Get Reg Values

getRegValues.ps1

[CmdletBinding()]
param (
    [Parameter(Mandatory=$false)]
    [string]$dnsNamePattern = 'google',
    [Parameter(Mandatory=$false)]
    [string[]]$registryPaths = @("HKLM:\SOFTWARE\WOW6432Node\Google"),
    [Parameter(Mandatory=$false)]
    [string[]]$excludePaths = @("HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update*"),
    [Parameter(Mandatory=$false)]
    [string[]]$computerNames = @("localhost"),
    [Parameter(Mandatory=$false)]
    [string]$outputFile = "DNSPatternMatches.csv"
)

function Search-RegistryValuesLocal {
    [CmdletBinding()]
    param (
        [string]$path,
        [string]$pattern,
        [string[]]$exclude
    )

    $ErrorActionPreference = 'SilentlyContinue'
    $script:matches = @()
    $stack = New-Object System.Collections.Stack

    $path = $path -replace '^HKLM:\\', 'HKEY_LOCAL_MACHINE\'
    $rootKey = $path.Split('\')[0]
    $subKey = $path.Substring($rootKey.Length + 1)

    $hive = switch ($rootKey) {
        'HKEY_LOCAL_MACHINE' { [Microsoft.Win32.RegistryHive]::LocalMachine }
        #'HKEY_CURRENT_USER'  { [Microsoft.Win32.RegistryHive]::CurrentUser }
        # Add other hives as needed
    }

    try {
        $baseKey = [Microsoft.Win32.RegistryKey]::OpenBaseKey($hive, [Microsoft.Win32.RegistryView]::Default)
        $stack.Push(@{Key = $baseKey.OpenSubKey($subKey); Path = $subKey})

        while ($stack.Count -gt 0) {
            $current = $stack.Pop()
            $currentKey = $current.Key
            $currentPath = $current.Path

            if ($null -eq $currentKey) { continue }

            $fullPath = "${rootKey}\${currentPath}"
            
            $isExcluded = $false
            foreach ($excludePath in $exclude) {
                if ($fullPath -like $excludePath) {
                    $isExcluded = $true
                    break
                }
            }

            if ($isExcluded) {
                Write-Verbose "Skipping excluded path: $fullPath"
                continue
            }

            try {
                Write-Verbose "Searching: $fullPath"
                
                foreach ($valueName in $currentKey.GetValueNames()) {
                    $value = $currentKey.GetValue($valueName)
                    if ($value -is [string] -and $value -match $pattern) {
                        $script:matches += [PSCustomObject]@{
                            ComputerName = $env:COMPUTERNAME
                            Path = $fullPath
                            Name = $valueName
                            Value = $value
                        }
                        Write-Verbose "Matched: $valueName = $value"
                    }
                }

                foreach ($subKeyName in $currentKey.GetSubKeyNames()) {
                    $subKey = $currentKey.OpenSubKey($subKeyName)
                    if ($null -ne $subKey) {
                        $stack.Push(@{Key = $subKey; Path = "$currentPath\$subKeyName"})
                    }
                }
            }
            catch [System.Security.SecurityException] {
                Write-Verbose "Access denied to $fullPath"
            }
            catch {
                Write-Verbose "Error accessing $fullPath`: $_"
            }
            finally {
                if ($currentKey -ne $baseKey) {
                    $currentKey.Dispose()
                }
            }
        }
    }
    finally {
        if ($null -ne $baseKey) {
            $baseKey.Dispose()
        }
    }

    return $script:matches
}

function Search-RegistryValuesRemote {
    [CmdletBinding()]
    param (
        [string]$computerName,
        [string]$path,
        [string]$pattern,
        [string[]]$exclude
    )
    
    try {
        $result = Invoke-Command -ComputerName $computerName -ScriptBlock ${function:Search-RegistryValuesLocal} -ArgumentList $path, $pattern, $exclude -ErrorAction SilentlyContinue
        return $result
    }
    catch {
        Write-Error "Error searching registry on $computerName`: $_"
        Write-Verbose "Error details: $($_.Exception.Message)"
        return @()
    }
}

$results = @()
$totalPaths = $computerNames.Count * $registryPaths.Count
$currentPath = 0

foreach ($computerName in $computerNames) {
    Write-Host "Searching on computer: $computerName"
    foreach ($path in $registryPaths) {
        $currentPath++
        Write-Progress -Activity "Searching registry" -Status "Processing $computerName : $path" -PercentComplete (($currentPath / $totalPaths) * 100)
        
        Write-Host "  Searching path: $path"
        try {
            if ($computerName -eq "localhost" -or $computerName -eq "127.0.0.1" -or $computerName -eq $env:COMPUTERNAME) {
                $localResults = Search-RegistryValuesLocal -path $path -pattern $dnsNamePattern -exclude $excludePaths
            }
            else {
                $localResults = Search-RegistryValuesRemote -computerName $computerName -path $path -pattern $dnsNamePattern -exclude $excludePaths
            }
            Write-Verbose "Found $(($localResults | Measure-Object).Count) items"
            if ($localResults) {
                $results += $localResults
            }
        }
        catch {
            Write-Error "Error processing $computerName, $path`: $_"
            Write-Verbose "Error details: $($_.Exception.Message)"
            Write-Verbose "Stack trace: $($_.ScriptStackTrace)"
        }
    }
}

Write-Progress -Activity "Searching registry" -Completed

if ($results.Count -gt 0) {
    $results | Export-Csv -Path $outputFile -NoTypeInformation
    Write-Host "Results exported to $outputFile"
    $results | Format-Table -AutoSize
}
else {
    Write-Host "No matches found."
}