Home Datacenter Using PowerShell to compare a registry key before and after a change

Using PowerShell to compare a registry key before and after a change

by Philip Sellers

So, while deploying IE 11, it became evident that something was happening in the IE settings that affected the display of certain webpages.  If we ran an IE Reset in the browser and set all the default settings, the sites would work fine, but after a while a policy or some change was occurring to break websites.  It isn’t easy to find the exact setting that is changing, so I thought, PowerShell’s Compare-Object would be great.

In PowerShell, its easy to get a data object that contains all the properties in a particular registry key. To return the IE settings, it is under HKEY_CURRENT_USER in Software\Microsoft\Internet Explorer.  The PowerShell to get this data is:

[code]

Get-Item ‘HKCU:\Software\Microsoft\Internet Explorer\Main’

[/code]

From prior work, I knew I should be able to store this in a variable before and after a change and then compare the two objects.  But every time I ran the Compare-Object on the two variables, there were no differences.  I even manually changed data in one of the registry properties and got no differences.

What I found is that even though the registry key is stored in a variable, it actually pulls the live data – not a point in time snapshot of the data, as expected.

Instead, I came across an article from Guy Thomas that talked about Compare-Object and the registry and it suggests exporting the registry values to a .reg file before and after the change and then using Compare-Object.  This works like a champ.  Its a simple comparison of two text documents and makes quick work of what I was trying to accomplish.

The first step is to go into registry editor and use the File > Export command to create the before.reg file.  Make sure you export only the select branch of the registry.

[code]

Compare-Object $(Get-Content before.reg) $(Get-Content after.reg)

[/code]

For screenshots and more details, see the post from Guy Thomas.

You may also like