powershell - 从脱机注册表文件中读取值

Question

我正在尝试读取脱机注册表文件:

$product_name = Get-ItemProperty -Path "C:\temp\RegistryHives\SOFTWARE\Microsoft\Windows NT\CurrentVersion" -name ProductName | Select-Object -ExpandProperty ProductName

得到以下错误。什么是访问脱机注册表文件键和值的正确方法？

Get-ItemProperty : Cannot find path 'C:\temp\RegistryHives\SOFTWARE\Microsoft\Windows NT\CurrentVersion' because it
does not exist.
At line:1 char:17
+ ... duct_name = Get-ItemProperty -Path "C:\temp\RegistryHives\SOFTWARE\Mi ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (C:\temp\Registr...\CurrentVersion:String) [Get-ItemProperty], ItemNotFo
   undException
    + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetItemPropertyCommand

Answer 1

您需要在访问之前加载注册表。 reg.exe可以使用load命令加载 hive 。

Reg.exe load 'HKLM\TempHive' C:\temp\RegistryHives\SOFTWARE
$product_name = Get-ItemProperty -Path "HKLM:\TempHive\Microsoft\Windows NT\CurrentVersion" -name ProductName | Select-Object -ExpandProperty ProductName
Reg.exe unload 'HKLM\TempHive'