Read, Set or Delete registry keys and values, save and restore from a .REG file.
Syntax:
REG QUERY [ROOT\]RegKey /v ValueName [/s]
REG QUERY [ROOT\]RegKey /ve --This returns the (default) value
REG ADD [ROOT\]RegKey /v ValueName [/t DataType] [/S Separator] [/d Data] [/f]
REG ADD [ROOT\]RegKey /ve [/d Data] [/f] -- Set the (default) value
REG DELETE [ROOT\]RegKey /v ValueName [/f]
REG DELETE [ROOT\]RegKey /ve [/f] -- Remove the (default) value
REG DELETE [ROOT\]RegKey /va [/f] -- Delete all values under this key
REG COPY [\\SourceMachine\][ROOT\]RegKey [\\DestMachine\][ROOT\]RegKey
REG EXPORT [ROOT\]RegKey FileName.reg
REG IMPORT FileName.reg
REG SAVE [ROOT\]RegKey FileName.hiv
REG RESTORE \\MachineName\[ROOT]\KeyName FileName.hiv
REG LOAD FileName KeyName
REG UNLOAD KeyName
REG COMPARE [ROOT\]RegKey [ROOT\]RegKey [/v ValueName] [Output] [/s]
REG COMPARE [ROOT\]RegKey [ROOT\]RegKey [/ve] [Output] [/s]
Key:
ROOT :
HKLM = HKey_Local_machine (default)
HKCU = HKey_current_user
HKU = HKey_users
HKCR = HKey_classes_root
ValueName : The value, under the selected RegKey, to edit.
(default is all keys and values)
/d Data : The actual data to store as a "String", integer etc
/f : Force an update without prompting "Value exists, overwrite Y/N"
\\Machine : Name of remote machine - omitting defaults to current machine.
Only HKLM and HKU are available on remote machines.
FileName : The filename to save or restore a registry hive.
KeyName : A key name to load a hive file into. (Creating a new key)
/S : Query all subkeys and values.
/S Separator : Character to use as the separator in REG_MULTI_SZ values
the default is "\0"
/t DataType : REG_SZ (default) | REG_DWORD | REG_EXPAND_SZ | REG_MULTI_SZ
Output : /od (only differences) /os (only matches) /oa (all) /on (no output)
Notes:
Any of the above commands can be run against a remote machine by adding \\MachineName to the command line, assuming the Remote Registry Service is running.
Registry data stored under HKCU will be visible and writable by the currently logged in user.
Registry data stored under HKLM will be visible to all users and writable by administrators.
To include a quote mark (") in the data, prefix it with the escape character (\) e.g. "Here is \" a quote"
Enclose ValueNames that contain the \ character in single quotes.
REG RESTORE has a tendency not to work, possibly due to firewall issues, Export and Import are much more reliable.
Examples
REG QUERY HKCU\Console\ REG QUERY HKCU\Console /v ScreenBufferSize REG ADD HKCU\Software\SS64 /v Sample /d "some test data" REG QUERY HKCU\Software\SS64 /v Sample REG ADD HKLM\Software\DiLithium /v WarpSpeed /t REG_BINARY /d ffffffff REG QUERY HKLM\Software\DiLithium /v WarpSpeed REG COPY \\Wks580\HKCU\Software\SS64 HKCU\Software\SS64 REG COPY HKCU\Software\SS64 HKCU\Software\SS64Copy REG EXPORT HKCU\Software\SS64 C:\MyReg.REG REG IMPORT C:\MyReg.REG REG SAVE HKCU\Software\SS64 C:\MyRegHive.hiv REG RESTORE \\Wks580\HKCU\Software\SS64 C:\MyRegHive.hiv
Change the default user profile: (temporarily load it as ZZZ)
REG LOAD HKU\ZZZ "C:\Documents and Settings\Default User\NTUSER.DAT" REG ADD HKU\ZZZ\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v newUserProfile /t REG_EXPAND_SZ /d "D:\setup.cmd" /f REG UNLOAD HKU\ZZZ
More examples are available via: REG QUERY /? REG ADD /? etc
"The way to a mans heart is through his stomach" - Fanny
Fern (writer)
Related Commands:
SETX - Set environment variables permanently, can also
read a registry key and write the value to a text file.
REGEDIT - Load Registry settings from a .REG file
Dureg - Registry Size Estimator. (Win 2K
ResKit)
Q945219 - Reg.exe fails for REG_EXPAND_SZ registry types
Q948698 - Remote access to 64-bit registry keys
