates
{374DE290-123F-4565-9164-39C4925E467B} : C:\Users\RD\Downloads
PSPath                                 : Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
PSParentPath                           : Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
PSChildName                            : User Shell Folders
PSDrive                                : HKCU
PSProvider                             : Microsoft.PowerShell.Core\Registry*

My problem seems to be how I'm trying to pipe this function to provide output for item's listed as "*Appdata\".

I've tried the following but get no output:

Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" | Where { $_.Data -eq "*AppData\*"}

I am sure I am making a basic mistake here, but just can't seem to figure it out.

Ive also tried Get-ChildItem on this:

Get-ChildItem HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\ |
 Where { $_.Name -like "*User Shell Folders*" } | Select Property | Where { $_.Property -like "*Appdata*" } | Format-Wide

But do not get the correct output just: {AppData, Cache, Cookies, Desktop...}

I can get output on a similar script looking at the hard drive:

PS C:\WINDOWS\system32> Get-ItemProperty -Path "C:\Users\RD\Documents" | Where { $_.Name -like "*Documents"}


    Directory: C:\Users\RD


Mode                LastWriteTime         Length Name                                                                                                                                                      
----                -------------         ------ ----                                                                                                                                                      
d-r---       26/08/2017     13:00                Documents 

Maybe its due to the PSDrive parameter differences? Any advice would be massively appreciated.

Answer 1

I will try to give you some pointers, as that seems to be what you are looking for. Specifically on this:

... to find any entries pointing to a specified file path

When you used Get-ItemProperty on the registry path, you got back a custom object from PowerShell that sets the names in the screenshot to NoteProperty, and the registry (data as you pointed to them) values as the values for these noteproperties. You can easily verify this:

    PS C:\> Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"| Get-member


   TypeName: System.Management.Automation.PSCustomObject

Name                                   MemberType   Definition
----                                   ----------   ----------
Equals                                 Method       bool Equals(System.Object obj)
GetHashCode                            Method       int GetHashCode()
GetType                                Method       type GetType()
ToString                               Method       string ToString()
AppData                                NoteProperty string AppData=C:\Users\adil\AppData\Roaming
Cache                                  NoteProperty string Cache=C:\Users\adil\AppData\Local\Microsoft\Windows\INetCache
Cookies                                NoteProperty string Cookies=C:\Users\adil\AppData\Local\Microsoft\Windows\INetCookies
Desktop                                NoteProperty string Desktop=C:\Users\adil\Desktop
Favorites                              NoteProperty string Favorites=C:\Users\adil\Favorites

So how can you access the NoteProperty values based on your search criteria? You can take a look at the object and look at what it has to offer (shortened just to the ones we care about):

(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders").psobject


   TypeName: System.Management.Automation.PSMemberSet

Name                MemberType Definition
----                ---------- ----------
Methods             Property
Properties          Property

If you take a look at members or properties, you will see now a collection that lists both names and values of that registry key you were looking at:

PS C:\Users\adil> (Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders").psobject.properties |select -first 3


MemberType      : NoteProperty
IsSettable      : True
IsGettable      : True
Value           : C:\Users\adil\AppData\Roaming
TypeNameOfValue : System.String
Name            : AppData
IsInstance      : True

MemberType      : NoteProperty
IsSettable      : True
IsGettable      : True
Value           : C:\Users\adil\AppData\Local\Microsoft\Windows\INetCache
TypeNameOfValue : System.String
Name            : Cache
IsInstance      : True

MemberType      : NoteProperty
IsSettable      : True
IsGettable      : True
Value           : C:\Users\adil\AppData\Local\Microsoft\Windows\INetCookies
TypeNameOfValue : System.String
Name            : Cookies
IsInstance      : True

Based on that information, you can create a new object, that only has the names and data values you were looking for by filtering with, say, -match operator:

    PS C:\Users\adil> (Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders").psobject.Properties| ? {$_.value -match 'appdata'}|select Name,Value

Name          Value
----          -----
AppData       C:\Users\adil\AppData\Roaming
Cache         C:\Users\adil\AppData\Local\Microsoft\Windows\INetCache
Cookies       C:\Users\adil\AppData\Local\Microsoft\Windows\INetCookies
History       C:\Users\adil\AppData\Local\Microsoft\Windows\History
Local AppData C:\Users\adil\AppData\Local
NetHood       C:\Users\adil\AppData\Roaming\Microsoft\Windows\Network Shortcuts
PrintHood     C:\Users\adil\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
Programs      C:\Users\adil\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
Recent        C:\Users\adil\AppData\Roaming\Microsoft\Windows\Recent
SendTo        C:\Users\adil\AppData\Roaming\Microsoft\Windows\SendTo
Start Menu    C:\Users\adil\AppData\Roaming\Microsoft\Windows\Start Menu
Startup       C:\Users\adil\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Templates     C:\Users\adil\AppData\Roaming\Microsoft\Windows\Templates