Why Some Registry Keys Can’t Be Deleted in PowerShell
Deleting registry keys is typically trivial and can be done with Remove-Item. However, every once in a while, you may come across registry keys that can’t be deleted. In this tip we’ll show an example, and provide a solution.
In the previous tip we explained that the “Run with PowerShell” context command may be missing in PowerShell files when you have defined a non-default OpenWith command, and this registry key exists:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ps1\UserChoice
This key is created when you right-click a PowerShell script in File Explorer, choose “Open With”, then choose to select a different app, then choose a non-default program such as “ISE” or “VSCode” and check the box to always open PowerShell scripts with the selected program.
Once the above registry key is present, the default PowerShell commands such as “Run with PowerShell” are missing from the context menu. While it is easy to repair this and manually delete the key in regedit.exe, for some unknown reason PowerShell commands fail. All underlying .NET methods fail as well.
This fails:
Remove-Item -Path HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ps1\UserChoice
This fails as well (which is the .NET equivalent):
$parent = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ps1', $true) $parent.DeleteSubKeyTree('UserChoice',$true) $parent.Close()
The Correct Way to Delete the Registry Key
To delete the key, you need to explicitly pick the method DeleteSubKey() instead of DeleteSubKeyTree(). Apparently, there are some invisible corrupted subkeys inside of that key that prevent the key from being deleted.
When you just ask to delete the key (and not its subkeys which don’t exist anyway), the key is deleted just fine, and your PowerShell “Run with PowerShell” command is restored:
$parent = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ps1', $true) $parent.DeleteSubKey('UserChoice', $true) $parent.Close()
Side note: since the code touches only the user hive, it can be safely run from any user, without any special privileges required, whereas the manual repair in regedit.exe required admin privileges.
psconf.eu – PowerShell Conference EU 2019 – June 4-7, Hannover Germany – visit www.psconf.eu There aren’t too many trainings around for experienced PowerShell scripters where you really still learn something new. But there’s one place you don’t want to miss: PowerShell Conference EU – with 40 renown international speakers including PowerShell team members and MVPs, plus 350 professional and creative PowerShell scripters. Registration is open at www.psconf.eu, and the full 3-track 4-days agenda becomes available soon. Once a year it’s just a smart move to come together, update know-how, learn about security and mitigations, and bring home fresh ideas and authoritative guidance. We’d sure love to see and hear from you!
