从离线注册表文件读取值

Question

我正在尝试读取脱机注册表文件：

$product_name = Get-ItemProperty -Path "C:\temp\RegistryHives\SOFTWARE\Microsoft\Windows NT\CurrentVersion" -name ProductName | Select-Object -ExpandProperty ProductName

出现以下错误。访问脱机注册表文件键和值的正确方法是什么？

Get-ItemProperty : Cannot find path 'C:\temp\RegistryHives\SOFTWARE\Microsoft\Windows NT\CurrentVersion' because it
does not exist.
At line:1 char:17
+ ... duct_name = Get-ItemProperty -Path "C:\temp\RegistryHives\SOFTWARE\Mi ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (C:\temp\Registr...\CurrentVersion:String) [Get-ItemProperty], ItemNotFo
   undException
    + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetItemPropertyCommand

Answer 1

您需要在访问之前加载注册表配置单元。reg.exe可以使用load命令加载配置单元`

Reg.exe load 'HKLM\TempHive' C:\temp\RegistryHives\SOFTWARE
$product_name = Get-ItemProperty -Path "HKLM:\TempHive\Microsoft\Windows NT\CurrentVersion" -name ProductName | Select-Object -ExpandProperty ProductName
Reg.exe unload 'HKLM\TempHive'