3

I've been doing searches on my registry and everything works well except HKLM. A search on HKLM takes hours and doesn't seem to work.

I'm using some powershell code from here

gci . -rec -ea SilentlyContinue | % { if((get-itemproperty -Path $_.PsPath) -match “<SomeText>”) { $_.PsPath} }

This is running as administrator on WinXP under a domain logged into both administrator as well as domain admin.

After a few expected security warnings for SAM and the like, it continues searching for hours--I could do better with F3 in regedit. It doesn't seem to find anything, either. Any ideas on why it's so slow?

Also, just as a side note, if I search HKU and HKLM, do I end up searching the whole registry (besides PERFORMANCE_DATA and DYN_DATA)?

0

1 Answer 1

2

This questions was asked regarding the filesystem on SO here. I would imagine the same applies to using it for the registry. I linked to Lee Holmes blog post on PowerShell Team's blog.

I would expect you might get a quicker search using REG.exe with the /QUERY parameter.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .