Powershell: Get-Acl -LiteralPath does not find Registry key

[KalleOlaviNiemitalo]

Steps to reproduce

Get-Acl -LiteralPath "HKLM:Software\Classes\*"

Expected behavior

Path                                                                      Owner               Access
----                                                                      -----               ------
Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\Software\Classes\* NT AUTHORITY\SYSTEM BUILTIN\Users Allow  …

Actual behavior

Get-Acl: Cannot find path 'HKEY_LOCAL_MACHINE\Software\Classes\*' because it does not exist.

Environment data

Name                           Value
----                           -----
PSVersion                      7.0.0-rc.1
PSEdition                      Core
GitCommitId                    7.0.0-rc.1
OS                             Microsoft Windows 10.0.18363
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

[KalleOlaviNiemitalo]

Windows PowerShell 5.1 fails in the same way, so this does not appear to be a regression. Windows PowerShell 2.0 does not support Get-Acl -LiteralPath.

On PowerShell 7.0.0-rc.1, Get-Item -LiteralPath "HKLM:Software\Classes\*" finds the Registry key all right.

[SeeminglyScience]

Workaround:

# No literal path + escape wildcard character.
Get-Acl -Path 'HKLM:\SOFTWARE\Classes\`*'

[KalleOlaviNiemitalo]

Get-Acl -Path 'HKLM:\SOFTWARE\Classes\`*'

Process Monitor shows that this enumerates and opens many (presumably all) subkeys of HKLM:\SOFTWARE\Classes, so it is much slower than e.g. Get-Acl -Path 'HKLM:\SOFTWARE\Classes\.exe'.

[SeeminglyScience]

Yeah, just a workaround, not a solution. Still needs to be fixed for sure.

[Shriram0908]

@SeeminglyScience
I was checking the code and the point where the problem occurs at [AclCommand.cs line 828](https://github.com/PowerShell/PowerShell/blob/d1aa11e367581736ffea570722cee93815c07a41/src/Microsoft.PowerShell.Security/security/AclCommands.cs#L828). From this [page](https://docs.microsoft.com/en-us/powershell/scripting/developer/cmdlet/supporting-wildcard-characters-in-cmdlet-parameters?view=powershell-7) I can see that wildcard characters are not supported inLiteralPath. So my suggestion is to ignoreSessionState.Path.GetUnresolvedProviderPathFromPSPath()function as it may not even be required forLiteralPath`.
Please let me know what you think about it.

[SeeminglyScience]

@Shriram0908 They're not supported in that they don't expand. It works like you'd expect though:

$ExecutionContext.SessionState.Path.GetUnresolvedProviderPathFromPSPath('HKLM:Software\Classes\*')
# returns:
# HKEY_LOCAL_MACHINE\Software\Classes\*

It's needed to expand drive names, statically resolve . and .. for current directory/previous, etc. LiteralPath doesn't really mean literal path, it means "don't expand wildcards" (yeah I see the irony 🙂).

The problem is almost definitely in the RegistryProvider directly. It probably accidently reuses a helper method somewhere that tries to expand/remove/escape wildcard characters where it doesn't need to.

[Shriram0908]

@SeeminglyScience Thanks for explanation. Get-ACL -LiteralPath . I tried to run the command with that changes I made expecting it to fail but to my surprise it worked. I added few more breakpoints and found out that we were calling the function which resolves the drive name multiple times.
I have removed SessionState.Path.GetUnresolvedProviderPathFromPSPath() from Line 828 but the drive name resolution happens also happens when calling InvokeProvider.SecurityDescriptor.Get(rp, sections, context); at Line 859
Could you provide few more examples ? I tried the below command and it works.
```
PS C:> Get-ACL -LiteralPath \localhost\c$

Directory: \\localhost

Path Owner Access
---- ----- ------
c$ NT SERVICE\TrustedInstaller NT AUTHORITY\Authenticated Users Allow AppendData…

PS C:> Get-ACL -LiteralPath .

Directory:

Path Owner Access
---- ----- ------
C:\ NT SERVICE\TrustedInstaller NT AUTHORITY\Authenticated Users Allow AppendData…

PS C:> Get-ACL -LiteralPath ..

Directory:

Path Owner Access
---- ----- ------
C:\ NT SERVICE\TrustedInstaller NT AUTHORITY\Authenticated Users Allow AppendData…

PS C:> Get-Acl -LiteralPath "HKLM:Software\Classes*"

Path Owner Access
---- ----- ------
Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\Software\Classes* NT AUTHORITY\SYSTEM BUILTIN\Users Allow Rea…

PS C:> Get-ACL -LiteralPath c:\

Directory:

Path Owner Access
---- ----- ------
C:\ NT SERVICE\TrustedInstaller NT AUTHORITY\Authenticated Users Allow AppendData…

[vexx32]

@Shriram0908 make sure you test relative paths when the current location is the registry as well; e.g., Set-Location HKLM:\ followed by Get-Acl $relativePath

[Shriram0908]

@vexx32 It seems to work too.Shall I will raise a PR and add all the examples as pester test ?

[VIP21]

@SeeminglyScience Спасибо за объяснение. Get-ACL -LiteralPath .Я попытался выполнить команду с теми изменениями, которые я сделал, ожидая, что она потерпит неудачу, но, к моему удивлению, это сработало. Я добавил еще несколько точек останова и обнаружил, что мы вызываем функцию, которая разрешает имя диска несколько раз.
Я извлекал SessionState.Path.GetUnresolvedProviderPathFromPSPath()из линии 828 , но разрешение имен диска происходит также происходит при вызове InvokeProvider.SecurityDescriptor.Get(rp, sections, context);на линии 859
Не могли бы вы предоставить несколько примеров больше? Я попробовал приведенную ниже команду, и она работает.

PS C:\> Get-ACL -LiteralPath \\localhost\c$

    Directory: \\localhost

Path Owner                       Access
---- -----                       ------
c$   NT SERVICE\TrustedInstaller NT AUTHORITY\Authenticated Users Allow  AppendData…

PS C:\> Get-ACL -LiteralPath .

    Directory:

Path Owner                       Access
---- -----                       ------
C:\  NT SERVICE\TrustedInstaller NT AUTHORITY\Authenticated Users Allow  AppendData…

PS C:\> Get-ACL -LiteralPath ..

    Directory:

Path Owner                       Access
---- -----                       ------
C:\  NT SERVICE\TrustedInstaller NT AUTHORITY\Authenticated Users Allow  AppendData…

PS C:\> Get-Acl -LiteralPath "HKLM:Software\Classes\*"

Path                                                                      Owner               Access
----                                                                      -----               ------
Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\Software\Classes\* NT AUTHORITY\SYSTEM BUILTIN\Users Allow  Rea…

PS C:\> Get-ACL -LiteralPath c:\

    Directory:

Path Owner                       Access
---- -----                       ------
C:\  NT SERVICE\TrustedInstaller NT AUTHORITY\Authenticated Users Allow  AppendData…