This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

How to setup power-shell monitor to monitor presence of registry key

PS C:\WINDOWS\system32> Get-ItemProperty -Path "HKCU:\SOFTWARE\MICROSOFT\OFFICE\14.0\OUTLOOK\PST\"

PSPath : Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\OFFICE\14.0\OUTLOOK\PST\

PSParentPath      : Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\OFFICE\14.0\OUTLOOK

PSChildName       : PST

PSDrive           : HKCU

PSProvider        : Microsoft.PowerShell.Core\Registry

MaxLargeFileSize : 512000

WarnLargeFileSize : 486400

If the registries in yellow are not present or values changes I need to alert . The value change is less important the present of key is priority

  • This is in the "Current User" registry and that's not something that WMI can easily grab over the network (because most of the collection runs as the SYSTEM service).  You also will run into issues as the "version" portion moves forward.  Outlook version 14 is part of Office 2010.  That's pretty old, so updates will happen after that.  This isn't impossible, just difficult.  Any chance you can provide some details about why you need this?  There may be another/better way to get it.

  • Another way to do this is to have scheduled task run registry upon users login , check registry and create event ID if missing . From there you can just monitor for event