'PowerShell, unable rename registry on the remote computer
How can I rename Registry SubKey instead of deleting it on the remote device?
$remoteHive = [Microsoft.Win32.RegistryHive]“LocalMachine”;
$regKey = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey($remoteHive,$computerName);
$profileList = $regKey.OpenSubKey(“SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\”,$true);
$remoteProfiles = $profileList.GetSubKeyNames()
ForEach ($remoteProfile in $remoteProfiles) {
If ($remoteProfile -eq $strSID)
{
$profileList.DeleteSubKey($strSID)
}
}
I would like to replace $profileList.DeleteSubKey($strSID) with rename but can't find how.
Solution 1:[1]
This is too long for a comment, so I'll post it as answer instead. The reason why
$strSID = "S-1-5-21"
Invoke-Command -ComputerName $computerName -Scriptblock {
Rename-Item "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\$strSID" -NewName "S-1-5-21_BAK" -Force
} -ErrorAction Stop
doesn't work is because inside the scriptblock, variable $strSID is unknown.
You need to either scope it in the scriptblock with $using:strSID, or send it as parameter to the scriptblock like:
$strSID = "S-1-5-21"
Invoke-Command -ComputerName $computerName -Scriptblock {
param([string]$SID)
Rename-Item "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\$SID" -NewName "$($SID)_BAK" -Force
} -ArgumentList $strSID -ErrorAction Stop
Renaming registry keys could be dangerous of course and you should be aware of the Well-known SIDs, making sure you don't try to rename these too..
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|---|
| Solution 1 | Theo |
