title: Powershell Query
body: <p>HKU</p>
  
  <pre><code>\\&lt;host&gt;\HKU\&lt;SID&gt;\Software\Microsoft\Windows\CurrentVersion\Run /s
  </code></pre>
  
  <p>Example: </p>
  
  <pre><code>for /f  "delims=\ tokens=2,*" %t in ('reg query HKU') do reg query HKU\%t         \Software\Microsoft\Windows\CurrentVersion\Run /s
  </code></pre>
  
  <p>HKLM</p>
  
  <pre><code>reg query \\&lt;host&gt;\HKLM\Software\Microsoft\Windows\CurrentVersion\Run /s
  </code></pre>
  
  <p>Example:</p>
  
  <pre><code>FOR /F %i in (hosts.txt) DO @echo [+] %i &amp;&amp; 
  @reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run /s 2&gt;NUL &gt; output.txt &amp;&amp; 
  FOR /F %n in (strings.txt) DO @type output.txt | findstr %n &gt; NUL &amp;&amp; 
  echo [!] %n was found on %i!
  </code></pre>
  
  <p>Here are some examples that we have came up with at the office. But trying to figure out how to add in a psexec command to allow for us to query remote computers on the network. </p>
  
  <p>So it would read the hosts from the hosts.txt file along with the strings from the strings.txt and possible add in a variable to change out the different registry keys. Then output it all into one text file.</p>
  
  <p>Do you think this is too much to try in a batch file? What about a powershell script?
  Thanks</p>