/bundles/itninjaweb/img/Breadcrumb_cap_w.png

Hey Everyone,

Is it possible to delete a registry subkey by using only a partial name for the key or subkey? Below is an example I can think of off the top of my head:

REG DELETE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Applications\Microsoft.XboxApp_39.39.21002.0_neutral_~_8wekyb3d8bbwe /F

This command works in deleting the key, however it does not cater for differences in version, updates, etc. The highlighted in yellow section changes, but the other remains constant.

Is there any way (CMD, PowerShell, VBS) to delete this by deleting any subkey beginning with Microsoft.Xbox under the given key below:

REG DELETE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Applications\Microsoft.XboxApp /F

Does anyone have any ready-made examples or resources to direct me on such a task?

(Note, I am wondering because with W10 1803, the PowerShell method of removing Appx Package and Provisioned package does not seem to remove some apps from new user accounts and removing these keys as a post task seems to fix the ones which do not get removed).

Thanks in advance.


Answer Summary:
0 Comments   [ + ] Show comments

Comments


Answer Chosen by the Author

1
Or even a one-liner in PowerShell:

Get-ChildItem -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Applications" | ForEach-Object {if ($_ -match "Microsoft.Xbox*"){Remove-Item -Path "Registry::$_" }}
Answered 05/23/2018 by: captain_planet
Black Belt

  • Thanks for this. Was able to add -recurse -force -confirm:$false to suppress the confirmation pop ups, after which this successfully removed the subkeys. This should be very helpful for similar apps and tasks. Thanks again, appreciate the help.
    • Good work. ;-)
    • How about posting your final script?
      • Sure, I used a .bat file to launch the .ps1 File. A few lines to delete the keys for the already provisioned apps, then a few lines to remove the ones I could not remove.
        I put them on separate lines for simplicity sake, but I imagine it can probably be done adding all names* to one command:

        Get-ChildItem -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Applications" -recurse | ForEach-Object {if ($_ -match "Microsoft.Xbox*"){Remove-Item -Path "Registry::$_" -recurse -force -confirm:$false}}
        Get-ChildItem -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Applications" -recurse | ForEach-Object {if ($_ -match "Microsoft.OneConnect*"){Remove-Item -Path "Registry::$_" -recurse -force -confirm:$false}}
        Get-ChildItem -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Applications" -recurse | ForEach-Object {if ($_ -match "Microsoft.People*"){Remove-Item -Path "Registry::$_" -recurse -force -confirm:$false}}
        Get-ChildItem -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Applications" -recurse| ForEach-Object {if ($_ -match "Microsoft.WindowsFeedbackHub*"){Remove-Item -Path "Registry::$_" -recurse -force -confirm:$false}}
        Get-ChildItem -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Applications" -recurse | ForEach-Object {if ($_ -match "Microsoft.Messaging*"){Remove-Item -Path "Registry::$_" -recurse -force -confirm:$false}}
        Get-ChildItem -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned" -recurse | ForEach-Object {if ($_ -match "Microsoft.BingWeather*"){Remove-Item -Path "Registry::$_" -recurse -force -confirm:$false}}
        Get-ChildItem -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned" -recurse | ForEach-Object {if ($_ -match "Microsoft.MicrosoftOfficeHub*"){Remove-Item -Path "Registry::$_" -recurse -force -confirm:$false}}
        Get-ChildItem -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned" -recurse | ForEach-Object {if ($_ -match "Microsoft.MicrosoftSolitaire*"){Remove-Item -Path "Registry::$_" -recurse -force -confirm:$false}}
        Get-ChildItem -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned" -recurse| ForEach-Object {if ($_ -match "Microsoft.windowscommunicationapps*"){Remove-Item -Path "Registry::$_" -recurse -force -confirm:$false}}
        Get-ChildItem -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned" -recurse | ForEach-Object {if ($_ -match "Microsoft.ZuneMusic*"){Remove-Item -Path "Registry::$_" -recurse -force -confirm:$false}}
        Get-ChildItem -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned" -recurse | ForEach-Object {if ($_ -match "Microsoft.ZuneVideo*"){Remove-Item -Path "Registry::$_" -recurse -force -confirm:$false}}
      • Very cool. Keep in mind that the latest version of K2 has built in tasks for powershell, so you don't have to use a .bat file to launch it.

All Answers

1
You can use autoit to enumerate the keys under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Applications and then compare key to find stringinstr of Microsoft.XboxApp and then delete that key.
Answered 05/22/2018 by: cserrins
Red Belt