Sure enough, I had upgraded my Windows 7 machines to Windows 10 and had NOT done a fresh Windows 10 install. But why did the Windows 10 workstations have both a "1" subkey and a "3" subkey? Jared, once again, suggested that a previous version of Windows being upgraded to Windows 10 may have been the reason.
#Ccleaner piriform 5.15 software
Therefore, James's SOFTWARE hive only had a single "1" subkey. My machines were Windows 10 workstations. James's machine was a Windows XP workstation. It wasn't until Jared noted that having the "1" subkey would indicate the existence of PowerShell v1 or v2 and that having the "3" subkey would indicate PowerShell v3-5 that this all started to make more sense.
As we can see in the screenshot below, there is a value named PowerShellVersion that will tell us the version of PowerShell installed on the machine.Ī second subkey named "3" shows a different, more recent version of PowerShell Within the "1" subkey is yet another subkey named PowerShellEngine. James noted that he found a subkey named " 1" inside.
Right off the bat, Jared suggested that there had to be something in the registry related to this information and subsequently pointed us to the following registry key: HKLM\SOFTWARE\Microsoft\PowerShell. you are working off of a forensic image - not a live machine). You want to determine the version of PowerShell installed on a machine, but don't have a means by which to run t he $PSVersionTablePowerShell command (e.g. I was chatting with Jared Atkinson and James Habben about PowerShell today and a question emerged from the discussion: is there way to determine the version of PowerShell installed on a given machine without using the $PSVersionTable PowerShell command? We all agreed that it would be nice to have an offline source for finding this information. FORENSICS QUICKIES! These posts will consist of small tidbits of useful information that can be explained very succinctly.
0 kommentar(er)
