How to query registry values skipping the PS* ones

When querying the registry value names like this:

Get-ItemProperty HKCU:\Software\Microsoft\Osk

You get a whole bunch of extra values.

PSPath            : Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USER\Software\Microsoft\Osk
PSParentPath      : Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USER\Software\Microsoft
PSChildName       : Osk
PSDrive           : HKCU
PSProvider        : Microsoft.PowerShell.Core\Registry
WindowLeft        : 100
WindowTop         : 100
WindowWidth       : 828
WindowHeight      : 236
ClickSound        : 1
Mode              : 1
HoverPeriod       : 1000
ScanInterval      : 1000
UseDevice         : 1
UseMouse          : 0
UseKB             : 1
ScanKey           : 32
UseTextPrediction : 1
InsertSpace       : 1
ShowNumPad        : 0

What I want is only the value names (WindowLeft, ...)

How can I do that?

Edit: string matches don't cut it. I do want legitimate registry value names to be included.

Example (could have done similar things with reg query hklm /v PS* /s or reg query hkcu /v PS* /s

reg add "HKCU\Software\BeSharp.net\Test" /v "Foo" /t REG_SZ /d "Bar" /f
reg add "HKCU\Software\BeSharp.net\Test" /v "Bar" /t REG_SZ /d "Foo" /f

reg add "HKCU\Software\BeSharp.net\Test" /v "PSPath" /t REG_SZ /d "Foo" /f
reg add "HKCU\Software\BeSharp.net\Test" /v "PSParentPath" /t REG_SZ /d "Foo" /f
reg add "HKCU\Software\BeSharp.net\Test" /v "PSChildName" /t REG_SZ /d "Foo" /f
reg add "HKCU\Software\BeSharp.net\Test" /v "PSDrive" /t REG_SZ /d "Foo" /f
reg add "HKCU\Software\BeSharp.net\Test" /v "PSProvider" /t REG_SZ /d "Foo" /f

reg add "HKCU\Software\BeSharp.net\Test" /v "1" /t REG_SZ /d "PSPath" /f
reg add "HKCU\Software\BeSharp.net\Test" /v "2" /t REG_SZ /d "PSParentPath" /f
reg add "HKCU\Software\BeSharp.net\Test" /v "3" /t REG_SZ /d "PSChildName" /f
reg add "HKCU\Software\BeSharp.net\Test" /v "4" /t REG_SZ /d "PSDrive" /f
reg add "HKCU\Software\BeSharp.net\Test" /v "5" /t REG_SZ /d "PSProvider" /f

reg query "HKCU\Software\BeSharp.net\Test"

You can delete the above demo data with this:

reg delete "HKCU\Software\BeSharp.net\Test"

The reg query "HKCU\Software\BeSharp.net\Test" returns this:

HKEY_CURRENT_USER\Software\BeSharp.net\Test
    Foo    REG_SZ    Bar
    Bar    REG_SZ    Foo
    PSPath    REG_SZ    Foo
    PSParentPath    REG_SZ    Foo
    PSChildName    REG_SZ    Foo
    PSDrive    REG_SZ    Foo
    PSProvider    REG_SZ    Foo
    1    REG_SZ    PSPath
    2    REG_SZ    PSParentPath
    3    REG_SZ    PSChildName
    4    REG_SZ    PSDrive
    5    REG_SZ    PSProvider

But the PowerShell Get-ItemProperty "HKCU:\Software\BeSharp.net\Test" returns this, overwriting the PS* values in the registry:

PSPath       : Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USER\Software\BeSharp.net\Test
PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USER\Software\BeSharp.net
PSChildName  : Test
PSDrive      : HKCU
PSProvider   : Microsoft.PowerShell.Core\Registry
Foo          : Bar
Bar          : Foo
1            : PSPath
2            : PSParentPath
3            : PSChildName
4            : PSDrive
5            : PSProvider

And adding a Select clause skips all PS* values, even if they came from the registry: PowerShell Get-ItemProperty "HKCU:\Software\BeSharp.net\Test" ^| Select * -Exclude PS*:

Foo : Bar
Bar : Foo
1   : PSPath
2   : PSParentPath
3   : PSChildName
4   : PSDrive
5   : PSProvider

So: skip PS* values like PSPath, PSParentPath, PSChildName, PSDrive and PSProvider (are there more?) when they are not in the registry, but include them when they are in the registry.

Bonus: Only list the names (not the values).

Solution

That's an easy one, you simple use Select, and tell it to Exclude PS*:

Get-ItemProperty HKCU:\Software\Microsoft\Osk|Select * -Exclude PS*

Edit: I should really read the whole question. Ok, to get just the names you can pipe to Get-Member -MemberType Properties, and then Select -Expand Name, and filter for items that start with PS

Get-ItemProperty HKCU:\Software\Microsoft\Osk|GM -MemberType Properties|Select -Expand Name| ?{!($_ -Match "^PS")}

Edit: Ok, if you want value names, and want to avoid PowerShell generated values, then we'll work around the built in providers and do a WMI query...

$HKEY_CLASSES_ROOT = 2147483648
$HKEY_CURRENT_USER = 2147483649
$HKEY_LOCAL_MACHINE = 2147483650
$HKEY_USERS = 2147483651
$HKEY_CURRENT_CONFIG = 2147483653
$reg = [WMIClass]"ROOT\DEFAULT:StdRegProv"
$reg.EnumValues($HKEY_CURRENT_USER,"Software\Microsoft\Osk")|Select -Expand sNames

On a side note, I'm curious what 2147483652 is since it seems to skip that.

Edit: meaning 2147483652 found by searching for 2147483652 HKEY_CLASSES_ROOT 2147483648 HKEY_CURRENT_USER 2147483649 HKEY_LOCAL_MACHINE 2147483650 HKEY_USERS 2147483651 HKEY_CURRENT_CONFIG 2147483653 HKEY_DYN_DATA 2147483654

Many links answer it, including DLLBinder Example - Registry Access that indicates it is in winreg.h (which - not surprisingly - contains the HEX values).

So, for completeness:

  $HKEY_CLASSES_ROOT       = 2147483648 # 0x80000000   
  $HKEY_CURRENT_USER       = 2147483649 # 0x80000001   
  $HKEY_LOCAL_MACHINE      = 2147483650 # 0x80000002   
  $HKEY_USERS              = 2147483651 # 0x80000003   
  $HKEY_PERFORMANCE_DATA   = 2147483652 # 0x80000004   
  $HKEY_CURRENT_CONFIG     = 2147483653 # 0x80000005   
  $HKEY_DYN_DATA           = 2147483654 # 0x80000006