GeezerVison is showing ss64.com — Reg - Edit Registry command - Windows CMD

REG.exe

Read, Set or Delete registry keys and values, save and restore from a .REG file.

Syntax

   REG QUERY [ROOT\]RegKey /V ValueName [/s] [/F Data [/K] [/D] [/C] [/E]] -- Display a specific value.
      [/T DataType] [/Z] [/SE Separator] [/reg:32 | /reg:64]

   REG QUERY [ROOT\]RegKey /VE  [/f Data [/K] [/D] [/C] [/E]]    --  Display the (default /VE) value.
      [/T DataType] [/Z] [/SE Separator] [/reg:32 | /reg:64]      

   
   REG ADD [ROOT\]RegKey /V ValueName [/T DataType] [/S Separator] [/D Data] [/F] [/reg:32] [/reg:64]

   REG ADD [ROOT\]RegKey /VE [/d Data] [/F] [/reg:32 | /reg:64]     -- Add the (default) value.

   REG DELETE [ROOT\]RegKey /V ValueName [/F] -- Remove a specific value.
   REG DELETE [ROOT\]RegKey /VE [/F]      -- Remove the (default) value.
   REG DELETE [ROOT\]RegKey /VA [/F]      -- Delete all values under this key.
   REG DELETE [ROOT\]RegKey               -- Delete the key (including all values).

   REG COPY  [\\SourceMachine\][ROOT\]RegKey [\\DestMachine\][ROOT\]RegKey

   REG EXPORT [ROOT\]RegKey FileName.reg [/Y] [/reg:32 | /reg:64]
   REG IMPORT FileName.reg  [/reg:32 | /reg:64]
   REG SAVE [ROOT\]RegKey FileName.hiv [/Y] [/reg:32 | /reg:64]
   REG RESTORE \\MachineName\[ROOT]\KeyName FileName.hiv [/reg:32 | /reg:64]
   
   REG LOAD KeyName FileName [/reg:32 | /reg:64]
   REG UNLOAD KeyName
   
   REG COMPARE [ROOT\]RegKey [ROOT\]RegKey [/V ValueName] [Output] [/s] [/reg:32 | /reg:64]
   REG COMPARE [ROOT\]RegKey [ROOT\]RegKey [/VE] [Output] [/s] [/reg:32 | /reg:64]

Key:
   ROOT These root prefixes can be used to abbreviate the full registry key:
         HKLM = HKey_Local_machine (default)
         HKCU = HKey_current_user
         HKU  = HKey_users
         HKCR = HKey_classes_root

   ValueName : The value, under the selected RegKey, to edit.
               (default is all keys and values)

   /C        : Case sensitive search.

   /D Data   : The actual data to store as a "String", integer etc
               Numbers do not have to be prefixed with zeros or enclosed in quotes,
               so /D "00000001", /D "1" or /D 1 are all equivalent.

   /E        : Return only exact matches, by default all are returned.

   /F        : Add/Delete - Force an update without prompting "Value exists, overwrite Y/N"
                    Query - Specify the data/pattern to search for, default = "*"
                            Use double quotes if the string contains spaces.

   /K        : Search in Key names only.

   \\Machine : Name of remote machine - omitting defaults to current machine.
               Only HKLM and HKU are available on remote machines.

   FileName  : The filename to save or restore a registry hive.

   KeyName   : A key name to load a hive file into. (Creating a new key)

   RegKey    : A Registry key. String name.
               These are case sensitive when creating and case-insensitive when reading.

   /S        : Query all subkeys and values.
   /S Separator  : Character to use as the separator in REG_MULTI_SZ values, the default is "\0"
   /SE Separator : Character to use as the separator in REG_MULTI_SZ values, the default is "\0"

   /T DataType  : REG_SZ | REG_BINARY | REG_DWORD | REG_EXPAND_SZ | REG_MULTI_SZ
                  Click for full list, default = REG_SZ.

   /reg:32   : Force REG.exe to read/write to the 32-bit registry location.
   /reg:64   : Force REG.exe to read/write to the 64-bit registry location.

             By default a 32-bit process (such as a 32 bit MSI installer) on a 64 bit machine,
             will use the 32-bit view of the registry: HKLM\SOFTWARE\Wow6432Node
             Use the /REG switch to over-ride this. See Q305097 for more details.

   Output    : /od (only differences) /os (only matches) /oa (all) /on (no output)

   /V        : Query for a specific registry key value, if omitted all values for the key are queried.

   /VE       : Compare or SET the empty value name (default)

   /Y        : Force overwriting the existing file without prompt.

   /Z        : Verbose - shows the numeric equivalent for the type of the valuename.

Any of the above commands can be run against a remote machine by adding \\MachineName to the command line, assuming the Remote Registry Service is running.

Registry paths which contain a space must be enclosed by quotation marks:
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList"

Depending on the registry permissions, REG ADD may require running REG.exe from an elevated command prompt.
Registry data stored under HKCU will be visible and writable by the currently logged in user.
Registry data stored under HKLM will be visible to all users and writable only by administrators.

REG RESTORE has a tendency not to work, possibly due to permissions or firewall issues, EXPORT and IMPORT are more reliable.

Backslash characters

The REG command will interpret \ as an escape for the character that immediately follows it.
To include a quote mark (") in the data, prefix it with the escape character e.g. Here is \" a quote

This can cause problems with quoted directory paths because \" at the end of the line will be escaped.

To save a directory path with a trailing backslash (\) requires adding a second backslash to 'escape' the escape
so for example instead of "C:\My Docs\" use "C:\My Docs\\"

Activate

To activate registry changes in HKEY_CURRENT_USER without logging off:
RUNDLL32.EXE USER32.DLL,UpdatePerUserSystemParameters ,1 ,True
n.b. this is an unsupported hack, with a good chance of failing in the future - details on oldnewthing

Elevation

Unlike REGEDIT, REG.exe does not always require elevation.
When adding an item to HKCU, REG will be automatically manifested “asInvoker”, and will work without elevation.
When adding an item to HKLM then it does need to be run elevated, or from an elevated command prompt.

Return codes (ERRORLEVEL)

0 = Success, the result is identical.
1 = Failed.
2 = Success, the result is different.

Examples

Query all the keys under HKCU console:

C:\> REG QUERY HKCU\Console\

Query the value of the ScreenBufferSize key:

C:\> REG QUERY HKCU\Console /v screenbuffersize

Add the registry key 'Sample' along with some data and then query to check that it worked:

C:\> REG ADD HKCU\Software\SS64 /v Sample /d "some test data"
C:\> REG QUERY HKCU\Software\SS64 /v Sample

Add the registry key to disable Fast User Switching on the current PC (requires elevation):

C:\> REG.exe ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v HideFastUserSwitching /t REG_DWORD /d 1

Add a REG_BINARY registry key to HKLM and overwrite if it already exists (requires elevation):

C:\> REG ADD HKLM\Software\DiLithium /v WarpSpeed /t REG_BINARY /d f1f2f3f4 /f
C:\> REG QUERY HKLM\Software\DiLithium /v WarpSpeed

Find the location of the Start Menu folder:

C:\> REG QUERY "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "Start Menu"

Query the Computer Description of the local machine:

C:\> REG QUERY HKLM\System\CurrentControlSet\services\LanmanServer\Parameters /f srvcomment

Switch to Windows Dark mode.

Enable Windows Dark mode:
C:\> REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize /v AppsUseLightTheme /t REG_DWORD /d 0 /f

Enable Windows Light mode:
C:\> REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize /v AppsUseLightTheme /t REG_DWORD /d 1 /f

To automate switching to Dark mode use a Scheduled task to call the above REG.exe scripts at dawn and dusk.
To run them precisely at dawn/dusk rather than at a fixed time, use the Sunwait utility or use a PowerShell script to determine dawn/dusk.

Delete the 3DObjects folder from the Windows Explorer sidebar (Requires elevation):

REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{0DB7E03F-FC29-4DC6-9020-FF41B59E513A}"
REG DELETE "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{0DB7E03F-FC29-4DC6-9020-FF41B59E513A}"

Save a directory/registry path that ends with a backslash:

Set _reg=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SS64.EXE\
Set _prog=C:\Program Files\SS64 App\
REG ADD "%_reg%\" /f /v "SS64.EXE" /t REG_SZ /d "%_prog%\"

Save a REG_Expand_SZ value, this variable will be expanded every time the registry value is read, rather than once when the key is added. Example using the %systemroot% variable:

REG.exe ADD HKLM\Software\SS64 /v Path /t REG_EXPAND_SZ /d ^%systemroot^%

Copy registry keys: and then restore the copy:

REG COPY HKCU\Software\SS64 HKCU\Software\SS64Copy
REG COPY \\Computer64\HKCU\Software\SS64 HKCU\Software\SS64

Export/Import/Save/Restore the Current Users Registry settings:

REG EXPORT HKCU\Software\SS64 C:\MyReg.REG
REG IMPORT C:\MyReg.REG
REG SAVE HKCU\Software\SS64 C:\MyRegHive.hiv
REG RESTORE \\Wks580\HKCU\Software\SS64 C:\MyRegHive.hiv

Run a script at first logon (Run Once) to do this we edit the Default User profile by temporarily loading it as TEMP:

REG LOAD HKU\TEMP "C:\Documents and Settings\Default User\NTUSER.DAT"
REG ADD HKU\TEMP\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v newUserProfile /t REG_EXPAND_SZ /d "D:\setup.cmd" /f
REG UNLOAD HKU\TEMP

To save a progress log as part of a RunOnce command you can include redirection to a log file as part of the command string, however to make this work the redirection characters and quotes must be escaped:
... "setup.cmd ^>^> \"C:\Temp\setup.log\"\"" /f

More examples are available via: REG QUERY /? REG ADD /? etc

“The way to a mans heart is through his stomach” ~ Fanny Fern (writer)

Related commands

SETX - Set environment variables permanently, can also read a registry key and write the value to a text file.
REGEDIT - Load Registry settings from a .REG file.
Equivalent PowerShell: Get-ItemProperty / Set-ItemProperty - Retrieve / save registry Keys.
Q305097 - Comparison of the 32 bit and 64-bit Registry Editor Regedit.exe.
Q325347 - Run a Logon Script once the first time a new user logs on, (Runonce).