• Powershell Microsoft.win32.registrykey Openremotebasekey Credentials

I'm trying to write an application that will get some registry values from a remote computer. The user can provide a hostname or IP in a string and should be getting a registry value displayed on their screen. When I was debugging the program, it turned out that it gives an error whenever the input I provide is either 'localhost' or '127.0.0.1', but it works when I provide 'mxcz', which is my computer name.

If you try starting PowerShell with alernate credentials perhaps using.

The application uses the OpenRemoteRegistryKey method in Microsoft.Win32.RegistryKey. I decided to isolate this line and just run it in PowerShell. You can see what happens in the picture below. These two PowerShell lines work:

These don't work:

Using my actual LAN IP address 192.168.0.136 instead of 127.0.0.1 gives the exact same behavior. It works without the quotes and doesn't work in quotes.

It's clear to me, I think, why the second line works and why the fourth line doesn't. But I can't figure out why the first line works and why the third and the fifth don't. The Microsoft webpage for the OpenRemoteRegistryKey method clearly says that the second argument is supposed to be a string. Why doesn't 'localhost' in quotes work then? Why does 127.0.0.1 without quotes work? I don't understand how the method interprets this value. Why doesn't '127.0.0.1' in quotes work?

And most importantly, how can I pass whatever the method needs to it, when the user input is a string, either 'hostname' or 'ipaddress' (preferably using the same variable regardless of which one the user decides to use)? Simply feeding it a string with the value '127.0.0.1' clearly doesn't work. Or should I use a different way of accessing a remote registry altogether?

This is on Windows 8.1, x64.

EDIT

In C# neither the quoted nor the unquoted version works. With the quotes, it will give the same error, 'network path not found', and without them it won't compile, see below.

3 Answers

I think your issue is the error is misleading. One of the prerequisites of this working is that the remote registry service needs to be running.

In order for a key to be opened remotely, both the server and client machines must be running the remote registry service, and have remote administration enabled.

I would suggest on your own machine and target machines that you verify that service is running. I was able to replicate the issue by toggling the service off and on. When the method assumes localhost it works by accessing locally it seems. When it is explicitly stated it appears to attempt to use the service.

Also you have to quote those string. Else PowerShell will attempt to evaluate the text as an exe/function/cmdlet etc. Just type in localhost or 127.0.0.1 and you will get errors from the parser. In the case of the latter:

This is the same error I get for one of your working examples... which unfortunately doesnt seem to help

The problem is that powershell is handling the 127.0.0.1 without quotes weirdly. If you crack open powershell and type 127.0.0.1 by itself, it will return with no output and no error. If you try to do something like '> 127.0.0.1 gm' it will throw an exception.

I noticed then that doing anything with more than two periods is treated differently. Try typing '127.0' at the prompt and then '127.0.0' at the prompt. Different behavior.

Finally - try this:

So - I think, long story short is PowerShell is doing weird stuff to that IP address without you having to quote it. Would love some additional info on this from someone who might have dived deeper than I.

PowerShell

I believe this may be due to PowerShell's way of doing Type Inference in earlier versions as i'm not seeing the same results using PowerShell 5 on Windows 10.

PowerShell has it's own unique way of finding out which type you need to use certain .Net methods:

For example:

and

are the same, the only difference is that PowerShell translates 'LocalMachine' to [Microsoft.Win32.RegistryHive]::LocalMachine at Runtime because OpenRemoteBaseKey requires the first parameter to be of type Microsoft.Win32.RegistryHive.

Here are some things you can try though:

(1) Let PowerShell evalute a variable first and then pass the variable to OpenRemoteBaseKey, PowerShell will evaulate the variable rather than a string:

(2) Use literal quotes to tell PowerShell you want to pass 127.0.0.1 literally:

C#

The reason it doesn't work in C# is because unlike Powershell 127.0.0.1 without quotes is not valid syntax for anything (As mentioned in the error message).

If you put the IP Address in quotes you will be telling C# which computers LocalMachine you'd like to connect to:

Hope this helps, please let us know if you make any progress :)

Not the answer you're looking for? Browse other questions tagged .netwindowspowershellregistry or ask your own question.

Definition

Opens a new T:Microsoft.Win32.RegistryKey that represents the requested key on a remote machine, with the option of specified registry view.

Overloads

OpenRemoteBaseKey(RegistryHive, String)OpenRemoteBaseKey(RegistryHive, String)OpenRemoteBaseKey(RegistryHive, String)OpenRemoteBaseKey(RegistryHive, String)

Opens a new RegistryKey that represents the requested key on a remote machine.

Parameters

hKey

RegistryHiveRegistryHiveRegistryHiveRegistryHive

The HKEY to open, from the RegistryHive enumeration.

machineName

StringStringStringString

The remote machine.

Returns

The requested registry key.

Exceptions

hKey is invalid.

machineName is not found.

machineName is null.

The user does not have the proper permissions to perform this operation.

The user does not have the necessary registry rights.

Examples

The following code example shows how to open a registry key on a remote computer and enumerate the values of the key. The remote computer must be running the remote registry service. Specify the name of the remote computer as a command-line argument when invoking the program.

Remarks

The local machine registry is opened if machineName is String.Empty. The requested key must be a root key on the remote machine, and is identified by the appropriate RegistryHive value.

In order for a key to be opened remotely, both the server and client machines must be running the remote registry service, and have remote administration enabled.

Security

SecurityPermission
for the ability to access the specified registry key if it is a remote key. Associated enumeration: UnmanagedCode

OpenRemoteBaseKey(RegistryHive, String, RegistryView)OpenRemoteBaseKey(RegistryHive, String, RegistryView)OpenRemoteBaseKey(RegistryHive, String, RegistryView)OpenRemoteBaseKey(RegistryHive, String, RegistryView)

Opens a new registry key that represents the requested key on a remote machine with the specified view.

Powershell Microsoft.win32.registrykey Openremotebasekey Credentials

Parameters

hKey

RegistryHiveRegistryHiveRegistryHiveRegistryHive

The HKEY to open from the RegistryHive enumeration.

machineName

StringStringStringString

The remote machine.

view

RegistryViewRegistryViewRegistryViewRegistryView

The registry view to use.

Returns

The requested registry key.

Exceptions

hKey or view is invalid.

machineName is not found.

machineName is null.

The user does not have the necessary registry rights.

The user does not have the required permissions to perform this operation.

Remarks

The local machine registry is opened if machineName is String.Empty. The requested key must be a root key on the remote machine, and is identified by the appropriate RegistryHive value.

In order for a key to be opened remotely, both the server and client machines must be running the remote registry service, and have remote administration enabled.

On the 64-bit versions of Windows, portions of the registry are stored separately for 32-bit and 64-bit applications. There is a 32-bit view for 32-bit applications and a 64-bit view for 64-bit applications. If view is Registry64 but the remote machine is running a 32-bit operating system, the returned key will use the Registry32 view.

Applies to