9.6. Searching the Registry

Problem

You want to search the registry for the occurrence of a string or number.

Solution

Using a graphical user interface

  1. Open the Registry Editor (regedit.exe).

  2. In the left pane, browse to the key you want to search. If you want to search the entire registry, click on My Computer at the top.

  3. From the menu, select Edit Find.

  4. Enter the string you want to search with and select whether you want to search keys, values, or data.

  5. Click the Find Next button.

  6. If you want to continue searching after a match is found, either select Edit Find Next from the menu or press the F3 key.

Using a command-line interface

On Windows Server 2003, use the reg command to search the registry:

> reg query \\<ServerName>\<RegKey> /f <ValueName> /s /k 

For instance, the following command searches recursively under the specified registry key for all values that contain "Run":

> reg query \\server01\HKLM\Software\Microsoft /f Run /s /k

Replace the /k switch with /d to perform the same search, but matching only value data (and not key names). Run reg query /? for the complete list of search options.

The version of reg included with the Windows 2000 Resource Kit does not have all of the search capabilities of the one included with Windows Server 2003. But you can use the regfind utility from the Windows 2000 Resource Kit to perform similar searches. Here is the syntax:

> regfind -m \\<ServerName> -p <RegKey> -n "<ValueName>"

For example:

> regfind -m \\server01 -p HKEY_LOCAL_MACHINE\Software\Microsoft ...

Get Windows Server Cookbook now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.