Search notes:

reg.exe

Registry console tool: reg.exe allows to query the registry or set values in the registry from cmd.exe or PowerShell

Command line options

reg must be invoked with at least a word that indicates the desired operation to be performed.
reg understands the following operations

Creating a registry key

A registry key is created with reg /add:
C:\> reg add HKCU\path\to\key

Writing a value into the registry

The values below a key can also be created with reg /add. Additionally, the name of the value needs to be specified with the /v option, its value with the /d option and the data type with the /t option.
If the value already exists and should be overwritten, the /f (= force) option is also needed:
c:\> reg add HKCU\path\to\key /v nameOfValue /t dataType /d value /f
dataType is one of
In order to add a key's default value, the /ve (e for empty value name) must be passed:
reg add HKCU\path\to\key /ve /t REG_DWORD /d 42

Querying a specific value in the registry

reg query in combination with /v can be used to query for a specific value under a specific key in the registry.
The following command determines the (system wide) value of the PATH environment variable.
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PATH
Unfortunately, reg query also prints the key and data type of the queried value. In order to only print the value, the reg query might be combined with for /f "tokens=…" to extract the value only. On the command line, that would be:
for /f "tokens=2,* skip=2" %a in ('reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v TEMP') do echo %b
If this construct is used in a batch file, the percent signs need to be doubled (%%a and %%b instead of %a and %b), see for example regQuery.bat.

Recursively search for a specific values

reg query … /s allows to recursively search for a specific value under a given key.
The following command searches for any key (/k) under HKLM\SOFTWARE\Classes whose name contains key-value.
reg query HKLM\SOFTWARE\Classes /k /f key-value
If the search is to be restricted to values that contain a specific value, /d instead of /k should be used.
The asterisk (star) is recognized as a wild card.
The following example searches for all values that end in .wav under HKEY_CURRENT_USER\AppEvents\Schemes:
C:\> reg query HKEY_CURRENT_USER\AppEvents\Schemes /s /d /f "*.wav"

Escaping special characters

Apparently, apostrophes can be escaped with a backslash and percent signs can be escaped with a caret (^).

See also

regedit.exe, registry
regini.exe

Index