Tips for Registry Editor Users

Several tips come to mind when using the Registry Editor:

• First, when saving a hive using Save Key (under the Registry menu), make absolutely sure that the filename saved to is descriptive enough to enable the successful restoration of the hive at a later time. The Registry Editor doesn't check whether a hive being restored is the same hive as the one being replaced.

• Second, as with the Registry Editor, be aware that printing can create reports of incredible size. Do not print the entire registry, especially if you are over the age of 22 or so life is just too short.

• Finally, the Registry Editor Save Subtree As functionality allows saving a detailed text report, identical to the printed report, to a disk file. This report can then be loaded into a text editor or word processor, allowing editing and printing.

Reg.exe

Reg.exe is a tool combining the functionality of a number of the other command-line-driven Windows NT 4 Resource Kit registry tools. Reg.exe is a standard part of Windows XP, and it is included in the Windows 2000 Resource Kit. It improves the interaction between the command line and the registry and is somewhat easier (and a whole lot more consistent) to use than the handful of other utilities. Note If you need to administer Windows 2000 machines as well, the Windows 2000 Resource Kit includes Reg. If you are still using older Resource Kit components in legacy support systems, there is no urgent need to change or migrate to the newer tools that are contained in the Windows Resource Kits. However, it is not recommended that the older utilities be used when updating support facilities, but that the new tools be integrated wherever possible. Many of the Resource Kit utilities are command-prompt driven. However, being experienced users, we are not afraid of a command prompt, are we? Reg.exe has the following functions:

• Add

• Backup (only found in versions prior to Windows 2000)

• Compare (only found in Windows 2000 versions and later)

• Copy

• Delete

• Export (only found in Windows 2000 versions and later)

• Import (only found in Windows 2000 versions and later)

• Load

• Query

• Restore

• Save

• Unload

• Update (only found in versions prior to Windows 2000)

In the following sections, I'll cover each of the functions, showing parameters and results as examples of how to use Reg.exe.

Add

The add function, invoked with the command reg add <options>, adds an object (key or value entry) to the registry. Options include the registry object to be added with the object's value, an optional machine name (additions may be made to remote registries), and an optional data type, as described next. The command line for add is:

REG ADD RegistryPath=value [data type][\\Machine]

As with other registry tools, the registry path may be a ROOTKEY or a hive (with or without a value entry). The ROOTKEY may be one of the following (HKLM is assumed if none is entered):

• HKLM (for HKEY_LOCAL_MACHINE)

• HKCU (for HKEY_CURRENT_USER)

• HKCR (for HKEY_CLASSES_ROOT)

• HKU (for HKEY_USERS)

• HKCC (for HKEY_CURRENT_CONFIG)

The hive is further qualified to determine the object to be added. The data type parameter is one of the following (the default, if the data type is not specified, is to use REG_SZ):

• REG_SZ

• REG_DWORD

• REG_EXPAND_SZ

• REG_MULTI_SZ

Here's an example of executing the add command:

Windows 8:56:09 C:\
   REG ADD HKLM\Software\MyCo\MyApp\Version=1.00
   The operation completed successfully.
   Windows 9:00:48 C:\
   REG query HKLM\Software\MyCo\MyApp\Version
   REG_SZ Version 1.00
 Windows 9:00:59 C:\

Backup

Backup is only found on Windows versions prior to Windows 2000, so this section is of concern only to those working with machines running Windows 95 or 98/Me. On versions of Windows that do not support Backup, including Windows XP, use the Save option instead of Backup. The backup function, invoked with the command reg backup <options>, saves the registry object specified to the file specified. Options include the registry path to be saved, the output filename, and an optional machine name (saves may be made on remote registries).

The command line for backup is:

REG BACKUP RegistryPath OutputFileName [\\Machine]

As with other registry tools, the registry path to be queried may be a ROOTKEY or a hive, with or without a value entry. The ROOTKEY may consist of one of the following (HKLM is assumed if none is entered):

• HKLM

• HKCU

• HKCR

• HKU

• HKCC

Only HKLM and HKU may be specified when copying objects to a remote registry. Note Notice that reg save and reg backup are identical in functionality. An example of executing the backup command is shown below. In this example, I've saved a small key to the file C:\Temp\MyCo.reg:

Windows 9:34:19 C:\
   REG backup HKLM\Software\MyCo\MyNewApp c:\temp\MyCo
   The operation completed successfully.
   Windows 9:34:21 C:\
   dir c:\temp\myco.*

Volume in drive C is (c) - Boot drive
Volume Serial Number is CC56-5631
Directory of c:\temp
07/17/99 09:34a 8,192 MyCo
1 File(s) 8,192 bytes
183,407,104 bytes free
Windows 9:34:27 C:\

Compare

The compare function, invoked with the command reg compare keyname1 keyname2 <options>, displays the value of an object (key or value entry) in the registry. A required parameter, keyname, specifies the object to be queried. Options include specifying a query for a specific registry, querying for the default value, and specifying that all subkeys and values be displayed. The command line for query is:

REG QUERY Keyname1 Keyname2 [/v valuename or /ve] [/oa | /od | /os | /on]
 [/s]

As with other registry tools, the registry path may be a ROOTKEY or a hive (with or without a value entry). The ROOTKEY may be one of the following (HKLM is assumed if none is entered):

• HKLM

• HKCU

• HKCR

• HKU

• HKCC

The hive is further qualified to determine the object to be added. Remote registry comparisons may be done; simply specify the keyname as \machine\keyname.

Copy

The copy function, invoked with the command reg copy <options>, copies the registry object specified to a new name. Options include the registry path to be copied (the source) and a destination name.

The command line for copy is:

REG COPY OldPath [\\Machine] Newpath [\\Machine]

As with other registry tools, the registry path to be copied (both the old path and the new path) may be a ROOTKEY or a hive. The path may be specified with or without a value entry. The ROOTKEY may consist of one of the following (HKLM is assumed if none is entered):

• HKLM

• HKCU

• HKCR

• HKU

• HKCC

Only HKLM and HKU may be specified when copying objects to a remote registry. Note Consider the case where a registry object is copied from one registry to another registry on a different machine. This command is more powerful than is apparent at first glance. The hive may be further qualified to determine the contents of a specific key or value entry. If no value entry is specified, all the value entries in the key will be copied. Here's an example of executing the copy command:

Windows 9:10:52 C:\
   REG query HKLM\Software\MyCo\MyApp\
   Listing of [Software\MyCo\MyApp\]
   REG_SZ Version 1.00
   Windows 9:15:18 C:\
   REG copy HKLM\Software\MyCo\MyApp\ HKLM\Software\MyCo\MyNewApp
   The operation completed successfully.
   Windows 9:15:43 C:\
   REG query HKLM\Software\MyCo\MyNewApp
   Listing of [Software\MyCo\MyNewApp]
   REG_SZ Version 1.00
 Windows 9:15:51 C:\

Delete

The delete function, invoked with the command reg delete <options>, deletes the specified registry object. Options include the registry path to be deleted, an optional machine name (queries may be made on remote registries), and an optional parameter, /F, that forces the deletion without recourse. The command line for delete is:

REG DELETE RegistryPath [\\Machine] [/F]\

As with other registry tools, the registry path to be queried may be a ROOTKEY or a hive (with or without a value entry). The ROOTKEY may consist of one of the following (HKLM
   is assumed if none is entered):
   
     

• HKLM
   
     
• HKCU
   
     
• HKCR
   
     
• HKU
   
     
• HKCC
   
     Only HKLM and HKU may be specified when deleting objects from a remote registry. The hive deletion may be forced by using the /F option, which forces the deletion without any
   
   prompt or confirmation. Microsoft recommends that the /F option be used only with extreme care. I agree.
 
   An example of executing the delete command is shown next. Notice that I had to respond with
 
   a y to the prompt to delete the specified object.
 
   Windows 9:05:30 C:\
 
   REG query HKLM\Software\MyCo\MyApp\Version
 
   REG_SZ Version 2.00
 
   Windows 9:09:30 C:\
 
   REG delete HKLM\Software\MyCo\MyApp\Version
 
   Permanently delete registry value Version (Y/N)? y
 
   The operation completed successfully.
 
   Windows 9:09:40 C:\
 
   REG query HKLM\Software\MyCo\MyApp\Version
 
   The system was unable to find the specified registry key.
 
   Windows 9:09:43 C:\