Recipe9.6.Searching the Registry

Recipe 9.6. Searching the Registry

Problem

You want to search the registry for the occurrence of a string or number.

Solution

Using a graphical user interface

1. Open the Registry Editor (regedit.exe).

2. In the left pane, browse to the key you want to search. If you want to search the entire registry, click on My Computer at the top.

3. From the menu, select Edit

   Enter the string you want to search with and select whether you want to search keys, values, or data.

4. Click the Find Next button.

5. If you want to continue searching after a match is found, either select Edit F3 key.

Using a command-line interface

On Windows Server 2003, use the reg command to search the registry:

> reg query \\<ServerName>\<RegKey> /f <ValueName> /s /k 

For instance, the following command searches recursively under the specified registry key for all values that contain "Run":

> reg query \\server01\HKLM\Software\Microsoft /f Run /s /k

Replace the /k switch with /d to perform the same search, but matching only value data (and not key names). Run reg query /? for the complete list of search options.

The version of reg included with the Windows 2000 Resource Kit does not have all of the search capabilities of the one included with Windows Server 2003. But you can use the regfind utility from the Windows 2000 Resource Kit to perform similar searches. Here is the syntax:

> regfind -m \\<ServerName> -p <RegKey> -n "<ValueName>"

For example:

> regfind -m \\server01 -p HKEY_LOCAL_MACHINE\Software\Microsoft -n "Run"

View the regfind command-line help for all of the search options.

Using VBScript

Unfortunately, the StdRegProv WMI Provider doesn't support searching the registry. Your only options to search the registry via VBScript would be to enumerate over all the keys and values you want to search against (very inefficient), shell out to a command-line utility such as reg (see Recipe Recipe 9.5 for an example of how to do this), or find a third-party ActiveX control that implements a registry search interface that can be used by scripting languages.

Discussion

The registry contains a significant amount of data. Don't be surprised if your initial search matches a lot of different keys or values that you weren't intending. This is especially true if you search across a whole hive or all of the hives. Try to restrict your search to a specific key when possible.