#Function for checking the registry key recursively
Function Get-AllItemsFromRegistry($RegItem)
{
    #First we print the RegItem name into file, so we know what is coming
    $RegItem >> $fileName
    #Call Get-Item funciton with the parameter passed, send output to the file
    Get-Item $RegItem -ErrorAction SilentlyContinue >> $fileName
    #Call Get-ChildItem funciton with the parameter passed and with the Recurse option, send output to the file
    Get-ChildItem $RegItem -Recurse -ErrorAction SilentlyContinue >> $fileName
}

#Get the output file's name from user
[string]$fileName = Read-Host -Prompt "Output file: "
#Overwrite file with the current date and time, if file exsists
Get-Date > $fileName
#Map HKU drive, just in case it is not mapped
New-PSDrive -Name HKU -PSProvider Registry HKEY_USERS -ErrorAction SilentlyContinue > $null
#Call function (defined above) to log the registry entries
Get-AllItemsFromRegistry -RegItem HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Get-AllItemsFromRegistry -RegItem HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Get-AllItemsFromRegistry -RegItem 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks'
Get-AllItemsFromRegistry -RegItem HKLM:\SYSTEM\CurrentControlSet\Services
Get-AllItemsFromRegistry -RegItem HKLM:\SYSTEM\CurrentControlSet\Enum\
Get-AllItemsFromRegistry -RegItem 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles'

#Get all the items from HKU where the name starts with S-1-5-21 and ends with 4 any numbers
Get-ChildItem HKU: | Where-Object {$_.Name -match "S-1-5-21-.*\d{4}$"} | ForEach-Object -Process {
    #Assign .Name's value to SIDI variable
    $SIDI = $($_.name)
    #Replace HKEY_USERS to HKU: in SIDI variable
    $SIDI = $SIDI -replace "HKEY_USERS","HKU:"
    #Call our function with the following parameters
    Get-AllItemsFromRegistry -RegItem "$SIDI\Software\Microsoft\Windows\CurrentVersion\Run"
    Get-AllItemsFromRegistry -RegItem "$SIDI\Software\Microsoft\Windows\CurrentVersion\RunOnce"
    Get-AllItemsFromRegistry -RegItem "$SIDI\Software\Microsoft\Internet Explorer\TypedURLs"
}
#We print !DONE! Because we want to now when we are done
Write-Output "!DONE!"