{"id":2320,"date":"2013-12-30T00:01:00","date_gmt":"2013-12-30T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2013\/12\/30\/use-powershell-to-access-registry-last-modified-time-stamp\/"},"modified":"2022-06-21T14:15:27","modified_gmt":"2022-06-21T21:15:27","slug":"use-powershell-to-access-registry-last-modified-time-stamp","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/use-powershell-to-access-registry-last-modified-time-stamp\/","title":{"rendered":"Use PowerShell to Access Registry Last-Modified Time Stamp"},"content":{"rendered":"<p><b style=\"font-size:12px\">Summary<\/b><span style=\"font-size:12px\">: Guest blogger, Rohn Edwards, talks about using Windows PowerShell to access the last-modified time stamp in the registry.<\/span><\/p>\n<p>Microsoft Scripting Guy, Ed Wilson, is here. Welcome back guest blogger, Rohn Edwards. Rohn is one of the cofounders of the Mississippi PowerShell User Group.<\/p>\n<p>I\u2019m not sure how many of you know this, but the registry stores the last-modified time for every registry key. Unfortunately, it\u2019s not that accessible. Regedit won\u2019t let you get it interactively, although you can get it if you export the key as a text file and then open the file. There are also third-party tools that will let you see this information. Today, I want to show you how to do it with Windows PowerShell.<\/p>\n<p>As far as I can tell, WMI and .NET don\u2019t offer a way to get the last-modified time. The only way that I know to get this information from Windows PowerShell is to use platform invocation services (P\/Invoke). For some great information about P\/Invoke, see the following Hey, Scripting Guy! Blog posts:<\/p>\n<ul>\n<li><a href=\"https:\/\/devblogs.microsoft.com\/scripting\/weekend-scripter-use-powershell-and-pinvoke-to-remove-stubborn-files\/\" target=\"_blank\" rel=\"noopener\">Use PowerShell and Pinvoke to Remove Stubborn Files<\/a><\/li>\n<li><a href=\"https:\/\/devblogs.microsoft.com\/scripting\/use-powershell-to-duplicate-process-tokens-via-pinvoke\/\" target=\"_blank\" rel=\"noopener\">Use PowerShell to Duplicate Process Tokens via P\/Invoke<\/a><\/li>\n<\/ul>\n<p>After a little Internet searching, I came across two Win32 functions that will let you get this information: <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/ms724902(v=vs.85).aspx\" target=\"_blank\" rel=\"noopener\">RegQueryInfoKey<\/a> and <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/ms724862(v=vs.85).aspx\" target=\"_blank\" rel=\"noopener\">RegEnumKeyEx<\/a>.<\/p>\n<p>In this post, I\u2019m going to show you how to use <strong>RegQueryInfoKey<\/strong>. Hopefully, after reading this, you can create a signature for <strong>RegEnumKeyEx<\/strong> on your own, if you would like to use that instead.<\/p>\n<p>If you follow the link to the MSDN page on <strong>RegQueryInfoKey<\/strong>, you can find the C++ signature:<\/p>\n<p><a href=\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/3666.hsg-12-30-13-1.png\"><img decoding=\"async\" src=\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/3666.hsg-12-30-13-1.png\" alt=\"Image of code information\" title=\"Image of code information\" \/><\/a><\/p>\n<p>Almost any time you hear anything about P\/Invoke, you\u2019ll see a reference to <a href=\"http:\/\/pinvoke.net\/\" target=\"_blank\" rel=\"noopener\">pinvoke.net<\/a>. I\u2019ll agree that this is a wonderful resource for creating C# signatures in Windows PowerShell, but I usually use it only as a starting point, and I make sure that I agree with the types that were chosen for each entry.<\/p>\n<p>In this case, the C++ signature is simple enough to create a C# signature. If you look at the parameter types, you\u2019ll see that there are only four unique types: HKEY, LPTSTR, LPDWORD, and PFILETIME. By using this <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/aa719104%28v=vs.71%29.aspx#docum_topic3\" target=\"_blank\" rel=\"noopener\">Type Conversion table (Table 1)<\/a>, you can match the C++ to the following C# types:<\/p>\n<p style=\"margin-left:30px\">\n  <b>HKEY<\/b> \u00a0 According to the RegOpenKeyEx function documentation, HKEY is a handle.\n<\/p>\n<p style=\"margin-left:30px\">\n  <em>hKey<\/em> [in]\n<\/p>\n<p>A handle to an open registry key. This handle is returned by the <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/ms724844(v=vs.85).aspx\" target=\"_blank\" rel=\"noopener\">RegCreateKeyEx<\/a> or <strong>RegOpenKeyEx<\/strong> function, or it can be one of the following <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/ms724836(v=vs.85).aspx\" target=\"_blank\" rel=\"noopener\">predefined keys<\/a>:<\/p>\n<p style=\"margin-left:30px\">\n  <strong>HKEY_CLASSES_ROOT<\/strong>\n<\/p>\n<p style=\"margin-left:30px\">\n  <strong>HKEY_CURRENT_CONFIG<\/strong>\n<\/p>\n<p style=\"margin-left:30px\">\n  <strong>HKEY_CURRENT_USER<\/strong>\n<\/p>\n<p style=\"margin-left:30px\">\n  <strong>HKEY_LOCAL_MACHINE<\/strong>\n<\/p>\n<p style=\"margin-left:30px\">\n  <strong>HKEY_USERS<\/strong>\n<\/p>\n<p>The conversion table says that handles are represented by the <strong>IntPtr<\/strong>, <strong>UIntPtr<\/strong>, or <strong>HandleRef<\/strong> types in managed code. At the time of this writing, the pinvoke.net signature uses a <strong>UIntPtr<\/strong>. This would work just fine, but we\u2019re going to save ourselves some trouble, and use a different type (more on this in a little bit).<\/p>\n<p><strong>LPTSTR<\/strong> \u00a0 This is handled by <strong>String<\/strong> or <strong>StringBuilder<\/strong> in .NET.<\/p>\n<p><strong>LPDWORD<\/strong> \u00a0 Use <strong>Int32<\/strong> or <strong>UInt32<\/strong>.<\/p>\n<p><strong>PFILETIME<\/strong> \u00a0 This is a <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/ms724284%28v=vs.85%29.aspx\" target=\"_blank\" rel=\"noopener\">FILETIME structure<\/a>:<\/p>\n<p style=\"margin-left:30px\">\n  typedef struct _FILETIME {\n<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0 DWORD dwLowDateTime;\n<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0 DWORD dwHighDateTime;\n<\/p>\n<p style=\"margin-left:30px\">\n  } FILETIME, *PFILETIME;\n<\/p>\n<p><span>It turns out that .NET already has a FILETIME structure that we can use: System.Runtime.InteropServices.ComTypes.FILETIME. We\u2019ll use that combined with a little bit of Windows PowerShell\u00a03.0 script to convert it to a <b>DateTime<\/b> object.<\/span><\/p>\n<p>There\u2019s only one more thing: Remember how I said we\u2019d come back to the <strong>hKey<\/strong> handle? Well, when using the Win32 functions to work with the registry, you have to open a handle to a key before you can do anything with it. This requires a call to <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/ms724897(v=vs.85).aspx\" target=\"_blank\" rel=\"noopener\">RegOpenKeyEx<\/a>, which would require its own C# signature.<\/p>\n<p>After you open a handle and use it, you have to close it with a call to <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/ms724837(v=vs.85).aspx\" target=\"_blank\" rel=\"noopener\">RegCloseKey<\/a>, which requires yet another signature. The <strong>hKey<\/strong> parameter wants a handle to an open key. An <strong>IntPtr<\/strong> handles this, but you still need two more functions to get that solution working. Windows PowerShell\u00a04.0 or Windows PowerShell\u00a03.0 provide an open handle to a registry key when you get the key by using <strong>Get-ChildItem<\/strong> or <strong>Get-Item<\/strong> (you can actually thank the .NET Framework). Take a look at the <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/microsoft.win32.registrykey.handle(v=vs.110).aspx\" target=\"_blank\" rel=\"noopener\">Handle<\/a> property on a <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/microsoft.win32.registrykey(v=vs.110).aspx\" target=\"_blank\" rel=\"noopener\">RegistryKey<\/a> object:<\/p>\n<p><a href=\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/3568.hsg-12-30-13-2.png\"><img decoding=\"async\" src=\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/3568.hsg-12-30-13-2.png\" alt=\"Image of command output\" title=\"Image of command output\" \/><\/a><\/p>\n<p>As far as I can tell, you can use the <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/microsoft.win32.safehandles.saferegistryhandle(v=vs.110).aspx\" target=\"_blank\" rel=\"noopener\">SafeRegistryHandle<\/a> in place of an <strong>IntPtr<\/strong> in the signature.<\/p>\n<p>Taking all of that into account, our call to <strong>Add-Type<\/strong> looks something like the following:<\/p>\n<p style=\"margin-left:30px\">\n  $Namespace = &#8220;HeyScriptingGuy&#8221;\n<\/p>\n<p style=\"margin-left:30px\">\n  Add-Type @&#8221;\n<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0\u00a0\u00a0 using System;\n<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0\u00a0\u00a0 using System.Text;\n<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0\u00a0\u00a0 using System.Runtime.InteropServices;\u00a0\n<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0\u00a0\u00a0 $($Namespace | ForEach-Object {\n<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 &#8220;namespace $_ {&#8221;\n<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0\u00a0\u00a0 })\n<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0 \u00a0 \u00a0 \u00a0 \u00a0public class advapi32 {\n<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 [DllImport(&#8220;advapi32.dll&#8221;, CharSet = CharSet.Auto)]\n<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 public static extern Int32 RegQueryInfoKey(\n<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Microsoft.Win32.SafeHandles.SafeRegistryHandle hKey,\n<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 StringBuilder lpClass,\n<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 [In, Out] ref UInt32 lpcbClass,\n<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 UInt32 lpReserved,\n<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 out UInt32 lpcSubKeys,\n<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 out UInt32 lpcbMaxSubKeyLen,\n<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 out UInt32 lpcbMaxClassLen,\n<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 out UInt32 lpcValues,\n<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 out UInt32 lpcbMaxValueNameLen,\n<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 out UInt32 lpcbMaxValueLen,\n<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 out UInt32 lpcbSecurityDescriptor, \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\n<\/p>\n<p style=\"margin-left:60px\">\n  \u00a0 \u00a0 \u00a0 out System.Runtime.InteropServices.ComTypes.FILETIME lpftLastWriteTime\n<\/p>\n<p>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 );<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 }\n<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0\u00a0\u00a0 $($Namespace | ForEach-Object {\n<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 &#8220;}&#8221;\n<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0\u00a0\u00a0 })\n<\/p>\n<p style=\"margin-left:30px\">\n  &#8220;@<ins cite=\"mailto:June%20Blender%20Rogers\" datetime=\"2013-12-18T13:13\"><\/ins>\n<\/p>\n<p>The <strong>$Namespace<\/strong> variable exists only so that you can easily change the namespace in one place, and it will be reflected throughout the script. You can assign an array of strings to have nested namespaces, too.<\/p>\n<p>The <strong>LP<\/strong> and <strong>P<\/strong> prefixes on the parameter names mean that you\u2019re actually passing pointers, so that\u2019s why we\u2019re using the <strong>Out<\/strong> keyword on almost all of the parameters (and when we use them, we\u2019ll pass them by reference).<\/p>\n<p>Here\u2019s how to use the function:<\/p>\n<p style=\"margin-left:30px\">\n  # Store the type in a variable:\n<\/p>\n<p style=\"margin-left:30px\">\n  $RegTools = (&#8220;{0}.advapi32&#8221; -f ($Namespace -join &#8220;.&#8221;)) -as [type]\n<\/p>\n<p style=\"margin-left:30px\">\n  # Get a RegistryKey object (we need the handle)\n<\/p>\n<p style=\"margin-left:30px\">\n  $RegKey = Get-Item HKLM:\\SOFTWARE\n<\/p>\n<p style=\"margin-left:30px\">\n  # Create any properties that we want returned:\n<\/p>\n<p style=\"margin-left:30px\">\n  $LastWrite = New-Object System.Runtime.InteropServices.ComTypes.FILETIME\n<\/p>\n<p style=\"margin-left:30px\">\n  # Call function:\n<\/p>\n<p style=\"margin-left:30px\">\n  $RegTools::RegQueryInfoKey($RegKey.Handle, $null, [ref] $null, $null, [ref] $null, [ref] $null, [ref] $null, [ref] $null, [ref] $null, [ref] $null, [ref] $null, [ref] $LastWrite)\n<\/p>\n<p style=\"margin-left:30px\">\n  # Convert to DateTime object:\n<\/p>\n<p style=\"margin-left:30px\">\n  $UnsignedLow = [System.BitConverter]::ToUInt32([System.BitConverter]::GetBytes($LastWrite.dwLowDateTime), 0)\n<\/p>\n<p style=\"margin-left:30px\">\n  $UnsignedHigh = [System.BitConverter]::ToUInt32([System.BitConverter]::GetBytes($LastWrite.dwHighDateTime), 0)\n<\/p>\n<p style=\"margin-left:30px\">\n  # Shift high part so it is most significant 32 bits, then copy low part into 64-bit int:\n<\/p>\n<p style=\"margin-left:30px\">\n  $FileTimeInt64 = ([Int64] $UnsignedHigh -shl 32) -bor $UnsignedLow\n<\/p>\n<p style=\"margin-left:30px\">\n  # Create datetime object\n<\/p>\n<p style=\"margin-left:30px\">\n  [datetime]::FromFileTime($FileTimeInt64)\u00a0\n<\/p>\n<p>The call to** RegQueryInfoKey** should return 0 if the call was successful. Passing <strong>$null<\/strong> as a parameter means that we aren\u2019t interested in it (notice in the C++ signature that they\u2019re optional). The other parameters aren\u2019t really that useful because they\u2019re almost all available already. But here\u2019s how you would get them (assuming you already ran the previous lines that define <strong>$RegTools<\/strong> and <strong>$RegKey<\/strong>):<\/p>\n<p style=\"margin-left:30px\">\n  # Create any properties that we want returned:\n<\/p>\n<p style=\"margin-left:30px\">\n  $SubKeyCount = $ValueCount = $null\n<\/p>\n<p style=\"margin-left:30px\">\n  $LastWrite = New-Object System.Runtime.InteropServices.ComTypes.FILETIME\n<\/p>\n<p style=\"margin-left:30px\">\n  $StringBuffer = 255\n<\/p>\n<p style=\"margin-left:30px\">\n  $ClassName = New-Object System.Text.StringBuilder $StringBuffer\n<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0# Call function:\n<\/p>\n<p style=\"margin-left:30px\">\n  $RegTools::RegQueryInfoKey($RegKey.Handle, $ClassName, [ref] $StringBuffer, $null, [ref] $SubKeyCount, [ref] $null, [ref] $null, [ref] $ValueCount, [ref] $null, [ref] $null, [ref] $null, [ref] $LastWrite)\n<\/p>\n<p style=\"margin-left:30px\">\n  # Convert to DateTime object:\n<\/p>\n<p style=\"margin-left:30px\">\n  $UnsignedLow = [System.BitConverter]::ToUInt32([System.BitConverter]::GetBytes($LastWrite.dwLowDateTime), 0)\n<\/p>\n<p style=\"margin-left:30px\">\n  $UnsignedHigh = [System.BitConverter]::ToUInt32([System.BitConverter]::GetBytes($LastWrite.dwHighDateTime), 0)\n<\/p>\n<p style=\"margin-left:30px\">\n  # Shift high part so it is most significant 32 bits, then copy low part into 64-bit int:\n<\/p>\n<p style=\"margin-left:30px\">\n  $FileTimeInt64 = ([Int64] $UnsignedHigh -shl 32) -bor $UnsignedLow\n<\/p>\n<p style=\"margin-left:30px\">\n  # Return results:\n<\/p>\n<p style=\"margin-left:30px\">\n  [PSCustomObject] @{\n<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0\u00a0\u00a0 Key = $RegKey.Name\n<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0\u00a0\u00a0 ClassName = $ClassName.ToString()\n<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0\u00a0\u00a0 SubKeyCount = $SubKeyCount\n<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0\u00a0\u00a0 ValueCount = $ValueCount\n<\/p>\n<p style=\"margin-left:30px\">\n  \u00a0\u00a0\u00a0 LastWriteTime = [datetime]::FromFileTime<span>($FileTimeInt64)<\/span>\n<\/p>\n<p style=\"margin-left:30px\">\n  }\n<\/p>\n<p>So now we can manually run this Win32 function when we want to get the last-modified time. The only issue is that using it is a lot of work\u2014look at how many parameters there are!<\/p>\n<p>Thanks to Colin Robertson and Lee Hart, Windows programming writers, who<\/p>\n<p>Thanks to Colin Robertson and Lee Hart, Windows programming writers, who explained the risks of converting the FILETIME structure to UInt64. Please join me tomorrow to see how we can take what we\u2019ve learned today and wrap it up into a much friendlier and easier-to-use reusable function. The complete script for this blog post is available in the Script Center Repository: <a href=\"http:\/\/gallery.technet.microsoft.com\/scriptcenter\/Get-Last-Write-Time-and-06dcf3fb\" target=\"_blank\" rel=\"noopener\">Get Last Write Time and Class Name of Registry Keys<\/a>.<\/p>\n<p>~Rohn<\/p>\n<p>Thanks, Rohn, for sharing your expertise.<\/p>\n<p>I invite you to follow me on <a href=\"http:\/\/bit.ly\/scriptingguystwitter\" target=\"_blank\" rel=\"noopener\">Twitter<\/a> and <a href=\"http:\/\/bit.ly\/scriptingguysfacebook\">Facebook<\/a>. If you have any questions, send email to me at <a href=\"mailto:scripter@microsoft.com\" target=\"_blank\" rel=\"noopener\">scripter@microsoft.com<\/a>, or post your questions on the <a href=\"http:\/\/bit.ly\/scriptingforum\" target=\"_blank\" rel=\"noopener\">Official Scripting Guys Forum<\/a>. See you tomorrow. Until then, peace.<\/p>\n<p><strong>Ed Wilson, Microsoft Scripting Guy<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Summary: Guest blogger, Rohn Edwards, talks about using Windows PowerShell to access the last-modified time stamp in the registry. Microsoft Scripting Guy, Ed Wilson, is here. Welcome back guest blogger, Rohn Edwards. Rohn is one of the cofounders of the Mississippi PowerShell User Group. I\u2019m not sure how many of you know this, but the [&hellip;]<\/p>\n","protected":false},"author":596,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[56,31,26,342,3,45],"class_list":["post-2320","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-guest-blogger","tag-operating-system","tag-registry","tag-rohn-edwards","tag-scripting-guy","tag-windows-powershell"],"acf":[],"blog_post_summary":"<p>Summary: Guest blogger, Rohn Edwards, talks about using Windows PowerShell to access the last-modified time stamp in the registry. Microsoft Scripting Guy, Ed Wilson, is here. Welcome back guest blogger, Rohn Edwards. Rohn is one of the cofounders of the Mississippi PowerShell User Group. I\u2019m not sure how many of you know this, but the [&hellip;]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/2320","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/596"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=2320"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/2320\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=2320"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=2320"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=2320"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}