I understand. Give this a shot:
$Computers = get-adcomputer -filter { name -like "us-it*" } | select Name
#put column names on csv file
Out-File c:\windows\temp\RegValues.csv -InputObject
"ComputerName,RegistryKey,Name,Value" -Append
foreach($computer in $Computers.Name)
{
$wmi=[wmiclass]"\\$($computer)\root\default:stdRegProv"
foreach($name in
($wmi.EnumValues(2147483650,"Software\Microsoft\Windows\CurrentVersion\Run")).sNames){"$($computer),Run,$($name),"
+
$(($wmi.GetExpandedStringValue(2147483650,"Software\Microsoft\Windows\CurrentVersion\Run",$name)).sValue)
| Out-File c:\windows\temp\RegValues.csv -Append}
foreach($name in
($wmi.EnumValues(2147483650,"Software\Wow6432node\Microsoft\Windows\CurrentVersion\Run")).sNames){"$($computer),x64Run,$($name),"
+
$(($wmi.GetExpandedStringValue(2147483650,"Software\Wow6432node\Microsoft\Windows\CurrentVersion\Run",$name)).sValue)
| Out-File c:\windows\temp\RegValues.csv -Append}
foreach($name in
($wmi.EnumValues(2147483650,"Software\Microsoft\Windows\CurrentVersion\RunOnce")).sNames){"$($computer),RunOnce,$($name),"
+
$(($wmi.GetExpandedStringValue(2147483650,"Software\Microsoft\Windows\CurrentVersion\RunOnce",$name)).sValue)
| Out-File c:\windows\temp\RegValues.csv -Append}
foreach($name in
($wmi.EnumValues(2147483650,"Software\Wow6432node\Microsoft\Windows\CurrentVersion\RunOnce")).sNames){"$($computer),x64RunOnce,$($name),"
+
$(($wmi.GetExpandedStringValue(2147483650,"Software\Wow6432node\Microsoft\Windows\CurrentVersion\RunOnce",$name)).sValue)
| Out-File c:\windows\temp\RegValues.csv -Append}
}
When you open the csv with excel you will have to use the text to columns tool
on the ribbon...
I also changed the output path to windows\temp - just for testing on my
machine. Works decent. Good luck!
Matt
-----Original Message-----
From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On
Behalf Of Kurt Buff
Sent: Friday, March 20, 2015 12:04 PM
To: powershell@lists.myitforum.com
Subject: Re: [powershell] Scripting registry queries
Responses in-line...
On Fri, Mar 20, 2015 at 5:37 AM, Kelley, Matthew <kelle...@med.umich.edu> wrote:
> Is this a one-time data capture, or something you need to do on a
> recurring basis?
Recurring, minimum once a week.
> Do you have any systems management software, like SCCM, in your
> environment?
We have no systems management software, though we have an EA agreement (my
manager doesn't like SCCM - I have no experience with it, though I'd love to
get my hands dirty with it, and with SCOM, but we do have PRTG, which would get
very expensive if we tried to monitor workstations with it.)
> If not, do your machines run a startup script through Group Policies?
> The best solution would be SCCM or something similar, where you can
> easily inventory registry keys and wmi data. Second best would be a
> logon or shutdown script that mines this data and writes it to a
> network share that your computer accounts (domain computers in AD)
> have write permissions on.
We have lots of people who never log off or shut down their machines, except
when we patch (me included!). It will be better (IMHO) to have all of this
gathered and processed in a more controlled fashion.
> Then you would just need a script to compile all these results into
> whatever format you want for viewing, like an excel spreadsheet.
> Having one machine open connections to all other machines in your
> environment is cumbersome, but it will work if some of the other
> options are unavailable, or if this is just a one-time event.
I'm intent on building a management station, as a counterpart to our
SecurityOnion installation. It'll be performing some other tasks as well - this
is just the first step.
BTW - if you're interested, the SANS webcast (which requires free
registration) is here:
https://www.sans.org/webcasts/seamless-continuous-monitoring-defend-organization-cyber-attacks-99472
Kurt
================================================
Did you know you can also post and find answers on PowerShell in the forums?
http://www.myitforum.com/forums/default.asp?catApp=1
**********************************************************
Electronic Mail is not secure, may not be read every day, and should not be
used for urgent or sensitive issues
================================================
Did you know you can also post and find answers on PowerShell in the forums?
http://www.myitforum.com/forums/default.asp?catApp=1
