# Get-BluGenieRegSnapshot



### Get-BluGenieRegSnapshot <a href="#get-blugenieregsnapshot" id="get-blugenieregsnapshot"></a>

### SYNOPSIS <a href="#synopsis" id="synopsis"></a>

Get-BluGenieRegSnapshot takes a snapshot of the Registry

### SYNTAX <a href="#syntax" id="syntax"></a>

```
Get-BluGenieRegSnapshot [[-Path] <String>] [[-Walkthrough]] [[-ReturnObject]] [[-LeaveFile]] [[-OutUnEscapedJSON]] [<CommonParameters>]
```

### DESCRIPTION <a href="#description" id="description"></a>

Get-BluGenieRegSnapshot takes a snapshot of the Registry

### EXAMPLES <a href="#examples" id="examples"></a>

#### EXAMPLE 1 <a href="#example-1" id="example-1"></a>

```
Get-BluGenieRegSnapshot -Path 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa'
```

```
This will take a Registry Snapshot of the path 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa'
and return a Hash Table with all the information
```

#### EXAMPLE 2 <a href="#example-2" id="example-2"></a>

```
Get-BluGenieRegSnapshot -Path 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa' -ReturnObject
```

```
This will take a Registry Snapshot of the path 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa'
and return just the Object content
```

#### EXAMPLE 3 <a href="#example-3" id="example-3"></a>

```
Get-BluGenieRegSnapshot -Path 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa' -LeaveFile
```

```
This will take a Registry Snapshot of the path 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa'

The temp snapshot file will be removed from the users temp directory.  The file is saved with a guid value
```

#### EXAMPLE 4 <a href="#example-4" id="example-4"></a>

```
Get-BluGenieRegSnapshot -Path 'HKEY_CURRENT_USER\Software\7-Zip'
```

```
Any values that match HKEY_CURRENT_USER will be convert to HKU keys and all loaded registry hives will be enumerated and
parsed.  A Registry Snapshot of the path will be taken for each loaded hive that has the key path.
```

#### EXAMPLE 5 <a href="#example-5" id="example-5"></a>

```
Get-BluGenieRegSnapshot -Path 'HKEY_CURRENT_USER\Software\7-Zip' -OutUnEscapedJSON
```

```
Any values that match HKEY_CURRENT_USER will be convert to HKU keys and all loaded registry hives will be enumerated and
parsed.  A Registry Snapshot of the path will be taken for each loaded hive that has the key path.

The return will be a beautified json format
```

### PARAMETERS <a href="#parameters" id="parameters"></a>

#### Path <a href="#path" id="path"></a>

```
-Path <String>
   The path to the parent registry key
   
   <Type>String<Type>
   
   Required?                    false
   Position?                    1
   Default value                
   Accept pipeline input?       false
   Accept wildcard characters?  false
```

#### Walkthrough <a href="#walkthrough" id="walkthrough"></a>

```
-Walkthrough [<SwitchParameter>]
   An automated process to walk through the current function and all the parameters
   
   <Type>SwitchParameter<Type>
   
   Required?                    false
   Position?                    2
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
```

#### ReturnObject <a href="#returnobject" id="returnobject"></a>

```
-ReturnObject [<SwitchParameter>]
   Return information as an Object.
   By default the data is returned as a Hash Table
   
   <Type>SwitchParameter<Type>
   
   Required?                    false
   Position?                    3
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
```

#### LeaveFile <a href="#leavefile" id="leavefile"></a>

```
-LeaveFile [<SwitchParameter>]
   Do not remove snapshot file.
   By default the data is saved has a GUID in the users temp directory
   
   <Type>SwitchParameter<Type>
   
   Required?                    false
   Position?                    4
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
```

#### OutUnEscapedJSON <a href="#outunescapedjson" id="outunescapedjson"></a>

```
-OutUnEscapedJSON [<SwitchParameter>]
   Removed UnEsacped Char from the JSON Return.
   This will beautify json and clean up the formatting.
   
   <Type>SwitchParameter<Type>
   
   Required?                    false
   Position?                    5
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
```

#### CommonParameters <a href="#commonparameters" id="commonparameters"></a>

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).