Allow CMPivot to query HKU keys with Registry()
Currently, CMPivot uses Get-Item in PowerShell to gather Registry() information. By default, only HKLM and HKCU exist as a PSdrive. CMPivot could work around this by creating a HKU on the fly during a query.
New-PSDrive -Name HKU -PSProvider Registry -Root HKEY_USERS
This would allow greater capabilities in querying the registry and searching for profile/user based registry keys.
Futher explanation here: https://twitter.com/PotentEngineer/status/1327354096932827138?s=20
49
votes
Daniel Ratliff
shared this idea
1 comment
-
Claudio Mendes
commented
humm this seems like the reason my query isn't working:
Registry('hkcu:\\Software\\Microsoft\\Internet Explorer\\Main\\EnterpriseMode') | where (Property == 'CurrentVersion') | summarize dcount( Device ) by Value