Read, Set or Delete registry keys and values, save and restore from a .REG file.


   REG QUERY [ROOT\]RegKey /v ValueName [/s]
   REG QUERY [ROOT\]RegKey /ve  --This returns the (default) value
   REG ADD [ROOT\]RegKey /v ValueName [/t DataType] [/S Separator] [/d Data] [/f]
   REG ADD [ROOT\]RegKey /ve [/d Data] [/f]  -- Set the (default) value

   REG DELETE [ROOT\]RegKey /v ValueName [/f]
   REG DELETE [ROOT\]RegKey /ve [/f]  -- Remove the (default) value
   REG DELETE [ROOT\]RegKey /va [/f]  -- Delete all values under this key

   REG COPY  [\\SourceMachine\][ROOT\]RegKey [\\DestMachine\][ROOT\]RegKey

   REG EXPORT [ROOT\]RegKey FileName.reg
   REG IMPORT FileName.reg
   REG RESTORE \\MachineName\[ROOT]\KeyName
   REG LOAD KeyName FileName
   REG COMPARE [ROOT\]RegKey [ROOT\]RegKey [/v ValueName] [Output] [/s]
   REG COMPARE [ROOT\]RegKey [ROOT\]RegKey [/ve] [Output] [/s]

   ROOT :
         HKLM = HKey_Local_machine (default)
         HKCU = HKey_current_user
         HKU  = HKey_users
         HKCR = HKey_classes_root

   ValueName : The value, under the selected RegKey, to edit.
               (default is all keys and values)

   /d Data   : The actual data to store as a "String", integer etc

   /f        : Force an update without prompting "Value exists, overwrite Y/N"

   \\Machine : Name of remote machine - omitting defaults to current machine.
         	    Only HKLM and HKU are available on remote machines.

   FileName  : The filename to save or restore a registry hive.

   KeyName   : A key name to load a hive file into. (Creating a new key)

   /S        : Query all subkeys and values.

   /S Separator : Character to use as the separator in REG_MULTI_SZ values
                  the default is "\0" 

   /t DataType  : REG_SZ (default) | REG_DWORD | REG_EXPAND_SZ | REG_MULTI_SZ

   /reg:32   : Force REG.exe to write to the 32-bit registry location
   /reg:64   : Force REG.exe to write to the 64-bit registry location

             By default a 32-bit process (such as an SCCM client or a 32 bit MSI installer)
             on a 64 bit machine, will use a 32-bit view of the registry: HKLM\SOFTWARE\Wow6432Node
             Use the /REG switch to over-ride this.

   Output    : /od (only differences) /os (only matches) /oa (all) /on (no output)

Any of the above commands can be run against a remote machine by adding \\MachineName to the command line, assuming the Remote Registry Service is running.
Registry data stored under HKCU will be visible and writable by the currently logged in user.
Registry data stored under HKLM will be visible to all users and writable by administrators.

REG RESTORE has a tendency not to work, possibly due to firewall issues, Export and Import are much more reliable.

Backslash characters

The REG command will interpret \ as an escape for the character that immediately follows it.
To include a quote mark (") in the data, prefix it with the escape character e.g. Here is \" a quote

This can cause problems with quoted directory paths because \" at the end of the line will be escaped.

To save a directory path with a trailing backslash (\) requires adding a second backslash to 'escape the escape'
so for example instead of "C:\My Docs\" use "C:\My Docs\\"


To activate registry changes in HKEY_CURRENT_USER without logging off:
RUNDLL32.EXE USER32.DLL,UpdatePerUserSystemParameters ,1 ,True


Adding and querying data:

REG QUERY HKCU\Console /v ScreenBufferSize
REG ADD HKCU\Software\SS64 /v Sample /d "some test data"
REG QUERY HKCU\Software\SS64 /v Sample

REG ADD HKLM\Software\DiLithium /v WarpSpeed /t REG_BINARY /d ffffffff
REG QUERY HKLM\Software\DiLithium /v WarpSpeed

Find the location of the Start Menu folder:

REG QUERY "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "Start Menu"

List IE Proxy overrides:

REG QUERY "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyOverride

Save a directory/registry path that ends with a backslash:

Set _reg=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SS64.EXE\
Set _prog=C:\Program Files\SS64 App\
REG ADD "%_reg%\" /f /v "SS64.EXE" /t REG_SZ /d "%_prog%\"

Save a REG_Expand_SZ value of %systemroot%

REG ADD HKLM\Software\SS64 /v Path /t REG_EXPAND_SZ /d ^%systemroot^%

REG COPY \\Wks580\HKCU\Software\SS64 HKCU\Software\SS64
REG COPY HKCU\Software\SS64 HKCU\Software\SS64Copy

REG SAVE HKCU\Software\SS64 C:\
REG RESTORE \\Wks580\HKCU\Software\SS64 C:\

Run a script at first logon (Run Once) to do this we edit the Default User profile by temporarily loading it as ZZZ:

REG LOAD HKU\ZZZ "C:\Documents and Settings\Default User\NTUSER.DAT"
REG ADD HKU\ZZZ\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v newUserProfile /t REG_EXPAND_SZ /d "D:\setup.cmd" /f

More examples are available via: REG QUERY /? REG ADD /? etc

"The way to a mans heart is through his stomach" ~ Fanny Fern (writer)


SETX - Set environment variables permanently, can also read a registry key and write the value to a text file.
REGEDIT - Load Registry settings from a .REG file
Dureg - Registry Size Estimator. (Win 2K ResKit)
Powershell: Get-ItemProperty / Set-ItemProperty - Retrieve / save registry Keys
Q948698 - Remote access to 64-bit registry keys /reg:64 switch
Q325347 - Run a Logon Script once when a new user logs on, Windows 2003
Q945219 - Reg.exe fails for REG_EXPAND_SZ registry types

© Copyright 1999-2015
Some rights reserved