Intune部署PowerShell脚本读取HKCU注册表路径遇空格报错求助

问题原因 #

1. 运行上下文不匹配：Intune部署的PowerShell脚本默认以SYSTEM账户执行，HKCU:指向的是当前执行账户的注册表 hive，SYSTEM账户的HKCU并非登录用户的注册表，因此无法访问用户的WorkplaceJoin信息。
2. 隐藏字符干扰：脚本复制到Intune时可能引入了隐藏的换行/空格字符，导致注册表路径解析异常。

解决方案 #

1. 切换到登录用户的注册表上下文 #

通过获取当前登录用户的SID，直接访问HKU:\<SID>下的用户注册表分支，替代HKCU:：

# 获取当前登录用户的SID
$currentUser = (Get-WmiObject Win32_ComputerSystem).UserName
$userSID = (New-Object System.Security.Principal.NTAccount($currentUser)).Translate([System.Security.Principal.SecurityIdentifier]).Value

# 构建正确的用户注册表路径
$path = "HKU:\$userSID\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WorkplaceJoin\JoinInfo"

2. 清理脚本中的隐藏字符 #

• 使用纯文本编辑器（如Notepad++）打开脚本，开启显示所有字符功能，检查并移除路径字符串中的多余空格、换行符
• 始终用单引号包裹路径字符串，避免自动解析转义字符

完整修正后的脚本 #

## 收集设备硬件信息
$cpu = Get-WmiObject -Class Win32_Processor | Select-Object @{n="CPU";e={$_.name}}
$model = Get-WmiObject -Class Win32_ComputerSystem | Select-Object Model
$serialNumber = Get-WmiObject win32_bios | Select-Object SerialNumber
$WinVer = Get-WmiObject Win32_OperatingSystem | Select-Object Version
$WinBuild = Get-WmiObject Win32_OperatingSystem | Select-Object BuildNumber
$memory = [math]::Round((Get-WmiObject Win32_PhysicalMemory | Measure-Object -Sum Capacity).Sum / 1GB, 2)
$owner = Get-WmiObject Win32_ComputerSystem | Select-Object PrimaryOwnerName
$totalStorage = [math]::Round((Get-WmiObject Win32_DiskDrive | Measure-Object -Sum Size).Sum / 1GB, 2)

## 获取工作/学校账户信息
$AccountMailAddress = "未找到关联账户或访问失败"
try {
    $currentUser = (Get-WmiObject Win32_ComputerSystem).UserName
    $userSID = (New-Object System.Security.Principal.NTAccount($currentUser)).Translate([System.Security.Principal.SecurityIdentifier]).Value
    $path = "HKU:\$userSID\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WorkplaceJoin\JoinInfo"

    if (Test-Path $path) {
        $AccountMailAddress = (Get-ChildItem $path | Get-ItemProperty).UserEmail
    }
} catch {
    $AccountMailAddress = "获取失败: $($_.Exception.Message)"
}

# 输出JSON结果
[PSCustomObject]@{
    ComputerName           = $env:COMPUTERNAME
    Model                  = $model.Model
    SerialNumber           = $serialNumber.SerialNumber
    Owner                  = $owner.PrimaryOwnerName
    "Work or School account" = $AccountMailAddress
    "Windows Version"      = $WinVer.Version
    "Windows Build"        = $WinBuild.BuildNumber
    "RAM(GB)"              = $memory
    CPU                    = $cpu.CPU
    "TotalStorage(GB)"     = $totalStorage
} | ConvertTo-Json

额外注意事项 #

• 确保设备已加入Azure AD或已注册工作/学校账户，否则注册表路径不存在
• 脚本加入了异常处理和路径检查，避免因权限或路径不存在导致脚本执行失败

内容的提问来源于stack exchange，提问作者Tomáš Kadlec