How to use the command 'reg query' (with examples)

The command ‘reg query’ is used to display the values of keys and sub keys in the registry in a Windows environment. It allows users to retrieve information about registry keys and their corresponding values.

Use case 1: Display all values of a key

Code:

reg query key_name

Motivation:

This use case is helpful when you need to retrieve all the values associated with a specific registry key. It provides a comprehensive list of all the values stored within that key.

Explanation:

• reg query: This is the command to query the registry.
• key_name: Replace this with the name of the registry key you want to retrieve the values from.

Example output:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
    ProgramFilesDir    REG_EXPAND_SZ    C:\Program Files
    ProgramFilesPath    REG_SZ    C:\Program Files
    ...

Use case 2: Display a specific value of a key

Code:

reg query key_name /v value

Motivation:

In some cases, you may only be interested in retrieving a specific value from a registry key, rather than all the values. This use case allows you to specify the value you want to retrieve.

Explanation:

• reg query: This is the command to query the registry.
• key_name: Replace this with the name of the registry key you want to retrieve the value from.
• /v value: Specifies the value name you want to retrieve.

Example output:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
    ProgramFilesDir    REG_EXPAND_SZ    C:\Program Files

Use case 3: Display all values of a key and its sub keys

Code:

reg query key_name /s

Motivation:

When you need to retrieve all the values of a registry key as well as its sub keys, this use case proves useful. It provides a more comprehensive view of the registry structure, including all values and sub keys.

Explanation:

• reg query: This is the command to query the registry.
• key_name: Replace this with the name of the registry key you want to retrieve the values from.
• /s: Specifies that the query should also include sub keys.

Example output:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
    ProgramFilesDir    REG_EXPAND_SZ    C:\Program Files
    ProgramFilesPath    REG_SZ    C:\Program Files
    ...
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
    CommonFilesDir    REG_SZ    C:\Program Files\Common Files
    CommonFilesPath    REG_SZ    C:\Program Files\Common Files
    ...

Use case 4: Search for keys and values matching a specific pattern

Code:

reg query key_name /f "query_pattern"

Motivation:

When you need to find specific keys or values in the registry that match a specific pattern, this use case becomes handy. It allows for filtering registry entries based on the provided search pattern.

Explanation:

• reg query: This is the command to query the registry.
• key_name: Replace this with the name of the registry key you want to search within.
• /f "query_pattern": Specifies the search pattern to filter the results.

Example output:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
    ProgramFilesDir    REG_EXPAND_SZ    C:\Program Files (x86)
    ProgramFilesPath    REG_SZ    C:\Program Files (x86)
    ...

Use case 5: Display a value of a key matching a specified data type

Code:

reg query key_name /t type

Motivation:

When you need to retrieve a specific value from a registry key that matches a certain data type, this use case is helpful. It allows you to filter the results based on the specified data type.

Explanation:

• reg query: This is the command to query the registry.
• key_name: Replace this with the name of the registry key you want to retrieve the value from.
• /t type: Specifies the data type of the value you want to retrieve.

Example output:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
    ProgramFilesDir    REG_EXPAND_SZ    C:\Program Files

Conclusion:

The ‘reg query’ command is a powerful tool for retrieving information from the Windows registry. With its various options, such as querying specific values, searching for patterns, and filtering based on data types, it provides flexibility to meet different use cases. Whether you need to explore the registry hierarchy or extract specific data, this command enables efficient access to registry information.