具有两个注册表键路径的 WMI MOF 文件

Question

查询 Win32_Products 可能需要很长时间，当尝试查询大量计算机时，这让我很沮丧。我以前从未使用过 MOF 文件，但有人建议 "creating" 一个新的命名空间，其中包含我正在从注册表中查找的信息。

我被指向了以下 MOF 代码：

    #PRAGMA AUTORECOVER

    qualifier dynamic:ToInstance;
    qualifier ProviderClsid:ToInstance;
    qualifier ClassContext:ToInstance;
    qualifier propertycontext:ToInstance; 

    [dynamic, provider("RegProv"),
        ProviderClsid("{fe9af5c0-d3b6-11ce-a5b6-00aa00680c3f}"),
        ClassContext
        ("local|HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall")
    ] 
    class Software {
        [key] string KeyName;
        [read, propertycontext("Publisher")] string Vendor;
        [read, propertycontext("DisplayName")] string ProductName;
        [read, propertycontext("DisplayVersion")] string Version;
        [read, propertycontext("InstallDate")] string InstallDate;
        [read, propertycontext("InstallLocation")] string InstallLocation;
        [read, propertycontext("InstallSource")] string InstallSource;
        [read, propertycontext("UninstallString")] string UninstallString;
    };

这太棒了，但我如何才能同时检查软件和 Software\Wow6432Node 路径？我试过在虚拟机上玩弄它，但运气不好只是在黑暗中刺伤。

我试过了：

    ("local|HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall")
    ("local|HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall")

或

    ("local|HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall",
    "local|HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall")

以及其他一些随意的想法。似乎没有任何效果。您将如何从两个注册表路径收集信息？

如有任何帮助，我将不胜感激！这会缩短我的脚本时间。

Answer 1

要么创建两个单独的 MOF 文件（每个注册表路径一个），要么使用多个实例化 __Win32Provider，如下所示

#PRAGMA AUTORECOVER
#pragma namespace("\\.\root\CimV2")

qualifier dynamic:ToInstance;
qualifier ProviderClsid:ToInstance;
qualifier ClassContext:ToInstance;
qualifier propertycontext:ToInstance; 

Instance of __Win32Provider as $prov32bit
{
  Name = "RegProv32";
  // ClsId = "{fe9af5c0-d3b6-11ce-a5b6-00aa00680c3f}";
};

Instance of __Win32Provider as $prov64bit
{
  Name = "RegProv64";
  // ClsId = "{fe9af5c0-d3b6-11ce-a5b6-00aa00680c3f}";
};

[dynamic, provider($prov32bit),
    ProviderClsid("{fe9af5c0-d3b6-11ce-a5b6-00aa00680c3f}"),
    ClassContext
    ("local|HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall")
] 

[dynamic, provider($prov64bit),
    ProviderClsid("{fe9af5c0-d3b6-11ce-a5b6-00aa00680c3f}"),
    ClassContext
    ("local|HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall")
]

非常确定也有必要将 class Software 部分加倍。不确定所有 ToInstance qualifier flavors rightness. And last not least, above script does not care for the Wow6432Node existence. However, this solution looks good:

This script creates a WMI Class Win32_AddRemovePrograms (and, on 64bit systems, a Win32_AddRemovePrograms32 for 32bit apps) which are backed by the registry provider. They can then be queried to list installed apps (and versions) and perform much faster than running the same queries using the PowerShell Registry provider. Additionally, they can be used in GPO policies, etc.

具有两个注册表键路径的 WMI MOF 文件

WMI MOF File with Two Registry KeyPaths

wmi