Windows – Search and replace registry entry value using powershell

Use REG ADD with the "/f" parameter to force overwrite.

REG ADD /? explains the parameters.

REG ADD KeyName [/v ValueName | /ve] [/t type] [/s Separator] [/d Data] [/f]

KeyName     [\\Machine\]FullKey

Machine     Name of remote machine - omitting defaults to the current machine 
            Only HKLM and HKU are available on remote machines
FullKey     ROOTKEY\SubKey ROOTKEY [ HKLM | HKCU | HKCR | HKU | HKCC ] SubKey 
            The full name of a registry key under the selected ROOTKEY
/v          The value name, under the selected Key, to add
/ve         adds an empty value name <no name> for the key
/t          RegKey data types
            [ REG_SZ | REG_MULTI_SZ | REG_DWORD_BIG_ENDIAN | REG_DWORD | 
              REG_BINARY | REG_DWORD_LITTLE_ENDIAN | REG_NONE | REG_EXPAND_SZ ]
            If omitted, REG_SZ is assumed
/s          Specify one character that you use as the separator in your data 
            string for REG_MULTI_SZ. If omitted, use "\0" as the separator
/d          The data to assign to the registry ValueName being added
/f          Force overwriting the existing registry entry without prompt

To insert a new value or toggle a string value from "false" to "true", use a command like this:

reg add HKCU\Software\Citrix\Receiver /t REG_SZ /v UpgradeDone /d true /f

Example which reads an existing value and appends some string before writing it back:

set append=XXXXXX
set key=HKCU\Software\myTest
set value=myValue
set oldVal=

for /F "skip=2 tokens=3" %%r in ('reg query %key% /v %value%') do set oldVal=%%r
echo previous=%oldVal%

set newVal=%oldVal%%append% 

reg add %key% /v %value% /d %newVal% /f

Note: This sample assumes that the old value and the new value have no blanks. Otherwise one has to add quotes and change the "tokens" parameter. Extra error checking omitted for brevity. However, all registry manipulating code definitely must do adequate error checking.

Indeed I found two methods. One using CMD-R to run some windows magic, and another by setting the PATH value to null with ('').

However, apparently there is another registry item containing the path in hex encoded form, in HKCU:\Control Panel\Desktop\TranscodedImageCache, that you can see by the rudimentary hex conversion.

# Set the wallpaper PATH to ''
$key = 'HKCU:\Control Panel\Desktop'
Set-ItemProperty -Path $key -Name 'WallPaper' -Value ''

# Re-start windows Explorer:
Stop-Process -ProcessName explorer

# Using `CMD+R` and run : 
shell:::{ED834ED6-4B5A-4bfe-8F11-A626DCB6A921} -Microsoft.Personalization\pageWallpaper

# Getting the "Transcoded" PATH:
$TIC=(Get-ItemProperty 'HKCU:\Control Panel\Desktop' TranscodedImageCache -ErrorAction Stop).TranscodedImageCache
[System.Text.Encoding]::Unicode.GetString($TIC) -replace '(.+)([A-Z]:[0-9a-zA-Z\\])+','$2'

#C:\Windows\Web\Wallpaper\Windows\_img0.jpg

Also related to this answer.

• You need to restart windows explorer.exe (use Sysinternal's Process Explorer or PS with: Stop-Process -ProcessName explorer) in order for registry changes to take effect.

UPDATE: 2020-01-09

• You don't need to re-start explorer, nor compile anything via PoweShell, ... almost. From THIS blog and this SESU answer, I found a fantastic one-liner:

add-type -typedefinition "using System;`n using System.Runtime.InteropServices;`n public class PInvoke { [DllImport(`"user32.dll`")] public static extern bool SetSysColors(int cElements, int[] lpaElements, int[] lpaRgbValues); }"

# Now to get your desktop to instantly turn purple, run it with:
[PInvoke]::SetSysColors(1, @(1), @(0xAA40C0))
# Or tack it on the end of above for a true one-line experience.

Notes from author: "This doesn't affect the Registry, so if you want the change to stick, you need to also write the new data to Registry yourself."