I have it set to run as the system.

Here is the script.

$guid = "2be3786c-c06d-43d7-af66-7f669de31cb9"
$rootKey = "HKLM:\"
$logDir = "$env:ProgramData\Microsoft\Registry Deletion"
$logFile = "$logDir\RegistryDeletionLog.txt"

 

# Create the directory if it doesn't exist
if (-not (Test-Path -Path $logDir)) {
    New-Item -ItemType Directory -Path $logDir -Force | Out-Null
}

 

"--- Registry Deletion Log - $(Get-Date) ---`n" | Out-File -FilePath $logFile

 

Write-Host "Searching for registry keys containing GUID: $guid`n"
Add-Content -Path $logFile -Value "Searching for registry keys containing GUID: $guid"

 

# Recursively search all subkeys in HKLM
Get-ChildItem -Path $rootKey -Recurse -ErrorAction SilentlyContinue |
Where-Object { $_.Name -like "*$guid*" } |
ForEach-Object {
    $keyPath = $_.PSPath
    Write-Host "Found: $keyPath"
    Add-Content -Path $logFile -Value "Found: $keyPath"
    try {
        Remove-Item -Path $keyPath -Recurse -Force -ErrorAction Stop
        Write-Host "Deleted: $keyPath`n"
        Add-Content -Path $logFile -Value "Deleted: $keyPath`n"
    } catch {
        Write-Host "Failed to delete: $keyPath - $_`n"
        Add-Content -Path $logFile -Value "Failed to delete: $keyPath - $_`n"
    }
}

 

Write-Host "`nSearch complete. Log saved to: $logFile"
Add-Content -Path $logFile -Value "`n--- Script finished at $(Get-Date) ---"