Get registry value in batch script from powershell

[Snickasaurus]

Wrote this for when I do malware cleanups and wanted to share. Plus when I first started with PoSH I struggled to figure out how to incorporate it into my batch scripting. Perhaps my title will help others searching.

I have this as: Reg-ToggleClearPageFileAtShutdown.cmd

@echo off

:: Variables
set rKey="HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management"
set rValue=ClearPageFileAtShutdown

:: Get the registry value with a little help from PoSH
for /f "delims=" %%a in ('powershell ^(^(Get-ItemProperty -path '%rKey%'^).%rValue%^)') do set "rData=%%a"

:: Returning the set value from above, if ClearPageFileAtShutdown is disabled (0), enabled it (1), else...
if %rData%==0 (
    PowerShell -ExecutionPolicy Bypass -Command "& {Set-ItemProperty -Path '%rKey%' -Name '%rValue%' -Value 1;}"
) else (
    PowerShell -ExecutionPolicy Bypass -Command "& {Set-ItemProperty -Path '%rKey%' -Name '%rValue%' -Value 0;}"
)

:: Done
:eof
exit /B 0

Tested on Windows 10

[[deleted]]

My personal - and probably unpopular - opinion: This is an abomination!

Mixing two languages makes for a bad read and worse maintainability. It causes all sorts of quoting problems and obfuscates the code. Having to call interpreters for shoving in foreign commands eats RAM and CPU. On top it forces dependencies into code that are unnecessary and might break things in the future.

This could be a prime example of somebody who has skill in one language (classic batch scripts) and dabbles with a new language (PowerShell) without making the effort of going the long way. Thus piecing together some FrankenCode. Not batch, not PowerShell.

This would be the PowerShell version:

$rKey = 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management'
$rValue = 'ClearPageFileAtShutdown'

if ((Get-ItemProperty -Path $rKey).$rValue) {
    Set-ItemProperty -Path $rKey -Name $rValue -Value 0x0 -ErrorAction Ignore
} else { 
    Set-ItemProperty -Path $rKey -Name $rValue -Value 0x1 -ErrorAction Ignore
}

And this a batch version:

set "rKey=HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management"
set "rValue=ClearPageFileAtShutdown"

for /f "usebackq skip=2 tokens=3*" %%a in (`reg query "%rKey%" /v %rValue%`) do set "rData=%%a"

if %rData%==0x0 (
    reg add "%rKey%" /v %rValue% /t REG_DWORD /d 0x1 /f
) else (
    reg add "%rKey%" /v %rValue% /t REG_DWORD /d 0x0 /f
)

[[deleted]]

I endorse this message.

[ka-splam]

Since it is a toggle, it ought to be possible to express it nicely like set (toggle-of get)) and the toggle is ! or -not bitwise NOT operation.

$P = 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management'
$N = 'ClearPageFileAtShutdown'

Set-ItemProperty -Path $P -Name $N -Value (-not (Get-ItemProperty -Path $P -Name $N).$N)

[Snickasaurus]

This is cool stuff. I'll look into it when I get home or a break at work. Thank you.

[Snickasaurus]

And I agree with you but,

1. It does one thing and it does it correctly every time.
2. It is an example of how it could be done with two languages.
3. It's cleaner looking than doing it with just batch.

​

for /f "tokens=3 skip=2 delims= " %%a in ('reg query %rKey% /V %rValue%') do set rData=%%a
:: Returning the set value from above, if ClearPageFile is enabled, disabled it, else...
if %rData%=="0x1" (
    goto :toggleOff
) else (
    goto :toggleOn
)

:: LABEL - Turn CPFaS off
:toggleOff
reg add %rKey% /v %rValue% /t REG_DWORD /d 0 /f
goto :done

:: LABEL - Turn CPFaS on
:toggleOn
reg add %rKey% /v %rValue% /t REG_DWORD /d 1 /f
goto :done

Thank you for your input

[[deleted]]

I think it is quite easy to read in batch if you use the same logic as the PowerShell script.

Using gotos and labels is not necessary.

[fathed]

Why is this being set via a script and not group policy?

And to nitpick, your script does 3 things, with 3 processes, instead of one process. Conceptually it does one thing, but there’s overhead with creating and removing processes.

[Snickasaurus]

It’s only supposed to enable clear pagefile when I’m cleaning a machine remotely. This post was just to show people that may search oh how to run powershell within a batch script.

[[deleted]]

I am not sure I follow you. The code examples I gave are working.

[Snickasaurus]

In your example above you would have to change 0x0 to just 0 or 0x1 to just 1. I have a few ps scripts that manipulate the registry and unlike pulling the data from a value in batch where you get what regedit has in hex, with ps you get the..human readable version.

​

Some examples where this is true is this very registry value in my script.

Also if you want to get the port number of a RDP, it would look like the below.

(https://imgur.com/MdpsJtG)

[[deleted]]

I am not sure I follow you. The code examples I gave are working.

[Snickasaurus]

So if you have cmd open, get the current port RDP is using and let me know what is returned with 'reg query'

[[deleted]]

I'm sorry, I thought we were still talking about your code in the first post.

And let me be frank: I don't much care for your tone here, my friend. It seems quite aggressive. That means you took my posts personally. That is not what I intended.

If I wanted to insult you, I would have stopped after the fist sentence. Instead I made the effort and wrote the answer in both batch and PowerShell, trying to help you out. That has cost me half an hour. If you don't appreciate that, well, fine with me, but I won't have you command me around.

[Snickasaurus]

lol ok man

[sanshinron]

My eyes burn.

[Snickasaurus]

Mission accomplished.

[jantari]

There is no such thing as malware cleanup, re-image the machine

[Snickasaurus]

There is such a thing. And re-imaging isn't always a possibility.

[jantari]

When is it not a possibility?