How to Use Windows PowerShell ‘Get-ItemProperty’ to Audit the Registry

The Dangers of Regedit

The Windows Registry is the master database that controls almost every behavior of the operating system. It dictates which programs launch at startup, how the network stack behaves, and whether USB drives are allowed to be mounted.

Historically, administrators modified this database using the graphical regedit.exe tool. This is highly dangerous. One accidental click or typo in regedit can instantly render a server unbootable. Furthermore, you cannot use a graphical tool to audit the registry of 50 remote servers simultaneously.

To safely read and parse the registry at an enterprise scale, Windows administrators use the PowerShell cmdlet Get-ItemProperty. PowerShell treats the Registry exactly like a standard file system (like the C: drive), making it incredibly easy to navigate and query safely.

1. Navigating the Registry Drive

PowerShell creates “Providers” that map complex systems into simple drives. The two main registry hives are mapped to HKLM: (Local Machine) and HKCU: (Current User).

You can literally use the standard cd (Set-Location) and ls (Get-ChildItem) commands to browse the registry exactly as if you were browsing folders on your hard drive.

cd HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ls

This drops you directly into the critical folder that controls which hidden applications launch silently every time the server boots up.

2. Reading Specific Keys (Get-ItemProperty)

While ls shows you the folders (keys), it doesn’t easily show you the actual data hidden inside them. To extract the specific data values, you must use Get-ItemProperty.

Suppose you want to write a security compliance script that checks if the Windows Firewall is actually enabled on a server.

$path = "HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile"
$firewall = Get-ItemProperty -Path $path -Name "EnableFirewall"

Write-Host "Firewall Status: " $firewall.EnableFirewall

If the output is 1, the firewall is on. If it is 0, it has been disabled, and your script can instantly throw an alert to the security team.

3. Auditing Software Installations

One of the most common administrative tasks is generating a list of every single program installed on a Windows machine (to verify license compliance or hunt for unauthorized software).

The legacy “Add/Remove Programs” Control Panel is notoriously slow. You can query the registry directly to get a lightning-fast list.

$uninstallKey = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*"
Get-ItemProperty $uninstallKey | Select-Object DisplayName, DisplayVersion, Publisher | Where-Object DisplayName -ne $null

Breaking down the syntax:

• We use a wildcard (*) at the end of the registry path. This tells Get-ItemProperty to grab every single folder inside the Uninstall directory simultaneously.
• We pipe that massive object into Select-Object to filter out the noise, keeping only the Name, Version, and Publisher columns.
• We use Where-Object to drop any blank rows where the software name is null.

The result is a perfect, clean table of every installed application that took fractions of a second to generate.

Conclusion

The Get-ItemProperty cmdlet demystifies the Windows Registry. By exposing the complex, hierarchical database as a simple, scriptable file system, PowerShell allows IT professionals to build robust compliance audits, verify system configurations, and parse installed software securely and at scale.