In this post I will show you how to query registry value using CMPivot. If you want to query specific registry value from your computers, you can do it using ConfigMgr CMPivot.
I get many questions about querying a specific registry value from devices using SCCM. I always recommend using CMPivot because you can find the registry value easily. Plus you don’t need to create an application or package in SCCM and CMPivot saves your time.
CMPivot is a new in-console utility that now provides access to real-time state of devices in your environment. It immediately runs a query on all currently connected devices in the target collection and returns the results.
Querying a registry using CMPivot is pretty simple. All you need is the query and a proper registry path to find the correct value. Let’s look at steps to query registry value using CMPivot.
I have got a device collection that contains Windows 10 computers. I will be running the CMPivot query on this collection. The larger the computers in the collection, the more time it takes for the results to be displayed.
Before you find or query registry value using CMPivot, ensure the devices are online. In case the device is offline or not contactable, you would get to know about it in the query output.
Query Registry Value using CMPivot
Launch the ConfigMgr console and go to Assets and Compliance > Overview > Device Collections. Choose the device collection against which you want to run the CMPivot. Right click the device collection and click Start CMPivot.
Wait for the CMPivot to launch. First click the Query tab so that you can enter the query. To query registry value using CMPivot, use the following query.
Registry('Registry Path') | where Property == 'Property Name'
In place of registry path you must specify the correct registry path. Set the property name that matches your registry value.
In the below example, we use CMPivot query to find the .NET Framework version. The registry contains a list of the versions of .NET Framework installed on the computer. To determine which .NET Framework versions are installed on computers, the below query should help. The Release REG_DWORD value in the registry represents the version of .NET Framework installed.
Registry('hklm:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Client') | where Property == 'Release'
Matching the release number with that of .NET Framework reveals that the computers have got .NET Framework 4.8 installed. This was also the update included with Windows 10 May 2020 Update and Windows 10 October 2020 Update.
You can export the query output to a CSV file when the output contains long list of machines. In the top right corner of the CMPivot query tool, click Export and select Results to File.
Tried to use it on hkcr:\\SOFTWARE\\ – no luck 🙁
Any suggestions for Computer\HKEY_CLASSES_ROOT\SOFTWARE\?
My Problem is that I just know the beginning of the path and don’t know the registry key itselfe.
currently I use Registry(‘hklm:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\client’) to get ALL keys.
but that doesnt work if I just look for Registry(‘hklm:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4’)
as in this path are no keys
Is there a chance to look for a path ?
You can get the registry path from another computer, provided the software is installed.
can CMPIVOT query HKCR ?
Runs under system context. IF a user is logged in you can query by their SID under HKEY_USERS
It is HKCR not HKCU
Thanks Prajwal, that works fine for an existing registry key. I am desperate looking for a CMPivot query which gives me the devices without a specific registry key. Thanks a lot.
Same request here how to query for missing registry key?
An exmaple I use. Query first off key would always be there liek the release ID for windows. Then Join that to the key you are checking, in my case WMITelemetry.
Then create a condition (where clause) for value1 (which is the value returned for the 2nd registry key)
Registry(‘hklm:\SOFTWARE\Microsoft\Windows NT\CurrentVersion’) | where Property == ‘ReleaseID’
| join kind=leftouter (Registry(‘hklm:\SOFTWARE\Microsoft\Internet Explorer\WMITelemetry’))
| where isnull(Value1)
| project device, Property
Can CMPivot look at HKey Current User ?
Does CMPivot have an automation method to run and export the results to SSRS or Excel?
this helped me out a good bit, but I can not seem to use Join with the query… can you use Join to query two diffent registery hive\keys
Thank you Prajwal, very useful post and well documented.