|
reg query /?
REG QUERY KeyName [/v [ValueName] | /ve] [/s]
[/f Data [/k] [/d] [/c] [/e]] [/t Type] [/z] [/se Separator]
[/reg:32 | /reg:64]
KeyName [\\Machine\]FullKey
Machine - Name of remote machine, omitting defaults to the
current machine. Only HKLM and HKU are available on
remote machines
FullKey - in the form of ROOTKEY\SubKey name
ROOTKEY - [ HKLM | HKCU | HKCR | HKU | HKCC ]
SubKey - The full name of a registry key under the
selected ROOTKEY
/v Queries for a specific registry key values.
If omitted, all values for the key are queried.
Argument to this switch can be optional only when specified
along with /f switch. This specifies to search in valuenames only.
/ve Queries for the default value or empty value name (Default).
/s Queries all subkeys and values recursively (like dir /s).
/se Specifies the separator (length of 1 character only) in
data string for REG_MULTI_SZ. Defaults to "\0" as the separator.
/f Specifies the data or pattern to search for.
Use double quotes if a string contains spaces. Default is "*".
/k Specifies to search in key names only.
/d Specifies the search in data only.
/c Specifies that the search is case sensitive.
The default search is case insensitive.
/e Specifies to return only exact matches.
By default all the matches are returned.
/t Specifies registry value data type.
Valid types are:
REG_SZ, REG_MULTI_SZ, REG_EXPAND_SZ,
REG_DWORD, REG_QWORD, REG_BINARY, REG_NONE
Defaults to all types.
/z Verbose: Shows the numeric equivalent for the type of the valuename.
/reg:32 Specifies the key should be accessed using the 32-bit registry view.
/reg:64 Specifies the key should be accessed using the 64-bit registry view.
Examples:
REG QUERY HKLM\Software\Microsoft\ResKit /v Version
Displays the value of the registry value Version
REG QUERY \\ABC\HKLM\Software\Microsoft\ResKit\Nt\Setup /s
Displays all subkeys and values under the registry key Setup
on remote machine ABC
REG QUERY HKLM\Software\Microsoft\ResKit\Nt\Setup /se #
Displays all the subkeys and values with "#" as the seperator
for all valuenames whose type is REG_MULTI_SZ.
REG QUERY HKLM /f SYSTEM /t REG_SZ /c /e
Displays Key, Value and Data with case sensitive and exact
occurrences of "SYSTEM" under HKLM root for the data type REG_SZ
REG QUERY HKCU /f 0F /d /t REG_BINARY
Displays Key, Value and Data for the occurrences of "0F" in data
under HKCU root for the data type REG_BINARY
REG QUERY HKLM\SOFTWARE /ve
Displays Value and Data for the empty value (Default)
under HKLM\SOFTWARE
|