Adds, modifies and displays registry key information and entry values
register.
Adds, modifies and displays registry key information and entry values
register.
Our resource already has a publication describing the main way to work with the Windows system registry: Changing the settings of the Windows system registry. We also considered a way to automate the process using special files: Creating reg files. Syntax for editing registry entries – which greatly simplifies the monotonous work and reproduction of frequently used settings. In this article, we will touch on the logical continuation of the topic, namely, we will talk about how to edit the registry from the command line.
Reg query
Returns a list of the next level of nested sections and entries found in the section
register.
Syntax
Specifies the full path to the partition. For remote computers, before the path to the partition in the format
\computer_name path_to_subkey is inserted the name of the computer. If
the computer_name parameter is not set, the default operation is performed on the local
computer. The path should start from the appropriate subtree. Allowed subtrees
are HKLM, HKCU, HKCR, HKU and HKCC. If given
remote computer, only the HKLM and HKU subtrees can be used.
Returns the entry and its value. This parameter returns only records that are
located directly below the given section. Entries from nested sections,
below the current section are not displayed. If record_name is omitted, then
all records in the given section are returned.
Specifies only those entries that have no value.
Returns all sections and entries in all levels. Without this parameter, only
the next level of sections and entries.
Display help on the command line.
Examples
The following are examples of using the reg query command.
reg query “hklmsystemcurrentcontrolsetcontrolsession manager”
/vmaxstacktracedepth
reg query “hkcusoftwaremicrosoftwinmine” /s
reg query “hklmsystemcurrentcontrolsetcontrolsession manager”
/v maxstacktracedepth
reg query “hkcusoftwaremicrosoftwinmine” /s
To be more precise, we, of course, will not manually enter the necessary parameters in the console window over and over again, this method is not needed for this, we will consider the option of making changes to the Windows system registry using bat files.
The creation and use of batch files was discussed in sufficient detail in the entry Batch files (bat, batch files) Windows, another function that can and should be used is changing registry entries using the cmd language.
Using batch files to edit the registry can sometimes be more profitable and more convenient than working with standard reg files for these purposes.
Changing the registry settings of a computer on the network
Above, we have considered the fairly wide possibilities of batch files in working with the registry of the operating system. The last point that we note in the context of this topic is editing the registry of computers on the local network.
And most importantly: in order to work with the registry of a computer on the network, you must specify the name of the remote machine starting with a double backslash in the command being used before the section.
At the same time, in commands that process several sections at once (for example, copying from one section to another, comparing branches), one of the branches can be located on the local computer, and the other on the computer on the network.
That is, to copy a branch from a remote machine to our computer, you need to execute the following command:
On this, the final article describing the general principles of working with the computer registry and with bat-files can be considered completed.
Unmistakable commands and correct registry keys for you.
Reg load
Writes saved keys and entries to another registry key. It is assumed that this
will be a temporary file for troubleshooting or editing registry entries.
reg load section_name file_name
Parameters
Sets the path and file name to be loaded. This file must be created in advance with
using the reg save operation and with the .hiv extension.
The following are examples of using the reg load command.
reg load “hkcusoftwaremicrosoftwinminebk2” wmbkup.hiv
Reg compare
Compares the specified sections or registry entries.
Specifies the full path to the partition. For remote computers, the computer name is inserted before
path to the partition in the format \computer_name path_to_partition. If the parameter
computer_name is not set, the default operation is performed on the local
computer. The path should start from the appropriate subtree. Allowed subtrees
are HKLM, HKCU, HKCR, HKU and HKCC. If given
remote computer, only the HKLM and HKU subtrees can be used.
Compares a special section entry.
Sets to compare only those records that have no value.
Specifies whether differences and matches are output. The default is /od.
Compares all sections and entries.
The following are examples of using the reg compare command.
reg compare “hkcusoftwaremicrosoftwinmine” “hkcusoftwaremicrosoftwinmine” /od /s
Copies a registry entry to the specified directory on the local or remote computer.
Sets the full path to the partition to be copied. For remote computers before the path to
section in the format \computer_name_path_to_partition, the name is inserted
computer. If the computer_name parameter is not specified, the default operation
running on the local computer. The path should start from the appropriate subtree.
Valid subtrees are HKLM, HKCU, HKCR, HKU, and
HKCC. If a remote computer is specified, then only subtrees can be used
HKLM and HKU.
Specifies the full path to the destination partition. For remote computers before the path to
section in the format \computer_name_path_to_partition, the name is inserted
computer. If the computer_name parameter is not specified, the default operation
running on the local computer. The path should start from the appropriate subtree.
Valid subtrees are HKLM, HKCU, HKCR, HKU, and
HKCC. If a remote computer is specified, then only subtrees can be used
HKLM and HKU.
Copies all nested sections and entries of the specified section.
Copies a section without asking for confirmation.
The following are examples of using the reg copy command:
reg copy “hkcusoftwaremicrosoftwinmine” “hkcusoftwaremicrosoftwinminebk” /s /f
reg copy “hkcusoftwaremicrosoftwinminebk” “hkcusoftwaremicrosoftwinmine” /s
Reg restore
Writes saved subkeys and entries back to the registry key.
reg restore partition_name file_name
Specifies the full path to the partition. The restore operation only works on the local
computer. The path should start from the appropriate subtree. Allowed subtrees
are HKLM, HKCU, HKCR, HKU and HKCC.
Specifies the path and file name to be written back to the registry. The file must be created
in advance using the reg save operation with the .hiv extension.
The following are examples of using the reg restore command.
reg restore “hkcusoftwaremicrosoftwinmine” wmbkup.hiv
Saves copies of the specified keys, entries, and registry values in the specified file.
reg save partition_name file_name
Specifies the full path to the partition. For remote computers, before the path to the partition in the format
\computer_name path_to_subkey is inserted the name of the computer. If
the computer_name parameter is not set, the default operation is performed on the local
computer. The path should start from the appropriate subtree. Allowed subtrees
are HKLM, HKCU, HKCR, HKU and HKCC.
Sets the path and file name to be created. If no path is given, the current path is used.
path.
The following are examples of using the reg save command.
reg save “hkcusoftwaremicrosoftwinmine” wmbkup.hiv
Removes a registry key loaded using the reg load operation.
reg unload partition_name
The following are examples of using the reg unload command.
reg unload “hkcusoftwaremicrosoftwinminebk2”
For questions, discussions, comments, suggestions, etc., you can use
forum section
this site (registration required).
A new section on command line tools within the same project is located
here
Reg delete
Deletes a registry key or entries.
Deletes a chapter entry. If the entry is not set, then all entries and nested entries will be deleted.
sections of this section.
Sets to delete only those records that have no value.
Deletes all entries in the specified section. This option does not remove nested sections in
given section.
Deletes an existing registry key or entry without asking for confirmation.
The following are examples of using the reg delete command.
reg delete “hkcusoftwaremicrosoftwinmine” /v Name1
reg delete “hkcusoftwaremicrosoftwinmine” /v Time1
reg delete “hkcusoftwaremicrosoftwinmine” /va
Reg add
Adds a new key or new entry to the registry.
Specifies the full path to the partition. For remote computers, before the path to the partition in the format
\computer_name path_to_partition the computer name is inserted. If the parameter
computer_name is not set, the default operation is performed on the local
computer. The path should start from the appropriate subtree. Allowed subtrees
are HKLM, HKCU, HKCR, HKU and HKCC.
Specifies the entry name to add to the specified section.
Sets the value of the entry to be added to the registry to zero.
Sets the data type for the entry value. The datatype parameter can be one of
the following values:
Sets characters to separate copies of data. Used when setting REG_MULTI_SZ in
as a data type and when placing more than one entry in the list. If the separator is not
is specified, the default delimiter is used.
Sets the value for the new registry entry.
Adds a section or entry without asking for confirmation.
The following are examples of using the reg add command.
reg add hklmsoftwaremyco /v data /t reg_binary /d fe340ead
reg add “hkcusoftwaremicrosoftwinmine” /v Name3 /t reg_sz /d Anonymous
reg add “hkcusoftwaremicrosoftwinmine” /v Time3 /t reg_dword /d 5
Returns a list of the next level of nested sections and entries found in the section
register.
Specifies the full path to the partition. For remote computers, before the path to the partition in the format
\computer_name path_to_subkey is inserted the name of the computer. If
the computer_name parameter is not set, the default operation is performed on the local
computer. The path should start from the appropriate subtree. Allowed subtrees
are HKLM, HKCU, HKCR, HKU and HKCC. If given
remote computer, only the HKLM and HKU subtrees can be used.
Returns the entry and its value. This parameter returns only records that are
located directly below the given section. Entries from nested sections,
below the current section are not displayed. If record_name is omitted, then
all records in the given section are returned.
Returns all sections and entries in all levels. Without this parameter, only
the next level of sections and entries.
reg query “hklmsystemcurrentcontrolsetcontrolsession manager”
/vmaxstacktracedepth
Working with the registry from the command line
The syntax of bat files and the process of their creation are described in the article cited above, in this publication we will only touch on the topic related to the execution of the registry change function from the command line.
We note right away that bat files do not require a header at the beginning of the file, similar to what is used in reg files: Windows Registry Editor Version 5.00 – here you can start writing a command from the very first line.
First, here are the main parameters used when working with the registry from the command line:
But, of course, the basis of any Windows batch file is the command itself. So, here is a list of commands used to edit the registry.
– a command for adding data, be it parameters, keys or entire branches.
Suppose, after a virus attack, we need to return the storage location of the hosts file (as well as the lmhosts, networks and protocols files) to the %SystemRoot%System32driversetc directory To do this, execute the command:
reg add HKLMSYSTEMCurrentControlSetServicesTcpipParameters /v DataBasePath /t REG_EXPAND_SZ /d %%SystemRoot%%System32driversetc /f
If you apply a little imagination and arrange a batch file, then the code will look something like this:
Here is a file like in the archive, we will get it: drivers_etc
The remaining examples in this article will be fictitious, so that when testing them, we will not make unwanted changes to the registry
– command to remove the specified information from the computer registry.
To remove a certain parameter, we just need to specify its full path after the delete command. Example:
This command will remove the Save parameter from the specified branch.
– command for copying parameters and keys from one registry branch to another.
To copy the parameters, it is enough after the command to sequentially register first the original branch, and then the modified one. For example:
– command to export specified registry branches as *.reg file to hard drive.
Usage example:
reg export HKLMSoftwareGamesFootball MyBackup.reg
As a result of executing this command, a reg file with a backup of the Football section will be created.
– a command that allows you to import data from a .reg file into the system registry.
Usage example:
reg import MyBackup.reg
As a result of executing this command, entries from the reg file will be imported into the registry.
– this command returns the value of the requested parameters and registry hives.
Usage example:
reg query HKLMSoftwareGamesFootball /v Run
The value of the Run parameter in the registry will be returned in response.
– the command allows you to compare two consecutive registry branches.
Usage example:
In response, the command returns one of the following values: 0 – these branches are identical; 1 – an error occurred while performing the operation; 2 – these branches are different.
, , , are commands that allow you to backup and restore the necessary branches of the Windows system registry using *.hiv files.
Reg export
Creates a copy of the given sections, entries, or values in a file that can be sent to
other servers.
reg export section_name file_name
Specifies the full path to the partition. The export operation only works on the local
computer. The path starts from the corresponding subtree. Allowed subtrees
are HKLM, HKCU, HKCR, HKU and HKCC.
Sets the name and path of the exported file. The file must have the .reg extension.
The following are examples of using the reg export command.
reg export “hkcusoftwaremicrosoftwinmine” c:data
egbackupswmbkup.reg
Copies keys, entries and values from the exported registry to the local registry
computer.
reg import filename
Specifies the name and path of the file to be copied to the registry of the local computer. pre-s
using the reg export operation, this file must be created.
The following are examples of using the reg import command.
reg import “hkcusoftwaremicrosoftwinmine” c:data
egbackupswmbkup.reg
Deletes a section entry. If the entry is not set, then all entries and nested entries will be deleted.
sections of this section.
Deletes all entries in the specified section. This option does not remove nested sections in
given section.
reg delete “hkcusoftwaremicrosoftwinmine” /v Name1
reg delete “hkcusoftwaremicrosoftwinmine” /v Time1
reg delete “hkcusoftwaremicrosoftwinmine” /va
Writes saved keys and entries to another registry key. It is assumed that this
will be a temporary file for troubleshooting or editing registry entries.
Sets the path and file name to be downloaded. This file must be created in advance with
using the reg save operation and with the .hiv extension.
Specifies the full path to the partition. For remote computers, the computer name is inserted before
path to the partition in the format \computer_name path_to_partition. If the parameter
computer_name is not set, the default operation is performed on the local
computer. The path should start from the appropriate subtree. Allowed subtrees
are HKLM, HKCU, HKCR, HKU and HKCC. If given
remote computer, only the HKLM and HKU subtrees can be used.
Sets the full path to the partition to be copied. For remote computers before the path to
section in the format \computer_name_path_to_partition, the name is inserted
computer. If the computer_name parameter is not specified, the default operation
running on the local computer. The path should start from the appropriate subtree.
Valid subtrees are HKLM, HKCU, HKCR, HKU, and
HKCC. If a remote computer is specified, then only subtrees can be used
HKLM and HKU.
Specifies the full path to the destination partition. For remote computers before the path to
section in the format \computer_name_path_to_partition, the name is inserted
computer. If the computer_name parameter is not specified, the default operation
running on the local computer. The path should start from the appropriate subtree.
Valid subtrees are HKLM, HKCU, HKCR, HKU, and
HKCC. If a remote computer is specified, then only subtrees can be used
HKLM and HKU.
reg copy “hkcusoftwaremicrosoftwinmine” “hkcusoftwaremicrosoftwinminebk” /s /f
reg copy “hkcusoftwaremicrosoftwinminebk” “hkcusoftwaremicrosoftwinmine” /s
Specifies the full path to the partition. The restore operation only works on the local
computer. The path should start from the appropriate subtree. Allowed subtrees
are HKLM, HKCU, HKCR, HKU and HKCC.
Specifies the path and file name to be written back to the registry. The file must be created
in advance using the reg save operation with the .hiv extension.
Specifies the path and name of the file to be created. If no path is given, the current path is used.
path.
Creates a copy of the given sections, entries, or values in a file that can be sent to
other servers.
Specifies the full path to the partition. The export operation only works on the local
computer. The path starts from the corresponding subtree. Allowed subtrees
are HKLM, HKCU, HKCR, HKU and HKCC.
Copies keys, entries and values from the exported registry to the local registry
computer.
Specifies the name and path of the file to be copied to the registry of the local computer. pre-s
using the reg export operation, this file must be created.
Specifies the full path to the partition. For remote computers, before the path to the partition in the format
\computer_name path_to_partition the computer name is inserted. If the parameter
computer_name is not set, the default operation is performed on the local
computer. The path should start from the appropriate subtree. Allowed subtrees
are HKLM, HKCU, HKCR, HKU and HKCC.
Sets the data type for the entry value. The datatype parameter can be one of
the following values:
Sets characters to separate copies of data. Used when setting REG_MULTI_SZ in
as a data type and when placing more than one entry in the list. If the separator is not
is specified, the default delimiter is used.
reg add hklmsoftwaremyco /v data /t reg_binary /d fe340ead
reg add “hkcusoftwaremicrosoftwinmine” /v Name3 /t reg_sz /d Anonymous
reg add “hkcusoftwaremicrosoftwinmine” /v Time3 /t reg_dword /d 5
