Query the registry on XP with REG QUERY  

Posted by ReelTym

What is Reg.exe?
Reg.exe is a command-line utility that can be used to edit the Windows registry. Using REG you can perform almost all tasks that can be done using the window-based Regedit.exe tool.
To run the REG command, open the Command Prompt window, type REG along with its argument, and press Enter. You can use the REG command to perform a number of registry related tasks. In this article, we will see how to query, add, and remove registry values.

Query Registry Keys
Using REG QUERY, you can:
  • Query a single key for a single value.
  • Query a range of registry keys for all their values.
Querying enables you to quickly check the value or values of a particular key.
REG QUERY Key_Name [/v Value_Name | /ve] [/s]
  • Key_Name must provide the full path to the key you need to query, represented by \\Computer_Name\Full_Key_Name. The Full_Key_Name comprises Root_Key\Sub_Key. Root_Key name may be HKLM, HKCU, HKCR, HKU, or HKCC. Sub_Key is the full name of the queried key under the Root_Key. Computer_Name is used when you are accessing a remote registry key to specify the name of the computer you are accessing.
  • /v enables you to query the specified registry key.
  • Value_Name is the name of the queried value under the registry key.
  • /ve helps you query the empty value name <no name> or the default value of the registry key.
  • /s enables you to query all subkeys and values under the specified registry key.
reg query hklm\software\McAfee

Add New Registry Keys
Using REG ADD, you can:
  • Add value to an existing registry key.
  • Add a new registry key without any values.
  • Create a new registry key and assign a value to it.
REG ADD Key_Name [/v Value_Name | /ve] [/t Type] [/s Separator] [/d Data] [/f]
  • Key_Name provides full path to the selected key and is represented by \\Computer_Name\Full_Key_Name. On remote computers, you can add keys under the HKLM and HKU root keys only.
  • /v is used to specify the Value_Name that you want to add under the selected key.
  • /ve enables you to add an empty value name <no name> value for the specified registry key.
  • /t is used to specify the data type of the new registry key–REG_SZ, REG_MULTI_SZ, REG_DWORD, REG_DWORD_BIG_ENDIAN, REG_DWORD_LITTLE_ENDIAN, REG_BINARY,REG_NONE, REG_EXPAND_SZ. The data type REG_SZ is assumed by default if you do not specify the data type in the command.
  • /s is used for REG_MULTI_SZ data types to specify the one character that you use as the separator in your data string. If not specified, “” is used as separator by default.
  • /d enables you to assign data to the Value_Name you are adding.
    /f enables you to forcefully overwrite the current registry entry without displaying the confirmation message.
reg add \HKLM\Software\MySoftware
The command adds the \HKLM\Software\MySoftware key in the registry .
reg add HKLM\Software\MySoftware /v Path /t REG_EXPAND_SZ /d %%systemroot%%
The command adds a value with the name Path, type REG_EXPAND, and data %systemroot% under the registry key HKLM\Software\MySoftware.

Remove a Registry Key
When you delete a registry key using the REG tool, all subkeys and values under this key are removed from the registry. However, the system will prompt you to confirm your decision before actually deleting any key. Using REG you can delete only those keys to which you are allowed to access.
REG DELETE Key_Name [/v Value_Name | /ve | /va] [/f]
  • Key_Name is represented by \\Computer_Name\Full_Key_Name. On remote computers, you can add keys under the HKLM and HKU root keys only.
  • Value_Name is the name of value under the selected key that you want to delete. If you do not include the Value_Name in the command all subkeys and values under the selected key are deleted.
  • /ve option enables you to delete the values of empty value name.
  • /va option enables you to delete all values under the specified key.
  • /f is used to delete the specified key without confirming your decision.
reg delete HKLM\Software\ABCsoftware
The command deletes all subkeys and values located under the ABCsoftware registry key.
REG provides you with an easy and quick way to perform various registry-related tasks. The main utilization of the REG command is to embed registry operations in batch files and logon scripts. Some of the command registry operations that you can perform using REG are, query, add, and remove registry keys. You may also use it to perform tasks such as update, copy, save, load, unload, backup, and restore registry keys.

This entry was posted on Friday, November 05, 2010 and is filed under . You can leave a response and follow any responses to this entry through the Subscribe to: Post Comments (Atom) .