PowerShell – Return LastWriteTime Registry Key

email me

$Namespace = "ReadRegDate"

Add-Type @"

using System;

using System.Text;

using System.Runtime.InteropServices;

$($Namespace | ForEach-Object {

"namespace $_ {"


public class advapi32 {

[DllImport("advapi32.dll", CharSet = CharSet.Auto)]

public static extern Int32 RegQueryInfoKey(

Microsoft.Win32.SafeHandles.SafeRegistryHandle hKey,

StringBuilder lpClass,

[In, Out] ref UInt32 lpcbClass,

UInt32 lpReserved,

out UInt32 lpcSubKeys,

out UInt32 lpcbMaxSubKeyLen,

out UInt32 lpcbMaxClassLen,

out UInt32 lpcValues,

out UInt32 lpcbMaxValueNameLen,

out UInt32 lpcbMaxValueLen,

out UInt32 lpcbSecurityDescriptor,

out System.Runtime.InteropServices.ComTypes.FILETIME lpftLastWriteTime



$($Namespace | ForEach-Object {




# Store the type in a variable:

$RegTools = ("{0}.advapi32" -f ($Namespace -join ".")) -as [type]

# Get a RegistryKey object (we need the handle)

$RegKey = Get-Item HKLM:\SOFTWARE

# Create any properties that we want returned:

$LastWrite = New-Object System.Runtime.InteropServices.ComTypes.FILETIME

# Call function:

$RegTools::RegQueryInfoKey($RegKey.Handle, $null, [ref] $null, $null, [ref] $null, [ref] $null, [ref] $null, [ref] $null, [ref] $null, [ref] $null, [ref] $null, [ref] $LastWrite)

# Convert to DateTime object:

$UnsignedLow = [System.BitConverter]::ToUInt32([System.BitConverter]::GetBytes($LastWrite.dwLowDateTime), 0)

$UnsignedHigh = [System.BitConverter]::ToUInt32([System.BitConverter]::GetBytes($LastWrite.dwHighDateTime), 0)

# Shift high part so it is most significant 32 bits, then copy low part into 64-bit int:

$FileTimeInt64 = ([Int64] $UnsignedHigh -shl 32) -bor $UnsignedLow

# Create datetime object




also see Notes in: C# – Return LastWriteTime Registry Key