Hi, I'm very new to PShell and to be honest am more at home with my beloved VBscript, however I need to adjust some ACLs on registry keys so am using PowerShell. So I put together the following basic script to read a txt file with a list of keys:
Txt file contents:
HKLM:\SOFTWARE
HKLM:\SOFTWARE\1
HKLM:\SOFTWARE\2
HKLM:\SOFTWARE\3
PS1 file:
function Testregpath {
Param
(
[Parameter(Mandatory=$true)]
[string]$Pathkey
)
Clear-Variable msg
if ((Test-Path "$PathKey") -eq "True")
{
$msg = 'Found Reg Key:' + $PathKey
Write-Host $msg
$msg | out-file -filepath $logfilepath -Append
Return "True"
}
Else
{
$msg = "Missing Reg Key:" + $PathKey
Write-Host $msg
$msg | out-file -filepath $logfilepath -Append
Return "False"
}
}
function TestAuditAcl{
Param
(
[Parameter(Mandatory=$true)]
[string]$key, $Access, $ResultType
)
#Logging
Get-Acl $key -Audit | Format-List Path,AuditToString | Out-File $logfilepath -Width 200 -Append
#Compare output once I've worked out how to get Pshell to parse it!
$acls = Get-Acl $key -Audit | Format-List AuditToString
Write-Host $acls
}
##################
## Script Body##
##################
$logfilepath = "g:\HKLM_AUDIT_KEYS.log"
$msg = "Running local Machine Registry key Script $(Get-Date -format 'u')"
Write-Host $msg
$msg | out-file -filepath $logfilepath -Append
$Keys_Array = (Get-Content $PSScriptRoot\hklm_keys.txt)
foreach ( $Keys in $Keys_Array)
{
if ((Testregpath $Keys) -eq "True" -and (TestAuditAcl $Keys "CreateSubkey” "Success,Failure”)-eq "False")
{
#set auditing on key
Try{
#AddAuditToRegKey “HKLM:\SOFTWARE\1” "CreateSubkey” "Success,Failure”
}
Catch{
$msg = "Could not set auditing on key: $Keys"
Write-Host $msg
$msg | out-file -filepath $logfilepath -Append
}
}
}
There are two problems:
1) Even though the keys exist, the script can't find them. It only finds the first key in the list:
Running local Machine Registry key Script 2015-09-01 19:58:47Z
Found Reg Key:HKLM:\SOFTWARE
Missing Reg Key:HKLM:\SOFTWARE\1
Missing Reg Key:HKLM:\SOFTWARE\2
Missing Reg Key:HKLM:\SOFTWARE\3
2) When outputting the contents of my variable using the code:
$acls = Get-Acl $key -Audit | Format-List AuditToString
Write-Host $acls
I get two different result?!
The file output writes as expected:
Path : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE
AuditToString :
Yet the Write-host output gives me (i don't know what):
Microsoft.PowerShell.Commands.Internal.Format.FormatStartData Microsoft.PowerShell.Commands.Internal.Format.GroupStartData Microsoft.PowerShell.Commands.Internal.Format.FormatEntryData Microsoft.PowerShell.Commands.Internal.Format.GroupEndData Microsoft.PowerShell.Commands.Internal.Format.FormatEndData
Am I missing something obvious here?
Thanks for any help / pity :)