using REG ADD in PowerShell to add registry key with double quotes

Question

I am trying to add registry keys to Windows 10 using a PowerShell script. The key in the registry must have double quotes included in the data field so I understand I must escape the double quote with a backslash.

The following example command throws a syntax error when executed in Powershell but works perfectly in a Command prompt window:

REG ADD \\COMPUTER1\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dcpm-notify /v ImagePath /t REG_EXPAND_SZ /d "\"C:\Program Files\Dell\CommandPowerManager\NotifyService.exe\"" /f

I have tried changing the escape characters to ` and using """ etc but I cannot get any combination to work in a PowerShell.

Any suggestions greatly appreciated.

Answer 1

You can use [Microsoft.Win32.RegistryKey] to add the key.

For example:

$RemoteReg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine',$TargetComp)
$NewKey = $RemoteReg.OpenSubKey("SYSTEM\CurrentControlSet\Services\")
$NewKey.CreateSubKey('dcpm-notify`)
$NewValue = $RemoteReg.OpenSubKey("SYSTEM\CurrentControlSet\Services\dcpm-notify")
$NewValue.SetValue('ImagePath', 'C:\Program Files\Dell\CommandPowerManager\NotifyService.exe')

Where $TargetComp is a computer you want to edit the registry for.

Please note that I have not tested the exact code, but I have used something very similar to this in the past and works without any issues. So run this on a test system first if anything.

Answer 2

Since you're using PowerShell, I'd suggest using the New-Item and New-ItemProperty cmdlets instead of Reg.exe, as they will let you include the escaped quotes.

E.G:

$registryPath = "HKLM:\SYSTEM\CurrentControlSet\Services\dcpm-notify"
$name = "ImagePath"
$value = "`"C:\Program Files\Dell\CommandPowerManager\NotifyService.exe`""

# If registry path doesn't exist, create it.
If (-NOT (Test-Path $registryPath)) {
    New-Item $registryPath | Out-Null
}

New-ItemProperty -Path $registryPath `
    -Name $name `
    -Value $value `
    -PropertyType ExpandString `
    -Force | Out-Null

Note: This example is targeted at the local machine. To run it against remote computer(s), look into using the Invoke-Command PowerShell cmdlet to invoke the above commands on the remote computer(s).

Answer 3

The easiest answer would be to use single quotes around the text so double quotes become text by itself.

Your command would become:

REG ADD \\COMPUTER1\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dcpm-notify /v ImagePath /t REG_EXPAND_SZ /d '"C:\Program Files\Dell\CommandPowerManager\NotifyService.exe"' /f

To explain it further:

Powershell knows two ways to work with text.

$test = "This is a test"
$test2 = 'This is also a test'

Because the above works, it allows you to do this:

$test3 = 'This is "double quoted" text'
$test4 = "This is 'single quoted' text"

And if you need to have a string which has both, you can accomplish it as follows:

$test5 = 'This is "double quoted" and ' + "'single quoted' text in one"

Answer 4

[Tested] For anyone that still wants to use reg add in powershell, just add ` after the backslash. The reg commands requires \" when you need to add double quotes in the value of an entry and powershell escapes double quotes by using `

When you run in powershell:

REG ADD \COMPUTER1\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dcpm-notify /v ImagePath /t REG_EXPAND_SZ /d "\`"C:\Program Files\Dell\CommandPowerManager\NotifyService.exe\`"" /f

The command will be rendered as the original.

Answer 5

The following is an example of modify registry on localhost

• double quotes in value is acceptable
• space in value is acceptable
• add double quotes in registry is required to avoid misconfiguration. Refer to CVE-2013-1609, CVE-2014-0759, CVE-2014-5455

# ===== Config Variable =====
$regHive="LocalMachine"     # HKEY_LOCAL_MACHINE, https://learn.microsoft.com/zh-tw/dotnet/api/microsoft.win32.registryhive?view=net-8.0
$regView="Default"     # https://learn.microsoft.com/zh-tw/dotnet/api/microsoft.win32.registryview?view=net-8.0
$regPath="SYSTEM\CurrentControlSet\Services\dcpm-notify"
$name="ImagePath"
$type="ExpandString"     # REG_EXPAND_SZ, refer https://learn.microsoft.com/en-us/dotnet/api/microsoft.win32.registryvaluekind?view=net-8.0
$value=="`"C:\Program Files\Dell\CommandPowerManager\NotifyService.exe`""     # Double Quote in Registry to avoid CVE-2013-1609, CVE-2014-0759, CVE-2014-5455

# ===== Get the RegistryKey =====
$BaseKey = [Microsoft.Win32.RegistryKey]::OpenBaseKey($regHive, $regView)
$TargetKey = $BaseKey.OpenSubKey("$regPath", "true")
# Another way to get the RegistryKey
## $TargetKey = [Microsoft.Win32.Registry]::$regHive.OpenSubKey($regPath, "true")

# ===== Read and config RegistryKey =====
$TargetKey.GetValueNames()
$TargetKey.GetValue('ImagePath')
$TargetKey.GetValueKind('ImagePath')
$TargetKey.SetValue("ImagePath", $value2, $type)