Using reg unload gives access denied error

user_6067621 0
Viewed 5014

I am trying to load an ntuser.dat and view part of it, after I have viewed what I need I am unable to use reg unload it says "access denied"

I looked and it seems I need to use [gc]::Collect() but that does not work either.

reg load HKLM\user C:\Users\user\NTUSER.DAT
$result = Get-ChildItem "hklm:\user\Software"
reg unload HKLM\user

If I choose not to do Get-ChildItem the registry unloads fine.

powershell
2 Answers

Just calling [gc]::collect() wasn't sufficient on my side, too. But a simple Start-Sleep afterwards did the trick:

reg load HKLM\user C:\Users\user\NTUSER.DAT
$result = Get-ChildItem "hklm:\user\Software"

[gc]::collect()
Start-Sleep -Seconds 2
reg unload HKLM\user
user_42484970
Related