Recipe 9.6. Searching the Registry

Problem

You want to search the Registry for the occurrence of a string or number.

Solution

Using a graphical user interface

1. Open the Registry Editor (regedit.exe).

2. In the left pane, browse to the key you want to begin the search. If you want to search the entire Registry, click on My Computer at the top.

3. From the menu, select Edit Find.

4. Click the Find Next button.

5. If you want to continue searching after a match is found, either select Edit Find Next from the menu or press the F3 key.

Using a command-line interface

You can use the regfind utility from the Windows 2000 Resource Kit to search for certain values under a given key. Here is the syntax:

> regfind -m \\<ComputerName> -p <RegKey> -n "<ValueName>"

For example:

> regfind -m \\wks01 -p HKEY_LOCAL_MACHINE\Software\Microsoft -n "Run"

See the regfind command line help to view all supported search options.

Using VBScript

Unfortunately, the StdRegProv WMI Provider doesn't support searching the Registry. Your only options to search the Registry via VBScript would be to enumerate over all the keys and values you want to search against (very inefficient), shell out to a command-line utility such as reg (see Recipe 9.5 for an example of how to do this), or find a third-party ActiveX control that implements a Registry search interface that can be used by scripting languages.

Discussion

The Registry contains a significant amount of data. Don't be surprised if your initial search matches a lot of different keys or values that you weren't intending. This is especially true if you search across a whole hive or all of the hives. Try to restrict your search to a specific key when possible.