如何用PowerShell远程删除App-V注册表通配符路径下的SID子键？

问题背景 #

你正在编写PowerShell脚本，目标是删除远程计算机注册表中App-V相关的指定SID子键。这些子键的路径格式为：

HKLM\SOFTWARE\Microsoft\AppV\MAV\Configuration\Packages\<PackageID>\UserConfigEx\<SID>

其中<PackageID>和<SID>都是唯一值，需要遍历所有<PackageID>路径，删除其中匹配用户输入SID的子键。

现有脚本及错误 #

你当前的脚本如下：

#Take user input 
$SID = Read-Host "Please enter users SID" 
$computer = Read-Host "Please enter computer name" 

#Test connection 
Write-Host "Connecting to $computer" 
if (Test-Connection -ComputerName $computer -Quiet -BufferSize 16 -Count 1) { 
    #Connect to registry and delete key 
    try { 
        $reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', $computer) 
        $regKey = $reg.OpenSubKey("HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\AppV\\MAV\\Configuration\\Packages\\*\\UserConfigEx\\$SID",$true ) 
        if ($regkey.GetValue('SID')) { 
            $regKey.DeleteValue('SID') 
            Write-Host 
            Write-Host "$SID key deleted successfully" -ForegroundColor Green 
        } else { 
            Write-Host 
            Write-Host "No keys with this SID exist." -ForegroundColor Red 
        } 
    } catch { 
        $ErrorMessage = $_.Exception.Message 
        Write-Host "Unable to connect to $computer. Error: $($ErrorMessage)." -ForegroundColor Red 
    } 
} else { 
    Write-Host "Unable to connect to $computer. Please ensure correct computer name / IP address has been entered correctly." -ForegroundColor Red 
}

运行时出现错误：

You cannot call a method on a null-valued expression. 
At line:51 char:9 
+ if ($regkey.GetValue('SID') 
+ ~~~~~~~~~~~~~~~~~~~~~~~~ 
+ CategoryInfo : InvalidOperation: (:) [], RuntimeException 
+ FullyQualifiedErrorId : InvokeMethodOnNull

问题分析 #

1. OpenSubKey不支持通配符：你试图在路径中用*匹配所有PackageID，但[Microsoft.Win32.RegistryKey]的OpenSubKey方法不支持通配符，直接使用会导致找不到路径，$regKey变为null，后续调用GetValue就会触发“空值表达式调用方法”的错误。
2. 语法错误：脚本中存在括号不匹配（if ($regkey.GetValue('SID')缺少闭合括号）、字符串转义冗余（路径里的\\可以简化为\，因为用双引号包裹时不需要额外转义）的问题。
3. 逻辑偏差：你当前的代码试图删除SID值，但实际需求是删除整个SID子键，而不是子键里的某个值。

修正后的脚本 #

下面是修复后的完整脚本，解决了上述所有问题：

# 获取用户输入
$SID = Read-Host "Please enter user's SID"
$computer = Read-Host "Please enter computer name"

# 测试远程连接
Write-Host "Connecting to $computer..." -ForegroundColor Cyan
if (Test-Connection -ComputerName $computer -Quiet -BufferSize 16 -Count 1) {
    try {
        # 打开远程HKLM注册表根键
        $regRoot = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', $computer)
        # 定位到Packages父键
        $packagesKey = $regRoot.OpenSubKey("SOFTWARE\Microsoft\AppV\MAV\Configuration\Packages", $true)
        
        if (-not $packagesKey) {
            Write-Host "App-V Packages registry path not found on $computer." -ForegroundColor Yellow
            exit
        }

        # 遍历所有PackageID子键
        $deletedCount = 0
        foreach ($packageIDKey in $packagesKey.GetSubKeyNames()) {
            # 构建UserConfigEx路径
            $userConfigPath = "SOFTWARE\Microsoft\AppV\MAV\Configuration\Packages\$packageIDKey\UserConfigEx"
            $userConfigKey = $regRoot.OpenSubKey($userConfigPath, $true)
            
            if ($userConfigKey) {
                # 检查当前UserConfigEx下是否存在目标SID子键
                if ($userConfigKey.GetSubKeyNames() -contains $SID) {
                    # 删除整个SID子键
                    $userConfigKey.DeleteSubKeyTree($SID)
                    Write-Host "Deleted SID subkey under PackageID: $packageIDKey" -ForegroundColor Green
                    $deletedCount++
                }
                # 关闭子键释放资源
                $userConfigKey.Close()
            }
        }

        # 输出最终结果
        Write-Host "`nOperation completed." -ForegroundColor Cyan
        if ($deletedCount -gt 0) {
            Write-Host "Successfully deleted $deletedCount SID subkey(s) on $computer." -ForegroundColor Green
        } else {
            Write-Host "No SID subkeys matching '$SID' found on $computer." -ForegroundColor Red
        }

        # 关闭根键资源
        $packagesKey.Close()
        $regRoot.Close()
    }
    catch {
        $ErrorMessage = $_.Exception.Message
        Write-Host "Error occurred: $ErrorMessage" -ForegroundColor Red
    }
}
else {
    Write-Host "Failed to connect to $computer. Please verify the computer name/IP is correct." -ForegroundColor Red
}

关键改动说明 #

• 遍历PackageID子键：先获取Packages下的所有子键名称（即所有PackageID），再逐个遍历处理，替代原脚本的通配符尝试。
• 删除整个子键：使用DeleteSubKeyTree方法删除整个SID子键，符合你的实际需求，而不是删除子键内的某个值。
• 空值检查：在访问任何注册表键之前先做空值判断，避免出现“空值调用方法”的错误。
• 资源释放：显式关闭打开的注册表键，避免资源泄漏。
• 更清晰的输出：增加了操作过程中的状态提示和最终统计结果，方便排查。

内容的提问来源于stack exchange，提问作者ryanmaddock