如何用PowerShell单命令获取远程计算机递归注册表键及值

核心解决方案 #

通过一次Invoke-Command远程调用，递归拉取目标注册表分支的所有键、键值及类型，返回结构化对象集合，彻底减少网络请求次数。执行以下命令即可完成全量数据获取：

$remoteRegistryData = Invoke-Command -ComputerName server01 -ScriptBlock {
    $rootKey = "HKLM:\Software\Wow6432Node\Vendor\App\DatabaseList"
    # 递归获取所有子键，包含根键
    $allKeys = Get-ChildItem -Path $rootKey -Recurse -ErrorAction SilentlyContinue
    $allKeys += Get-Item -Path $rootKey -ErrorAction SilentlyContinue

    # 遍历所有键，提取结构化键值数据
    $allKeys | ForEach-Object {
        $keyPath = $_.Name -replace 'HKEY_LOCAL_MACHINE', 'HKLM:'
        $props = Get-ItemProperty -Path $keyPath -ErrorAction SilentlyContinue
        
        # 仅保留注册表原生键值，排除PowerShell内置属性
        $props | Get-Member -MemberType NoteProperty | ForEach-Object {
            # 兼容PS2，使用New-Object替代[PSCustomObject]
            New-Object PSObject -Property @{
                KeyPath    = $keyPath
                ValueName  = $_.Name
                ValueData  = $props.$($_.Name)
                ValueType  = (Get-Item -Path $keyPath).GetValueKind($_.Name)
            }
        }
    } | Where-Object { $null -ne $_.ValueName }
} -ErrorAction Stop

本地处理流程（无额外网络请求） #

获取到$remoteRegistryData后，所有搜索、验证操作均可在本地完成：

• 查找目标键：直接筛选集合

  $targetEntry = $remoteRegistryData | Where-Object {
      $_.KeyPath -eq 'HKLM:\Software\Wow6432Node\Vendor\App\DatabaseList\DB01' -and
      $_.ValueName -eq 'ConnectionString'
  }
  

• 验证当前值：直接读取$targetEntry.ValueData

批量修改与验证（仅2次额外网络请求） #

1. 批量修改键值：收集所有需要修改的项，通过一次远程调用完成：

   $changeList = @(
       @{
           KeyPath    = 'HKLM:\Software\Wow6432Node\Vendor\App\DatabaseList\DB01'
           ValueName  = 'ConnectionString'
           ValueData  = 'Server=NewDB;Database=AppDB;Trusted_Connection=True'
           ValueType  = 'String'
       },
       @{
           KeyPath    = 'HKLM:\Software\Wow6432Node\Vendor\App\DatabaseList\DB02'
           ValueName  = 'Timeout'
           ValueData  = 30
           ValueType  = 'DWord'
       }
       # 追加其余14个键的修改项
   )
   
   Invoke-Command -ComputerName server01 -ScriptBlock {
       param($Changes)
       foreach ($change in $Changes) {
           Set-ItemProperty -Path $change.KeyPath -Name $change.ValueName `
               -Value $change.ValueData -Type $change.ValueType -ErrorAction Stop
       }
   } -ArgumentList $changeList -ErrorAction Stop
   

2. 批量验证新值：再次拉取全量数据（或仅目标键），本地对比验证：

   $updatedData = Invoke-Command -ComputerName server01 -ScriptBlock {
       $rootKey = "HKLM:\Software\Wow6432Node\Vendor\App\DatabaseList"
       $allKeys = Get-ChildItem -Path $rootKey -Recurse -ErrorAction SilentlyContinue
       $allKeys += Get-Item -Path $rootKey -ErrorAction SilentlyContinue
   
       $allKeys | ForEach-Object {
           $keyPath = $_.Name -replace 'HKEY_LOCAL_MACHINE', 'HKLM:'
           $props = Get-ItemProperty -Path $keyPath -ErrorAction SilentlyContinue
           $props | Get-Member -MemberType NoteProperty | ForEach-Object {
               New-Object PSObject -Property @{
                   KeyPath    = $keyPath
                   ValueName  = $_.Name
                   ValueData  = $props.$($_.Name)
               }
           }
       } | Where-Object { $null -ne $_.ValueName }
   } -ErrorAction Stop
   
   # 逐一验证修改结果
   foreach ($change in $changeList) {
       $newValue = $updatedData | Where-Object {
           $_.KeyPath -eq $change.KeyPath -and $_.ValueName -eq $change.ValueName
       } | Select-Object -ExpandProperty ValueData
   
       if ($newValue -eq $change.ValueData) {
           Write-Host "✅ $($change.KeyPath)\$($change.ValueName) 已成功更新"
       } else {
           Write-Error "❌ $($change.KeyPath)\$($change.ValueName) 更新失败"
       }
   }
   

兼容性说明 #

• PowerShell 2（远程服务器）：使用New-Object PSObject替代[PSCustomObject]，所有命令均为PS2原生支持，无需额外模块
• PowerShell 5（本地）：完全兼容，可直接替换为[PSCustomObject]提升效率
• 网络请求优化：从原64次（16键×4步）降至3次（1次全量获取+1次批量修改+1次批量验证），远低于目标的18次

内容的提问来源于stack exchange，提问作者Epsilon