Check/read registry key value on remote computer with local admin credential

0

How to check registry key value on computer which is not in domain??

I think that I must use local admin credential for this but I dont know how

I tried this:

$user = "admin"
$password = "pass" | ConvertTo-SecureString -asPlainText -Force
$computer = "computer"
$domain=$computer
        $username = $domain + "\" + $user
        $Credential = New-Object System.Management.Automation.PSCredential -ArgumentList $username,$password


$key = '\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters'
$valuename = 'DiskSpaceThreshold'

$wmi = Get-Wmiobject -list "StdRegProv" -namespace root\default -Computername $computer -Credential $Credential
$value = $wmi.GetStringValue($HKEY_Local_Machine,$key,$valuename).svalue

$wmi
$value

But the result:

Get-Wmiobject : Could not get objects from namespace root\default. Serwer RPC jest niedostępny. (Wyjątek od HRESULT: 0x800706BA) At line:12 char:8
+ $wmi = Get-Wmiobject -list "StdRegProv" -namespace root\default -Comp ...
+        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (:) [Get-WmiObject], COMException
    + FullyQualifiedErrorId : INVALID_NAMESPACE_IDENTIFIER,Microsoft.PowerShell.Commands.GetWmiObjectCommand You cannot call a method on a null-valued expression. At line:13 char:1
+ $value = $wmi.GetStringValue($HKEY_Local_Machine,$key,$valuename).sva ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 


__GENUS          : 2
__CLASS          : __PARAMETERS
__SUPERCLASS     : 
__DYNASTY        : __PARAMETERS
__RELPATH        : 
__PROPERTY_COUNT : 2
__DERIVATION     : {}
__SERVER         : 
__NAMESPACE      : 
__PATH           :  ReturnValue      : 6 uValue           :  PSComputerName   :

So I tried something else

  # file with computer name
$computers = Get-Content F:\IT\!Set_NTP_Time\ReadRegistry\servers.txt | ?{$_ -notmatch "^#"};

#Registry Hives
[long]$HIVE_HKROOT = 2147483648
[long]$HIVE_HKCU = 2147483649
[long]$HIVE_HKLM = 2147483650
[long]$HIVE_HKU = 2147483651
[long]$HIVE_HKCC = 2147483653
[long]$HIVE_HKDD = 2147483654


# registry
$HKLM = 2147483650
$main = "Localmachine"
$keyPath = "System\CurrentControlSet\Services\W32Time"
$keyName = "Start"

#$computer ='.'
$reg = [WMIClass]"ROOT\DEFAULT:StdRegProv"
$Key = "W32Time"
#$Value = "HistoryBufferSize"
#$results = $reg.GetDWORDValue($HKEY_LOCAL_MACHINE, $Key, $keyName)
#"Current History Buffer Size: {0}" -f $results.uValue


<#
Param($computer)
$HKEY_Local_Machine = 2147483650 
$reg = [WMIClass]"\\$computer\ROOT\DEFAULT:StdRegProv"
$Key = "SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\CurrentVersion\SharedDefs"
$ValueName = "DEFWATCH_10"
$results = $reg.GetStringValue($HKEY_LOCAL_MACHINE, $Key, $ValueName)
write $results.sValue
#>

# credentials
$user = "admin"
$user1 = "admin1"
$password = "pass" | ConvertTo-SecureString -asPlainText -Force

# Start processing 
    foreach($computer in $computers) {
        $domain=$computer
        $username = $domain + "\" + $user
        $username1 = $domain + "\" + $user1
        $Credential = New-Object System.Management.Automation.PSCredential -ArgumentList $username,$password
        $Credential1 = New-Object System.Management.Automation.PSCredential -ArgumentList $username1,$password

     try {  
        if (($computer -eq "comp1") -or ($computer -eq "comp2") -or ($computer -eq "name_of_computer") -or ($computer -eq "other_computer")) {
            #$wmi = Get-Wmiobject -list "StdRegProv" -namespace root\default -Computername $computer -Credential $Credential1
            #$value = $wmi.GetStringValue($HKLM,$keyPath,$keyName).svalue
            #Write-Host -ForegroundColor DarkYellow $computer $value
            #$value = Invoke-Command -Scriptblock {Get-Item $HKLM,$keyPath,$keyName} -Computername $computer -Credential $Credential1
            $reg = Get-WmiObject -List -Namespace root\default -ComputerName $Computer -Credential $Credential1 | Where-Object {$_.Name -eq "StdRegProv"}
            #$HKLM = 2147483650
            #$value = $reg.GetStringValue($HKLM,$keyPath,$keyName).sValue
            $value = $reg.GetDWORDValue($HKEY_LOCAL_MACHINE, $Key, $keyName)
            Write-Host -ForegroundColor DarkYellow $computer $reg $value 

        } else { 
        
            #$wmi = Get-Wmiobject -list "StdRegProv" -namespace root\default -Computername $computer -Credential $Credential
            #$value = $wmi.GetStringValue($HKLM,$keyPath,$keyName).svalue
            #Write-Host -ForegroundColor DarkYellow $computer $value
            #$value = Invoke-Command -Scriptblock {Get-Item $HKLM,$keyPath,$keyName} -Computername $computer -Credential $Credential
            $reg = Get-WmiObject -List -Namespace root\default -ComputerName $Computer -Credential $Credential | Where-Object {$_.Name -eq "StdRegProv"}
            #$HKLM = 2147483650
            #$value = $reg.GetStringValue($HKLM,$keyPath,$keyName).sValue 
            $value = $reg.GetDWORDValue($HKEY_LOCAL_MACHINE, $Key, $keyName)
            Write-Host -ForegroundColor DarkYellow $computer $reg $value

        }
        <#
        if($value -eq 2)
        {
        Write-Host -ForegroundColor DarkYellow $computer "YES" 
        } else {
        Write-Host -ForegroundColor Red $computer "NO"
        }
        #>
        } catch {
        Write-Host -ForegroundColor Red "$computer access denied.$_";
    }
}

Result for this script

comp1 \COMP1\ROOT\default:StdRegProv System.Management.ManagementBaseObject

comp2 \COMP2\ROOT\default:StdRegProv System.Management.ManagementBaseObject

comp3 \COMP3\ROOT\default:StdRegProv System.Management.ManagementBaseObject

powershell
powershell-4.0
powershell-remoting
powershell-5.0
powershell-v6.0
asked on Stack Overflow Jun 27, 2019 by Alen • edited Jun 20, 2020 by Community

2 Answers

0

Personally, as I am used to use powershell remoting to gather information from remote machines, I would proceed like this:

  1. Establish remote PS session
  2. Run script on remote machine
  3. Profit

So in your case, something like (If you are retrieving a value named DiskSpaceThreshold inside of HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters)

$user = "admin"
$password = "pass" | ConvertTo-SecureString -asPlainText -Force
$computer = "computer"
$domain=$computer
        $username = $domain + "\" + $user
        $Credential = New-Object System.Management.Automation.PSCredential -ArgumentList $username,$password

$session = New-PSSession $computer -Credential $Credential
$r = Invoke-Command -Session $session -ScriptBlock { Get-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters -Name "DiskSpaceThreshold" }
Remove-PSSession $session

Write-Host $r.DiskSpaceThreshold
answered on Stack Overflow Jun 27, 2019 by P-L • edited Jun 27, 2019 by P-L
0

The effect of trying to run the script from P-L user post

New-PSSession : [computer] Connecting to remote server computer failed with the following error message : WinRM cannot process the
 request. The following error with errorcode 0x80090311 occurred while using Kerberos authentication: There are currently no
 logon servers available to service the logon request.  
 Possible causes are:
  -The user name or password specified are invalid.
  -Kerberos is used when no authentication method and no user name are specified.
  -Kerberos accepts domain user names, but not local user names.
  -The Service Principal Name (SPN) for the remote computer name and port does not exist.
  -The client and remote computers are in different domains and there is no trust between the two domains.
 After checking for the above issues, try the following:
  -Check the Event Viewer for events related to authentication.
  -Change the authentication method; add the destination computer to the WinRM TrustedHosts configuration setting or use HTT
PS transport.
 Note that computers in the TrustedHosts list might not be authenticated.
   -For more information about WinRM configuration, run the following command: winrm help config. For more information, see 
the about_Remote_Troubleshooting Help topic.
At line:9 char:12
+ $session = New-PSSession $computer -Credential $Credential
+            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [New-PSSession], PSRemotingTran 
   sportException
    + FullyQualifiedErrorId : AuthenticationFailed,PSSessionOpenFailed
Invoke-Command : Cannot validate argument on parameter 'Session'. The argument is null or empty. Provide an argument that is
 not null or empty, and then try the command again.
At line:10 char:30
+ $r = Invoke-Command -Session $session -ScriptBlock { Get-ItemProperty -Path HKLM ...
+                              ~~~~~~~~
    + CategoryInfo          : InvalidData: (:) [Invoke-Command], ParameterBindingValidationException
    + FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.PowerShell.Commands.InvokeCommandCommand

Remove-PSSession : Cannot validate argument on parameter 'Id'. The argument is null. Provide a valid value for the argument,
 and then try running the command again.
At line:11 char:18
+ Remove-PSSession $session
+                  ~~~~~~~~
    + CategoryInfo          : InvalidData: (:) [Remove-PSSession], ParameterBindingValidationException
    + FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.PowerShell.Commands.RemovePSSessionCommand

The username and password are good.

answered on Stack Overflow Jun 28, 2019 by Alen

User contributions licensed under CC BY-SA 3.0