Merge pull request #36 from EvotecIT/ImproveRegistryCommands

Improve registry commands

Build/Manage-PSSharedGoods.ps1

@@ -38,7 +38,7 @@ $Configuration = @{
             Sort           = 'None'
             FormatCodePSM1 = @{
                 Enabled           = $true
-                RemoveComments    = $true
+                RemoveComments    = $false
                 FormatterSettings = @{
                     IncludeRules = @(
                         'PSPlaceOpenBrace',
@@ -123,6 +123,9 @@ $Configuration = @{
             Path       = 'Docs'
             PathReadme = 'Docs\Readme.md'
         }
+        Signing           = @{
+            CertificateThumbprint = '36A8A2D0E227D81A2D3B60DCE0CFCF23BEFC343B'
+        }
     }
     Steps       = @{
         BuildModule        = @{  # requires Enable to be on to process all of that

CHANGELOG.MD

@@ -1,4 +1,10 @@
-#### 0.0.259 - 2023.03.08
+#### 0.0.260 - 2023.04.18
+- Adds support for `HKUDUO` and `HKUDUDO` for `Get-PSRegistry`, `Set-PSRegistry`, `Remove-PSRegistry`, `New-PSRegistry` and `Test-PSRegistry`
+  - `HKUDUO` - All users in HKEY_USERS that are non SPECIAL accounts excluding .DEFAULT / .DEFAULT_USER (auto mapped from NTUSER.DAT). But also including non-loaded users (not logged in) (auto mapped from NTUSER.DAT)
+  - `HKUDUDO` - All users in HKEY_USERS that are non SPECIAL accounts including .DEFAULT_USER (auto mapped from NTUSER.DAT). But also including non-loaded users (not logged in) (auto mapped from NTUSER.DAT)
+  - Improve `Get-WinADForestDetails` by adding switch `PreferWritable` which would use writable DCs for quering
+
+#### 0.0.259 - 2023.03.08
 - Improve `Get-ComputerSMBSharePermissions` with `Translated` switch
 - Improve `Get-ComputerSMBShare` with `Translated` switch
 

Examples/RegistryGet.ps1

@@ -10,13 +10,9 @@ Get-PSRegistry -RegistryPath "HKUDUD\Tests" -ComputerName AD1, EVOPOWER | Format
 Get-PSRegistry -RegistryPath "HKEY_ALL_DOMAIN_USERS\Tests" -ComputerName AD1 | Format-Table
 Get-PSRegistry -RegistryPath "HKUDU\Test" -Key "Ok" -ComputerName AD1, 'EVOPOWER' | Format-Table
 Get-PSRegistry -RegistryPath "HKUDU\Test" -Key "Ok" -ComputerName AD1, 'EVOPOWER' | Format-Table
-
 Get-PSRegistry -RegistryPath "HKEY_LOCAL_MACHINE\SOFTWARE\Ok\MaybeNot\More" | Format-Table
-
 Get-PSRegistry -RegistryPath "HKEY_USER S\S-1-5-18\Test", 'HKEY_USERS\S-1-5-19\Test' -Key "Ok" -ComputerName AD1, 'EVOPOWER' | Format-Table
-
 Get-PSRegistry -RegistryPath "HKEY_CLASSES_ROOT" -Key 'test' | Format-Table
-
 Get-PSRegistry -RegistryPath "HKEY_USERS" | Format-Table
 
 $Output = Get-PSRegistry -RegistryPath "HKEY_LOCAL_MACHINE\SOFTWARE"

Examples/RegistryGetDefault.ps1

@@ -2,20 +2,50 @@
 
 Import-Module $PSScriptRoot\..\PSsharedGoods.psd1 -Force
 
-Get-PSRegistry -RegistryPath "HKEY_USERS" | Format-Table
-Get-PSRegistry -RegistryPath "HKUDU:\Tests" | Format-Table
-Get-PSRegistry -RegistryPath "HKUDUD:\Tests" | Format-Table
-Get-PSRegistry -RegistryPath "HKUD:\Test1" | Format-Table
-Get-PSRegistry -RegistryPath "HKEY_DEFAULT_USER\Test1" | Format-Table
-
-for ($i = 0; $i -lt 20; $i++) {
-    New-PSRegistry -RegistryPath "HKUD:\Test$i"
-    Remove-PSRegistry -RegistryPath "HKUD:\Test$i"
+$Registry = Get-PSRegistry -Path "HKEY_CURRENT_USER\Printers\ConvertUserDevModesCount"
+$FoundKeys = foreach ($R in $Registry.PSObject.Properties.Name) {
+    if ($R -like "*EVO*") {
+        $R
+    }
 }
+foreach ($Key in $FoundKeys) {
+    Remove-PSRegistry -RegistryPath "HKEY_CURRENT_USER\Printers\ConvertUserDevModesCount" -Key $Key
+}
+
+#Get-PSRegistry -RegistryPath "HKLM\SOFTWARE\Microsoft\Windows NT"
+
+#Get-PSRegistry -RegistryPath "HKEY_USERS" | Format-Table
+#Get-PSRegistry -RegistryPath "HKUDUO:\Environment" -Key "OneDrive" -Verbose | Format-Table
+#Get-PSRegistry -RegistryPath "HKUDUDO:\Environment" -Key "OneDrive" -Verbose | Format-Table
+#Get-PSRegistry -RegistryPath "HKUDUDO\Environment" -Key "OneDrive" -Verbose | Format-Table
+#Get-PSRegistry -RegistryPath "HKEY_ALL_DOMAIN_USERS_OTHER_DEFAULT:\Environment" -Key "OneDrive" -Verbose | Format-Table
+#Get-PSRegistry -RegistryPath "HKEY_ALL_DOMAIN_USERS_OTHER_DEFAULT\Environment" -Key "TEMP" -Verbose | Format-Table
+#Get-PSRegistry -RegistryPath "HKUDUDO:\Software\\Policies1\\Microsoft\\Windows\\CloudContent" -Key "DisableTailoredExperiencesWithDiagnosticData" -Verbose | Format-Table
+#Set-PSRegistry -Verbose -RegistryPath "HKUDUDO:\Software\\Policies1\\Microsoft\\Windows\\CloudContent" -Key 'DisableTailoredExperiencesWithDiagnosticData' -Type dword -Value 1 | Format-Table
+#Set-PSRegistry -RegistryPath 'Users\Offline_test.1\Software\Policies1\Microsoft\Windows\CloudContent' -Key 'DisableTailoredExperiencesWithDiagnosticData' -Type dword -Value 1 | Format-Table
+
+#Get-PSRegistry -Verbose -RegistryPath "Users\Offline_test.1\Software\Policies1\Microsoft\Windows\CloudContent" -Key 'DisableTailoredExperiencesWithDiagnosticData' | Format-Table
+#Set-PSRegistry -Verbose -RegistryPath 'HKU:\Offline_Przemek\Software\Policies1\Microsoft\Windows\CloudContent' -Key 'DisableTailoredExperiencesWithDiagnosticData' -Type dword -Value 1 | Format-Table
+#Set-PSRegistry -Verbose -RegistryPath 'HKEY_USERS:\Offline_Przemek\Software\Policies1\Microsoft\Windows\CloudContent' -Key 'DisableTailoredExperiencesWithDiagnosticData' -Type dword -Value 1 | Format-Table
+#Set-PSRegistry -RegistryPath 'Users\.DEFAULT_USER\Software\Policies1\Microsoft\Windows\CloudContent' -Key 'DisableTailoredExperiencesWithDiagnosticData' -Type dword -Value 1 | Format-Table
+#Get-PSRegistry -RegistryPath "HKUDUD:\Environment" | Format-Table
+#Get-PSRegistry -RegistryPath "HKUD:\Test1" | Format-Table
+#Get-PSRegistry -RegistryPath "HKEY_DEFAULT_USER\Test1" | Format-Table
+
+#Get-PSRegistry -RegistryPath "HKEY_USERS\S-1-5-21-853615985-2870445339-3163598659-1105\Control Panel\Mouse" | Format-Table
+#Get-PSRegistry -RegistryPath "HKUDUO:\Control Panel\Mouse" -Verbose | Format-Table
+#Get-PSRegistry -RegistryPath "HKEY_DEFAULT_USER\Test1" -Key '' | Format-Table
+
+# for ($i = 0; $i -lt 20; $i++) {
+#     New-PSRegistry -RegistryPath "HKUD:\Test$i"
+#     Remove-PSRegistry -RegistryPath "HKUD:\Test$i"
+# }
+
+# Set-PSRegistry -RegistryPath "HKUD:\Test1" -Type REG_DWORD -Key "TestMe" -Value 5
 
-Set-PSRegistry -RegistryPath "HKUD:\Test1" -Type REG_DWORD -Key "TestMe" -Value 5
+# Get-PSRegistry -RegistryPath "HKUDUD:\Software\\Policies\\Microsoft\\Windows\\CloudContent" #-Key 'ConfigureWindowsSpotlight'
+# Set-PSRegistry -RegistryPath "HKUDUD:\Software\\Policies\\Microsoft\\Windows\\CloudContent" -Key 'ConfigureWindowsSpotlight' -Type dword -Value 2
+# Set-PSRegistry -RegistryPath "Users\.DEFAULT_USER\Software\Policies\Microsoft\Windows\CloudContent" -Key 'DisableThirdPartySuggestions' -Type dword -Value 1
+# Get-PSRegistry -RegistryPath "Users\.DEFAULT_USER\Software\Policies\Microsoft\Windows\CloudContent" | Format-List
 
-Get-PSRegistry -RegistryPath "HKUDUD:\Software\\Policies\\Microsoft\\Windows\\CloudContent" #-Key 'ConfigureWindowsSpotlight'
-Set-PSRegistry -RegistryPath "HKUDUD:\Software\\Policies\\Microsoft\\Windows\\CloudContent" -Key 'ConfigureWindowsSpotlight' -Type dword -Value 2
-Set-PSRegistry -RegistryPath "Users\.DEFAULT_USER\Software\Policies\Microsoft\Windows\CloudContent" -Key 'DisableThirdPartySuggestions' -Type dword -Value 1
-Get-PSRegistry -RegistryPath "Users\.DEFAULT_USER\Software\Policies\Microsoft\Windows\CloudContent" | Format-List
+# Get the domain name from the first line of $results.DuplicatePasswordGroups

Examples/RegistryNew.ps1

@@ -1,5 +1,7 @@
 Import-Module $PSScriptRoot\..\PSsharedGoods.psd1 -Force
 
-New-PSRegistry -RegistryPath "HKCU:\\Tests1\CurrentControlSet\Control\Lsa" -Verbose -WhatIf
+New-PSRegistry -RegistryPath "HKCU:\\Tests1\CurrentControlSet\Control\Lsa" -Verbose -WhatIf | Format-Table
+Get-PSRegistry -RegistryPath "HKCU:\\Tests1\CurrentControlSet\Control\Lsa" -Verbose | Format-Table
 
-Get-PSRegistry -RegistryPath "HKCU:\\Tests1\CurrentControlSet\Control\Lsa" -Verbose
+New-PSRegistry -RegistryPath "HKUDUO:\\Tests1\CurrentControlSet\Control\Lsa" -WhatIf | Format-Table
+Get-PSRegistry -RegistryPath "HKUDUO:\Tests1\CurrentControlSet\Control\Lsa" | Format-Table

Examples/RegistryRemove.ps1

@@ -1,4 +1,7 @@
 Import-Module $PSScriptRoot\..\PSsharedGoods.psd1 -Force
 
 Remove-PSRegistry -RegistryPath "HKEY_CURRENT_USER\Tests\Ok\MaybeNot" -Key "LimitBlankPass1wordUse" -WhatIf
-Remove-PSRegistry -RegistryPath "HKCU:\Tests\Ok" -WhatIf
+Remove-PSRegistry -RegistryPath "HKCU:\Tests\Ok" -WhatIf
+
+Remove-PSRegistry -RegistryPath "HKUDUO:\\Tests1\CurrentControlSet\Control\Lsa" -WhatIf | Format-Table
+Get-PSRegistry -RegistryPath "HKUDUO:\Tests1\CurrentControlSet\Control\Lsa" | Format-Table

Examples/RegistrySet.ps1

@@ -3,11 +3,11 @@ Import-Module $PSScriptRoot\..\PSsharedGoods.psd1 -Force
 
 #Get-PSRegistry -RegistryPath "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Installer" -Key "EnableUserControl"
 #Get-PSRegistry -RegistryPath "HKCU:\\\\Tests" -Key 'LimitBlankPasswordUse'
-
-Set-PSRegistry -RegistryPath "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon" -Key 'ForceUnlockLogon' -Value 1 -Type dword -WhatIf
-
+#Set-PSRegistry -RegistryPath "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon" -Key 'ForceUnlockLogon' -Value 1 -Type dword -WhatIf
 #Set-PSRegistry -RegistryPath "Users\.DEFAULT\Tests" -Key 'LimitBlankPasswordUse' -Value '1' -Type dword
 
+Get-PSRegistry -RegistryPath "HKUDUO:\Tests1\CurrentControlSet\Control\Lsa" | Format-Table
+Set-PSRegistry -RegistryPath "HKUDUO:\Tests1\CurrentControlSet\Control\Lsa" -Key 'LimitBlankPasswordUse' -Value '1' -Type dword
 return
 
 Set-PSRegistry -RegistryPath "HKEY_DEFAULT_USER\\Tests\CurrentControlSet\Control\Lsa" -Key "LimitBlankPasswordUse" -Value "0" -Type REG_DWORD -ComputerName EVOPOWER | Format-Table

PSSharedGoods.psd1

@@ -8,7 +8,7 @@
     Description          = 'Module covering functions that are shared within multiple projects'
     FunctionsToExport    = @('Get-ProtocolDefaults', 'Add-WinADUserGroups', 'Convert-ADGuidToSchema', 'Convert-ADSchemaToGuid', 'Find-ADConnectServer', 'Find-ExchangeServer', 'Find-HyperVServer', 'Find-ServerTypes', 'Find-UsersProxyAddressesStatus', 'Get-ADADministrativeGroups', 'Get-ADEncryptionTypes', 'Get-ADTrustAttributes', 'Get-WinADForestControllers', 'Get-WinADForestDetails', 'Get-WinADForestOptions', 'Get-WinADOrganizationalUnitData', 'Get-WinADOrganizationalUnitFromDN', 'Get-WinADUsersByDN', 'Get-WinADUsersByOU', 'Get-WinADUserSnapshot', 'Remove-WinADUserGroups', 'Set-WinADGroupSynchronization', 'Set-WinADUserFields', 'Set-WinADUserSettingGAL', 'Set-WinADUserStatus', 'Get-CimData', 'Get-Computer', 'Get-ComputerApplication', 'Get-ComputerBios', 'Get-ComputerCPU', 'Get-ComputerCulture', 'Get-ComputerDevice', 'Get-ComputerDisk', 'Get-ComputerDiskLogical', 'Get-ComputerMissingDrivers', 'Get-ComputerNetwork', 'Get-ComputerOemInformation', 'Get-ComputerOperatingSystem', 'Get-ComputerRAM', 'Get-ComputerRDP', 'Get-ComputerRoles', 'Get-ComputerService', 'Get-ComputerSMB', 'Get-ComputerSMBShare', 'Get-ComputerSMBSharePermissions', 'Get-ComputerStartup', 'Get-ComputerSystem', 'Get-ComputerTask', 'Get-ComputerTime', 'Get-ComputerTimeNtp', 'Get-ComputerWindowsFeatures', 'Get-ComputerWindowsUpdates', 'Get-OperatingSystem', 'Get-IPAddressInformation', 'Get-MyIpAddress', 'Set-PasswordRemotely', 'Convert-BinaryToHex', 'Convert-BinaryToString', 'Convert-Color', 'Convert-CountryCodeToCountry', 'Convert-CountryToCountryCode', 'Convert-DomainFqdnToNetBIOS', 'Convert-DomainToSid', 'Convert-ExchangeEmail', 'Convert-ExchangeItems', 'Convert-ExchangeRecipient', 'Convert-ExchangeSize', 'ConvertFrom-Color', 'Convert-HexToBinary', 'Convert-Identity', 'Convert-KeyToKeyValue', 'Convert-Office365License', 'Convert-Size', 'Convert-TimeToDays', 'Convert-ToDateTime', 'Convert-ToTimeSpan', 'Convert-TwoArraysIntoOne', 'Convert-UAC', 'Convert-UserAccountControl', 'ConvertFrom-DistinguishedName', 'ConvertFrom-ErrorRecord', 'ConvertFrom-LanguageCode', 'ConvertFrom-NetbiosName', 'ConvertFrom-ObjectToString', 'ConvertFrom-OperationType', 'ConvertFrom-ScriptBlock', 'ConvertFrom-SID', 'ConvertFrom-X500Address', 'ConvertTo-DistinguishedName', 'ConvertTo-FlatHashtable', 'ConvertTo-FlatObject', 'ConvertTo-Identity', 'ConvertTo-ImmutableID', 'ConvertTo-JsonLiteral', 'ConvertTo-OperatingSystem', 'ConvertTo-OrderedDictionary', 'ConvertTo-SID', 'Find-DatesCurrentDayMinusDayX', 'Find-DatesCurrentDayMinuxDaysX', 'Find-DatesCurrentHour', 'Find-DatesDayPrevious', 'Find-DatesDayToday', 'Find-DatesMonthCurrent', 'Find-DatesMonthPast', 'Find-DatesPastHour', 'Find-DatesPastWeek', 'Find-DatesQuarterCurrent', 'Find-DatesQuarterLast', 'Set-DnsServerIpAddress', 'Get-HTML', 'Send-Email', 'Set-EmailBody', 'Set-EmailBodyPreparedTable', 'Set-EmailBodyReplacement', 'Set-EmailBodyReplacementTable', 'Set-EmailFormatting', 'Set-EmailHead', 'Set-EmailReportBranding', 'Set-EmailWordReplacements', 'Set-EmailWordReplacementsHash', 'Get-FileInformation', 'Get-FileMetaData', 'Get-FileName', 'Get-FileOwner', 'Get-FilePermission', 'Get-FilesInFolder', 'Get-FileSize', 'Get-PathSeparator', 'Get-PathTemporary', 'Get-TemporaryDirectory', 'Remove-FilePermission', 'Set-FileInheritance', 'Set-FileOwner', 'Set-FilePermission', 'Get-GitHubLatestRelease', 'Get-GitHubVersion', 'Get-Logger', 'Add-ToArray', 'Add-ToArrayAdvanced', 'Add-ToHashTable', 'Clear-DataInformation', 'Compare-MultipleObjects', 'Compare-ObjectsAdvanced', 'Compare-ObjectProperties', 'Copy-Dictionary', 'Copy-DictionaryManual', 'Format-AddSpaceToSentence', 'Format-FirstXChars', 'Format-PSTable', 'Format-Stream', 'Format-ToTitleCase', 'Format-TransposeTable', 'Format-View', 'Get-Colors', 'Get-DataInformation', 'Get-HashMaxValue', 'Get-MimeType', 'Get-ObjectCount', 'Get-ObjectData', 'Get-ObjectEnumValues', 'Get-ObjectKeys', 'Get-ObjectProperties', 'Get-ObjectPropertiesAdvanced', 'Get-ObjectTitles', 'Get-ObjectType', 'Get-Types', 'Join-Uri', 'Join-UriQuery', 'Merge-Array', 'Merge-Objects', 'New-ArrayList', 'New-GenericList', 'Remove-DuplicateObjects', 'Remove-EmptyValue', 'Remove-FromArray', 'Remove-ObjectsExistingInTarget', 'Remove-WhiteSpace', 'Rename-LatinCharacters', 'Rename-UserValuesFromHash', 'Select-Properties', 'Split-Array', 'Test-IsDistinguishedName', 'Find-MyProgramData', 'Initialize-ModulePortable', 'Invoke-CommandCustom', 'Start-InternalFunction', 'Start-MyProgram', 'Get-RandomCharacters', 'Get-RandomFileName', 'Get-RandomPassword', 'Get-RandomStringName', 'Dismount-PSRegistryPath', 'Get-PSRegistry', 'Mount-PSRegistryPath', 'New-PSRegistry', 'Remove-PSRegistry', 'Set-PSRegistry', 'Test-PSRegistry', 'New-Runspace', 'Start-Runspace', 'Stop-Runspace', 'Get-PSService', 'Set-ServiceRecovery', 'Get-SqlQueryColumnInformation', 'New-SqlQuery', 'New-SqlQueryAlterTable', 'New-SqlQueryCreateTable', 'New-SqlTableMapping', 'Send-SqlInsert', 'Find-TypesNeeded', 'Get-ModulesAvailability', 'Search-Command', 'Test-AvailabilityCommands', 'Test-ComputerAvailability', 'Test-ComputerPort', 'Test-ConfigurationCredentials', 'Test-ForestConnectivity', 'Test-Key', 'Test-ModuleAvailability', 'Test-WinRM', 'Get-TimeSettings', 'Get-TimeZoneAdvanced', 'Get-TimeZoneLegacy', 'Measure-Collection', 'Set-TimeSynchronization', 'Start-TimeLog', 'Stop-TimeLog', 'Show-Array', 'Show-DataInVerbose', 'Show-TableVisualization', 'Save-XML', 'Set-XML')
     GUID                 = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
-    ModuleVersion        = '0.0.259'
+    ModuleVersion        = '0.0.260'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{

Private/ConvertTo-HkeyUser.ps1

@@ -6,7 +6,7 @@
         [string] $DictionaryKey,
         [string] $RegistryPath
     )
-    foreach ($Sub in $Subkeys) {
+    $OutputRegistryKeys = foreach ($Sub in $Subkeys) {
         if ($HiveDictionary[$DictionaryKey] -eq 'All') {
             if ($Sub -notlike "*_Classes*" -and $Sub -ne '.DEFAULT') {
                 $RegistryPath.Replace($DictionaryKey, "Users\$Sub")
@@ -16,7 +16,6 @@
                 if (-not $Script:DefaultRegistryMounted) {
                     $Script:DefaultRegistryMounted = Mount-DefaultRegistryPath
                 }
-                #$RegistryPath.Replace($DictionaryKey, "Users\$Sub")
                 if ($Sub -eq '.DEFAULT') {
                     $RegistryPath.Replace($DictionaryKey, "Users\.DEFAULT_USER")
                 } else {
@@ -41,10 +40,47 @@
                     $RegistryPath.Replace($DictionaryKey, "Users\$Sub")
                 }
             }
+        } elseif ($HiveDictionary[$DictionaryKey] -eq 'AllDomain+Other') {
+            if (($Sub.StartsWith("S-1-5-21") -and $Sub -notlike "*_Classes*")) {
+                if (-not $Script:OfflineRegistryMounted) {
+                    $Script:OfflineRegistryMounted = Mount-AllRegistryPath
+                    foreach ($Key in $Script:OfflineRegistryMounted.Keys) {
+                        $RegistryPath.Replace($DictionaryKey, "Users\$Key")
+                    }
+                }
+                $RegistryPath.Replace($DictionaryKey, "Users\$Sub")
+            }
+        } elseif ($HiveDictionary[$DictionaryKey] -eq 'AllDomain+Other+Default') {
+            if (($Sub.StartsWith("S-1-5-21") -and $Sub -notlike "*_Classes*") -or $Sub -eq '.DEFAULT') {
+                if (-not $Script:DefaultRegistryMounted) {
+                    $Script:DefaultRegistryMounted = Mount-DefaultRegistryPath
+                }
+                if (-not $Script:OfflineRegistryMounted) {
+                    $Script:OfflineRegistryMounted = Mount-AllRegistryPath
+                    foreach ($Key in $Script:OfflineRegistryMounted.Keys) {
+                        $RegistryPath.Replace($DictionaryKey, "Users\$Key")
+                    }
+                }
+                if ($Sub -eq '.DEFAULT') {
+                    $RegistryPath.Replace($DictionaryKey, "Users\.DEFAULT_USER")
+                } else {
+                    $RegistryPath.Replace($DictionaryKey, "Users\$Sub")
+                }
+            }
         } elseif ($HiveDictionary[$DictionaryKey] -eq 'AllDomain') {
             if ($Sub.StartsWith("S-1-5-21") -and $Sub -notlike "*_Classes*") {
                 $RegistryPath.Replace($DictionaryKey, "Users\$Sub")
             }
+        } elseif ($HiveDictionary[$DictionaryKey] -eq 'Users') {
+            if ($Sub -like "Offline_*") {
+                $Script:OfflineRegistryMounted = Mount-AllRegistryPath -MountUsers $Sub
+                foreach ($Key in $Script:OfflineRegistryMounted.Keys) {
+                    if ($Script:OfflineRegistryMounted[$Key].Status -eq $true) {
+                        $RegistryPath
+                    }
+                }
+            }
         }
     }
+    $OutputRegistryKeys | Sort-Object -Unique
 }