From 88b26dcfa3b8247f142f3e22baf4c269772971bf Mon Sep 17 00:00:00 2001 From: Jaap Brasser Date: Fri, 2 Aug 2019 09:42:14 +0200 Subject: [PATCH] Included HKCU --- Get-RemoteProgram/Get-RemoteProgram.ps1 | 139 ++++++++++++------------ 1 file changed, 71 insertions(+), 68 deletions(-) diff --git a/Get-RemoteProgram/Get-RemoteProgram.ps1 b/Get-RemoteProgram/Get-RemoteProgram.ps1 index 66bff35..9812968 100644 --- a/Get-RemoteProgram/Get-RemoteProgram.ps1 +++ b/Get-RemoteProgram/Get-RemoteProgram.ps1 @@ -149,87 +149,90 @@ Will retrieve the InstallDate of all components that match the regex pattern of try { $socket = New-Object Net.Sockets.TcpClient($Computer, 445) if ($socket.Connected) { - $RegBase = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine,$Computer) - $RegistryLocation | ForEach-Object { - $CurrentReg = $_ - if ($RegBase) { - $CurrentRegKey = $RegBase.OpenSubKey($CurrentReg) - if ($CurrentRegKey) { - $CurrentRegKey.GetSubKeyNames() | ForEach-Object { - $HashProperty.ComputerName = $Computer - $HashProperty.ProgramName = ($DisplayName = ($RegBase.OpenSubKey("$CurrentReg$_")).GetValue('DisplayName')) + 'LocalMachine','CurrentUser' | ForEach-Object { + $RegBase = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey([Microsoft.Win32.RegistryHive]::$_,$Computer) + $RegistryLocation | ForEach-Object { + $CurrentReg = $_ + if ($RegBase) { + $CurrentRegKey = $RegBase.OpenSubKey($CurrentReg) + if ($CurrentRegKey) { + $CurrentRegKey.GetSubKeyNames() | ForEach-Object { + $HashProperty.ComputerName = $Computer + $HashProperty.ProgramName = ($DisplayName = ($RegBase.OpenSubKey("$CurrentReg$_")).GetValue('DisplayName')) + #$HashProperty.RegPath = "$CurrentReg$_" - if ($IncludeProgram) { - if ($ProgramRegExMatch) { - $IncludeProgram | ForEach-Object { - if ($DisplayName -notmatch $_) { - $DisplayName = $null - } - } - } else { - $IncludeProgram | Where-Object { - $DisplayName -notlike ($_ -replace '\[','`[') - } | ForEach-Object { - $DisplayName = $null - } - } - } - - if ($ExcludeProgram) { - if ($ProgramRegExMatch) { - $ExcludeProgram | ForEach-Object { - if ($DisplayName -match $_) { - $DisplayName = $null - } - } - } else { - $ExcludeProgram | Where-Object { - $DisplayName -like ($_ -replace '\[','`[') - } | ForEach-Object { - $DisplayName = $null - } - } - } - - if ($DisplayName) { - if ($Property) { - foreach ($CurrentProperty in $Property) { - $HashProperty.$CurrentProperty = ($RegBase.OpenSubKey("$CurrentReg$_")).GetValue($CurrentProperty) - } - } - if ($LastAccessTime) { - $InstallPath = ($RegBase.OpenSubKey("$CurrentReg$_")).GetValue('InstallLocation') -replace '\\$','' - if ($InstallPath) { - $WmiSplat = @{ - ComputerName = $Computer - Query = $("ASSOCIATORS OF {Win32_Directory.Name='$InstallPath'} Where ResultClass = CIM_DataFile") - ErrorAction = 'SilentlyContinue' - } - $HashProperty.LastAccessTime = Get-WmiObject @WmiSplat | - Where-Object {$_.Extension -eq 'exe' -and $_.LastAccessed} | - Sort-Object -Property LastAccessed | - Select-Object -Last 1 | ForEach-Object { - $_.ConvertToDateTime($_.LastAccessed) + if ($IncludeProgram) { + if ($ProgramRegExMatch) { + $IncludeProgram | ForEach-Object { + if ($DisplayName -notmatch $_) { + $DisplayName = $null } + } } else { - $HashProperty.LastAccessTime = $null + $IncludeProgram | Where-Object { + $DisplayName -notlike ($_ -replace '\[','`[') + } | ForEach-Object { + $DisplayName = $null + } } } - if ($psversiontable.psversion.major -gt 2) { - [pscustomobject]$HashProperty - } else { - New-Object -TypeName PSCustomObject -Property $HashProperty | - Select-Object -Property $SelectProperty + if ($ExcludeProgram) { + if ($ProgramRegExMatch) { + $ExcludeProgram | ForEach-Object { + if ($DisplayName -match $_) { + $DisplayName = $null + } + } + } else { + $ExcludeProgram | Where-Object { + $DisplayName -like ($_ -replace '\[','`[') + } | ForEach-Object { + $DisplayName = $null + } + } } + + if ($DisplayName) { + if ($Property) { + foreach ($CurrentProperty in $Property) { + $HashProperty.$CurrentProperty = ($RegBase.OpenSubKey("$CurrentReg$_")).GetValue($CurrentProperty) + } + } + if ($LastAccessTime) { + $InstallPath = ($RegBase.OpenSubKey("$CurrentReg$_")).GetValue('InstallLocation') -replace '\\$','' + if ($InstallPath) { + $WmiSplat = @{ + ComputerName = $Computer + Query = $("ASSOCIATORS OF {Win32_Directory.Name='$InstallPath'} Where ResultClass = CIM_DataFile") + ErrorAction = 'SilentlyContinue' + } + $HashProperty.LastAccessTime = Get-WmiObject @WmiSplat | + Where-Object {$_.Extension -eq 'exe' -and $_.LastAccessed} | + Sort-Object -Property LastAccessed | + Select-Object -Last 1 | ForEach-Object { + $_.ConvertToDateTime($_.LastAccessed) + } + } else { + $HashProperty.LastAccessTime = $null + } + } + + if ($psversiontable.psversion.major -gt 2) { + [pscustomobject]$HashProperty + } else { + New-Object -TypeName PSCustomObject -Property $HashProperty | + Select-Object -Property $SelectProperty + } + } + $socket.Close() } - $socket.Close() + } } } - } } } catch {