Powershell Registry Entry

Ok I would like to enter this registry information using powershell need to be sure it is correct:

Code:

Windows Registry Editor Version 5.00
 
[HKEY_CLASSES_ROOT\Applications\powershell.exe\shell\open\command]
@="\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" \"& \\\"%1\\\"\""



HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1
(Default): REG_SZ – “PowerShell Script File”
EditFlags: REG_DOWRD – Hex: 20000
FriendlyTypeName: REG_EXPAND_SZ – @”%systemroot%\system32\windowspowershell\v1.0\powershell.exe”,-103

HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1\DefaultIcon
(Default): REG_SZ – “C:\WINDOWS\Installer\{48664066-BB69-408E-BD48-C21F6D347888}\ext.exe,0″

HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1\Shell
MUIVerb: REG_EXPAND_SZ – “@”%systemroot%\system32\windowspowershell\v1.0\powershell.exe “,-108″

HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1\Shell\Command
(Default): REG_SZ – “C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe” “-Command” “if((Get-ExecutionPolicy ) -ne ‘AllSigned’) { Set-ExecutionPolicy -Scope Process Bypass }; & ‘%1′”

HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1\Shell\Edit
(Default): REG_SZ – “C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe” “%1″

Kinda learning a bit here so bear with me on syntax issues...

This is what I have:


Well any help on this is appreciated.

Code:

 
[HKEY_CLASSES_ROOT\Applications\powershell.exe\shell\open\command]
@="\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" \"& \\\"%1\\\"\""

Set-ItemProperty -Path "Registry::HKEY_CLASSES_ROOT\Applications\powershell.exe\shell\open\command" -Name "SpacesAllowedInScriptNames" -Value "@="\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" \"& \\\"%1\\\"\"""



HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1
(Default): REG_SZ – “PowerShell Script File”
EditFlags: REG_DOWRD – Hex: 20000
FriendlyTypeName: REG_EXPAND_SZ – @”%systemroot%\system32\windowspowershell\v1.0\powershell.exe”,-103

Set-ItemProperty -Path "Registry::HKEY_CLASSES_ROOT\Microsoft.PowerShellscript.1" -Name "(Default)" -Value "Powershell Script File"
Set-ItemProperty -Path "Registry::HKEY_CLASSES_ROOT\Microsoft.PowerShellscript.1" -Name "Editflags" -Type "DWORD" -Value "0x00020000"
Set-ItemProperty -Path "Registry::HKEY_CLASSES_ROOT\Microsoft.PowerShellscript.1" -Name "FriendlyTypeName" -Value "@”%systemroot%\system32\windowspowershell\v1.0\powershell.exe”,-103"


HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1\DefaultIcon
(Default): REG_SZ – “C:\WINDOWS\Installer\{48664066-BB69-408E-BD48-C21F6D347888}\ext.exe,0″  
Set-ItemProperty -Path "Registry::HKEY_CLASSES_ROOT\Microsoft.PowerShellscript.1\DefaultIcon" -Name "(Default)" -Value "C:\WINDOWS\Installer\{48664066-BB69-408E-BD48-C21F6D347888}\ext.exe,0"


HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1\Shell
MUIVerb: REG_EXPAND_SZ – “@”%systemroot%\system32\windowspowershell\v1.0\powershell.exe “,-108″

Set-ItemProperty -Path "Registry::HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1\Shell" -Name "MUIVerb -Value “@”%systemroot%\system32\windowspowershell\v1.0\powershell.exe “,-108"

HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1\Shell\Command
(Default): REG_SZ – “C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe” “-Command” “if((Get-ExecutionPolicy ) -ne ‘AllSigned’) { Set-ExecutionPolicy -Scope Process Bypass }; & ‘%1′”


Set-ItemProperty -Path "Registry::HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1\Shell\Command" -Name "(Default)" -Value “C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe” “-Command” “if((Get-ExecutionPolicy ) -ne ‘AllSigned’) { Set-ExecutionPolicy -Scope Process Bypass }; & ‘%1′”


HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1\Shell\Edit
(Default): REG_SZ – “C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe” “%1″

Set-ItemProperty -Path "Registry::HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1\Shell\Edit -Name "(Default)" -Value “C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe” “%1"

Thanks in advance !

Edited I just uploaded the file I am trying to convert to a .ps1 registry change.


-infringer-

 

It would defeat the purpose of what I am trying to accomplish a better understanding of powershell itself and the easiest way for me to learn is by example. To me powershell has an ability to accomplish everything in automation providing you give it the proper data. Elimination of prompts is nice while any automation can be used for bad reasons we should not let that take automation away from the user if that is what they prefer. There are a million and one reasons for automation the largest of them is to eliminate menial tasks. Let us be honest here if one would realize how much time they could save in their life by not having to use a light switch they would likely do it in an automated fashion. We are far to used to doing menial tasks and wasting our valued time doing it. Powershell for me is a way to overcome such wastes of time. Lets say you spend 5 minutes out of your day flipping light switches by the time you have reached 70 you would have wasted 89 days of your life flipping light switches.... Hrmmm I don't know about you but when I think of this If I could have 89 more days to live by not touching another light switch it certainly lends a bit more credibility to automation. I feel there are similar things in computing while the computer makes it possible to automate there are latent protocols that eat into our productivity as well. I think powershell is a tool that has an ability to fix this.

 

Could we start this over and make things more simple for the question to be answered?


Maybe this is more about syntax confusion for me so using this instance:

(Note: It may be possible that this is incorrect as well I suppose for syntax for regedit)

Code:

[HKEY_CLASSES_ROOT\Microsoft.PowerShellScript.1]
EditFlags: REG_DOWRD – Hex: 20000

You are saying the above is incorrect and below is correct for regedit right?

Code:

[HKEY_CLASSES_ROOT\Microsoft.PowershellScript.1]
"EditFlags"=dword:00020000

Or possibly both will work will they?

But lets use this instance to clear the air for me as this will help me be sure I am doing things correctly as there are two elements that both require data using specific patterns or syntax.

My thoughts on how it would be done in powershell

Code:

Set-ItemProperty -Path "Registry::HKEY_CLASSES_ROOT\Microsoft.PowerShellscript.1" -Name "Editflags" -Type "DWORD" -Value "0x00020000" 

How would you accomplish this same thing via powershell to set this single method show me?


Would it be like this?:

Code:

New-PSDrive -PSProvider registry -Root HKEY_CLASSES_ROOT -Name HKCR
Set-ItemProperty -Path "Registry::HKCR\Microsoft.PowerShellscript.1" -Name "Editflags" -Type "DWORD" -Value "0x00020000" 

If So,
Could we just keep HKEY_CLASSES_ROOT as it is dunno why we have to use HKCR I know it is shorter but it almost seems as if we are giving it a short name HKCR in the above example unless the name is something that already exists ?

for instance:

Code:

New-PSDrive -PSProvider registry -Root HKEY_CLASSES_ROOT -Name HKEY_CLASSES_ROOT
Set-ItemProperty -Path "Registry::HKEY_CLASSES_ROOT\Microsoft.PowerShellscript.1" -Name "Editflags" -Type "DWORD" -Value "0x00020000" 

Finally The below bit of info you gave me.

Code:

New-item HKLM:\SOFTWARE\Classes\Microsoft.PowershellScript.1\Shell\Edit -force

I see you are using the -force switch here are you using it like a group policy edit

So does it copy from HKLM upon restart if so then this would work I am thinking:

Code:

Set-ItemProperty -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellscript.1" -Name "Editflags" -Type "DWORD" -Value "0x00020000" -force

If not I am confused so just bare with me as I try to grasp some understanding out of these simple examples.

Are you telling me it is mirrored because I can use it in this fashion?

Or are you telling me it is mirrored because I need to copy it to both?

Or it is possible you are telling me that it is mirrored so that I can use either and having access to the one already it is potentially easier to accomplish the task which still leaves the -force switch in question to me.

It is possible that I have to use New-Item for registry keys that do not exist would be nice to know this too I suppose. I realize I must do some more reading I have created some successful scripts to automate quite a bit for me already but either way I want to get this stuff learned to automate registry entries with powershell this is the goal If you can no longer help for whatever reason even if you are annoyed just say so I will not take offense to it!

Note: this has been edited many times for simplicity of your understanding and my own understanding.

 

The edits were many but the question no longer exists about hex to me it was pretty evident what was being done ...

Must have caught me mid stream when asking the question but I figured why not dumb my question down a bit and come to the same conclusion that I am trying to arrive at.

 

The most interesting thing is you are able to not only address the info of syntax but you can also address the info of what I am trying to do and correct some of my missing ' marks as well very elaborate I can tell you worked with this stuff a bit

For instance:

Code:

Set-ItemProperty -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\powershell.exe\shell\open\command" -Name "(Default)" -Type "String" -Value "`"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe`" `"& \`"%1\`"`""

I had this as:

Code:

Set-ItemProperty -Path "Registry::HKEY_CLASSES_ROOT\Applications\powershell.exe\shell\open\command" -Name "SpacesAllowedInScriptNames" -Value "@="\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" \"& \\\"%1\\\"\"""

This was due to copying from notepad so I assume you are correct by adding the ' Marks where needed. I assume this is like C markup where a string starts is like 'string of information here' indicating a string?
Or is it indicating that there is multiple values or strings?
I guess I will have to look more into when and why to use the ' mark for powershell I assume you would need that same info for regedit as well?

Excellent now that is something that I can dig using the " if "- statements to check if they are already there!

I suppose if one wanted to be safer they could export the keys with powershell as well before changing them to a directory as well
Like so:

Code:

If (-Not (Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\powershell.exe\shell\open\command")){
New-Item -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\powershell.exe\shell\open\command" -ItemType RegistryKey -Force
}
Reg Export "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\powershell.exe\shell\open\command" C:\Powershell Open Command.reg
Set-ItemProperty -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\powershell.exe\shell\open\command" -Name "(Default)" -Type "String" -Value "`"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe`" `"& \`"%1\`"`""

I must admit this was every bit as good as a fresh baked chocolate chip cookie!
Getting the syntax right holds a great deal of importance one wrong markup could put you in an interesting spot you don't want to be in so the export is rather nice before making changes.


Registry Hive Structure and syntax Information for any of those wondering:

The Windows Registry is a hierarchical database that contains all of the configurations and settings used by components, services, applications, and pretty much everything in Windows.

The interesting thing that most people don’t know is that three of the five items on the root level aren’t actually there… they are just linked to items further down in one of the other keys.
HKEY_CLASSES_ROOT

Windows uses this section to manage file type associations, and it is usually abbreviated HKCR when being referenced in documentation. This key is actually just a link to HKLM\Software\Classes.

You can also use this section if you want to tweak the context menu for a particular file type.
HKEY_CURRENT_USER

Holds the user settings for the currently logged in user, and is usually abbreviated HKCU This is actually just a link to HKEY_USERS\<SID-FOR-CURRENT-USER>. The most important sub-key in here is HKCU\Software, which contains user-level settings for most of your software.
HKEY_LOCAL_MACHINE

All of the system-wide settings are stored here, and it is usually abbreviated as HKLM. You’ll mostly use the HKLM\Software key to check machine-wide settings.
HKEY_USERS

Stores all of the settings for all users on the system. You’ll typically use HKCU instead, but if you need to check settings for another user on your computer, you can use this one.
HKEY_CURRENT_CONFIG

Stores all of the information about the current hardware configuration. This one isn’t used very often, and it just a link to HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\Current.

This should sum up the structure for those still wondering or reading While I have made many different registry keys base off of just looking and modifying or importing or exporting and editing I would say I guess I never fully understood the structure good to know for all out there ....

Of course the syntax was another question for the most part I used other keys as reference to cheat more or less...

Code:

RegistryEditorVersion
Blank line
[RegistryPath1] 
"DataItemName1"="DataType1:DataValue1"
DataItemName2"="DataType2:DataValue2" <----- Hrmm this is what it says on M$ website shouldn't it be MISSING QUOTE HERE> "DataItemName2"="DataType2:DataValue2" Quite possibly a typo  if I recall correct it is indeed missing a quote!
Blank line
[RegistryPath2] 
"DataItemName3"="DataType3:DataValue3"

Maybe you can clear this up for me is it missing a " mark at the beginning of DataItemName2" or is this how it is supposed to be?

Take a look for yourself Microsoft made this post about syntax and if they got it wrong http://support.microsoft.com/kb/310516/ double facepalm on that one!


Also the data types are as follows:


String Value (REG_SZ) – This contains anything that will fit into a regular string. The vast majority of the time, you can edit human-readable strings without breaking everything.
Binary Value (REG_BINARY) – This value contains arbitrary binary data, and you will almost never want to attempt to edit one of these keys.
DWORD (32-bit) Value (REG_DWORD) – These are almost always used for a regular integer value, whether just 0 or 1, or a number from 0 to 4,294,967,295.
QWORD (64-bit) Value (REG_QWORD) – These are not used very often for registry hacking purposes, but it’s basically a 64-bit integer value.
Multi-String Value (REG_MULTI_SZ) – These values are fairly uncommon, but it works basically like a notepad window. You can type multi-line textual information into a field like this.
Expandable String Value (REG_EXPAND_SZ) – These variables have a string that can contain environment variables and is often used for system paths. So a string might be %SystemDrive%\Windows and would expand to C:\Windows. This means that when you find a value in the Registry that is set to this type, you can change or insert environment variables and they will be “expanded” before the string is used.