reg query

Returns a list of the next tier of subkeys and entries that are located under a specified subkey in the registry.

Syntax

reg query <keyname> [{/v <valuename> | /ve}] [/s] [/se <separator>] [/f <data>] [{/k | /d}] [/c] [/e] [/t <Type>] [/z] [/reg:32] [/reg:64]

Parameters

Parameter Description
<keyname> Specifies the full path of the subkey. To specify a remote computer, include the computer name (in the format \\<computername>\) as part of the keyname. Omitting \\<computername>\ causes the operation to default to the local computer. The keyname must include a valid root key. Valid root keys for the local computer are: HKLM, HKCU, HKCR, HKU, and HKCC. If a remote computer is specified, valid root keys are: HKLM and HKU. If the registry key name contains a space, enclose the key name in quotes.
/v <valuename> Specifies the registry value name that is to be queried. If omitted, all value names for keyname are returned. Valuename for this parameter is optional if the /f option is also used.
/ve Runs a query for value names that are empty.
/s Specifies to query all subkeys and value names recursively.
/se <separator> Specifies the single value separator to search for in the value name type REG_MULTI_SZ. If separator isn't specified, \0 is used.
/f <data> Specifies the data or pattern to search for. Use double quotes if a string contains spaces. If not specified, a wildcard (*) is used as the search pattern.
/k Specifies to search in key names only. Must be used with /f.
/d Specifies to search in data only.
/c Specifies that the query is case sensitive. By default, queries are not case sensitive.
/e Specifies to return only exact matches. By default, all the matches are returned.
/t <Type> Specifies registry types to search. Valid types are: REG_SZ, REG_MULTI_SZ, REG_EXPAND_SZ, REG_DWORD, REG_BINARY, REG_NONE. If not specified, all types are searched.
/z Specifies to include the numeric equivalent for the registry type in search results.
/reg:32 Specifies the key should be accessed using the 32-bit registry view.
/reg:64 Specifies the key should be accessed using the 64-bit registry view.
/? Displays help at the command prompt.

Remarks

  • The return values for the reg query operation are:

    Value Description
    0 Success
    1 Failure

Examples

To display the value of the name value Version in the HKLM\Software\Microsoft\ResKit key, type:

reg query HKLM\Software\Microsoft\ResKit /v Version

To display all subkeys and values under the key HKLM\Software\Microsoft\ResKit\Nt\Setup on a remote computer named ABC, type:

reg query \\ABC\HKLM\Software\Microsoft\ResKit\Nt\Setup /s

To display all the subkeys and values of the type REG_MULTI_SZ using # as the separator, type:

reg query HKLM\Software\Microsoft\ResKit\Nt\Setup /se #

To display the key, value, and data for exact and case sensitive matches of SYSTEM under the HKLM root of data type REG_SZ, type:

reg query HKLM /f SYSTEM /t REG_SZ /c /e

To display the key, value, and data that match 0F in the data under the HKCU root key of data type REG_BINARY, type:

reg query HKCU /f 0F /d /t REG_BINARY

To display the keys, values, and data that match asp.net under the key HKLM\SOFTWARE\Microsoft and all subkeys, type:

reg query HKLM\SOFTWARE\Microsoft /s /f asp.net

To display only the keys that match asp.net under the key HKLM\SOFTWARE\Microsoft and all subkeys, type:

reg query HKLM\SOFTWARE\Microsoft /s /f asp.net /k

To display the value and data for value names of null (default) under HKLM\SOFTWARE, type:

reg query HKLM\SOFTWARE /ve