$Namespace = "ReadRegDate" Add-Type @" using System; using System.Text; using System.Runtime.InteropServices; $($Namespace | ForEach-Object { "namespace $_ {" }) public class advapi32 { [DllImport("advapi32.dll", CharSet = CharSet.Auto)] public static extern Int32 RegQueryInfoKey( Microsoft.Win32.SafeHandles.SafeRegistryHandle hKey, StringBuilder lpClass, [In, Out] ref UInt32 lpcbClass, UInt32 lpReserved, out UInt32 lpcSubKeys, out UInt32 lpcbMaxSubKeyLen, out UInt32 lpcbMaxClassLen, out UInt32 lpcValues, out UInt32 lpcbMaxValueNameLen, out UInt32 lpcbMaxValueLen, out UInt32 lpcbSecurityDescriptor, out System.Runtime.InteropServices.ComTypes.FILETIME lpftLastWriteTime ); } $($Namespace | ForEach-Object { "}" }) "@ # Store the type in a variable: $RegTools = ("{0}.advapi32" -f ($Namespace -join ".")) -as [type] # Get a RegistryKey object (we need the handle) $RegKey = Get-Item HKLM:\SOFTWARE # Create any properties that we want returned: $LastWrite = New-Object System.Runtime.InteropServices.ComTypes.FILETIME # Call function: $RegTools::RegQueryInfoKey($RegKey.Handle, $null, [ref] $null, $null, [ref] $null, [ref] $null, [ref] $null, [ref] $null, [ref] $null, [ref] $null, [ref] $null, [ref] $LastWrite) # Convert to DateTime object: $UnsignedLow = [System.BitConverter]::ToUInt32([System.BitConverter]::GetBytes($LastWrite.dwLowDateTime), 0) $UnsignedHigh = [System.BitConverter]::ToUInt32([System.BitConverter]::GetBytes($LastWrite.dwHighDateTime), 0) # Shift high part so it is most significant 32 bits, then copy low part into 64-bit int: $FileTimeInt64 = ([Int64] $UnsignedHigh -shl 32) -bor $UnsignedLow # Create datetime object [datetime]::FromFileTime($FileTimeInt64)
Notes
also see Notes in: C# – Return LastWriteTime Registry Key