Untitled

Powershell search registry content in event log

Get-ItemProperty -path hklm:systemcurrentcontrolsetenumusbstor** | select PSChildName

       

Get-ItemProperty -path hklm:systemcurrentcontrolsetenumusbstor** | select PSChildName | foreach-object {Get-Content C:Windowsinfsetupapi.dev.log | select-string '$_.PSChildName' -context 1}

       

Get-ItemProperty -path hklm:systemcurrentcontrolsetenumusbstor** | select PSChildName | foreach-object {$P = $_.PSChildName ; Get-Content  C:Windowsinfsetupapi.dev.log | select-string $P -SimpleMatch -context 1}

       

$KeyListArray = @()

    Foreach($key in Get-ItemProperty -path hklm:systemcurrentcontrolsetenumusbstor** | select PSChildName)

    {$KeyListArray +($key)}

 

 

foreach($PsChild in $KeyListArray)

{Get-Content C:Windowsinfsetupapi.dev.log | select-string -Pattern "$PsChild" -context 1}