WMI Getting Registry Value via Command Prompt - cmd

Question

I need to verify if a chrome extension is installed or not installed on remote computers.
Extension id is unique value like that "234aljksdfklja3idffklsasf".
I need to search "HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\PreferenceMACs\Default\extensions.settings"
direction for extension id "234aljksdfklja3idffklsasf"
How to do that?
i think i will use code below but i need some help
WMIC /NameSpace:\root\default Class StdRegProv ....

Answer 1

Instead of WMIC, you should use the REG cmd, it's made to do this.
The HKCU is whatever the user running the command's registry key is.
Reg allows you to load and check the registry keys of any users not just the one running the command, even users who have not logged in since the last reboot.
Since this is a chrome extension you may need to check every used on the system to see if each has it enabled individually.
Alternatively there is probably an HKLM key that corresponds to the extension being installed, if all you want to know is if it's present at all so it can be removed.
Reg also allows you to query your computers through the network.
One issue you will have if you need to check every user's registry for the key is you need to know what the user's SIDs present on the systen are.
This is findable by querying HKLM, but I am on mobile and can't recall how without getting on my computer later to do this.
Alternatively you can also just load the reg hive file by looping the fire tory structure of the remote machine and loading each user.dat file through the reg command which is much simpler but then the code must execute on each remote machine through a login script or GPO script push.
Basically you can use reg in this manner on a local machine to check the reg of the user you are running as (HKCU)
(reg query "HKCU\SOFTWARE\Google\Chrome\PreferenceMACs\Default\extensions.settings" /s | FIND /I "234aljksdfklja3idffklsasf") && Echo.FOUND 234aljksdfklja3idffklsasf
Of course to run on another computer it's fairly simple to do, but HKCU will be the reg of the admin user you ran the command as with access to that other system, or you can try HKLM to see if that setting exists on the local machine key, which the following checks HKLM instead.
(reg query \\[Computer_Name_or_IP_Address]\hklm\SOFTWARE\Google\Chrome\PreferenceMACs\Default\extensions.settings /s | FIND /I "234aljksdfklja3idffklsasf") && Echo.FOUND 234aljksdfklja3idffklsasf
You could loop a set of computer names/IPs and check each using the above command inside the loop like so:
FOR %A IN (
Computer_A
192.168.12.13
192.168.12.31
Computer_C
) DO (
(
reg query \\%~A\hklm\SOFTWARE\Google\Chrome\PreferenceMACs\Default\extensions.settings /s | FIND /I "234aljksdfklja3idffklsasf"
) && Echo.%~A -- FOUND 234aljksdfklja3idffklsasf || ECHO.%~A -- Key Not Found!
)
If you need to check the actual HKCU of every used on the system then you need to load each reg hive on the system and check it, this is true if you use WMIC as well, and Reg is faster.
From the MS reg page:
reg query <KeyName> [{/v <ValueName> | /ve}] [/s] [/se <Separator>] [/f <Data>] [{/k | /d}] [/c] [/e] [/t <Type>] [/z]

Answer 2

i got one more solution to this situation. But only works if extension is packed. Btw this solution also doesnt solve my problem because my extension is unpacked.
Packeted extensions are stored "AppData\Local\Google\Chrome\User Data\Default\Extensions".
wmic /node:remoteip datafile where "name='C:\Users\username\AppData\Local\Google\Chrome\User Data\Default\Extensions\extensionid\1.0.4_0\manifest.json'"
if extension installed command returns manifest.json file specs.

Answer 3

I got the solution;
wmic /node:ipaddr /NAMESPACE:"\\root\DEFAULT" class stdregprov call GetStringValue ^&H80000001,"SOFTWARE\Google\Chrome\PreferenceMACs\Default\extensions.settings","extensionid"
On localhost, it works but on remote computers access denied.