Solved reg.exe won't query subkeys

[umphorton]

-Windows 7 Professional 64bit.
-Command is executed from an elevated command prompt.
-It worked yesterday

If I type reg query HKLM/Software ... I get all the subkeys under Sofware.

If I type reg query HKLM /f Software... I get...
HKEY_LOCAL_MACHINE\SOFTWARE
End of search: 1 match(es) found.

If I type reg query HKLM\software\Policies... I get
HKEY_LOCAL_MACHINE\software\Policies\ActivIdentity
HKEY_LOCAL_MACHINE\software\Policies\Adobe
HKEY_LOCAL_MACHINE\software\Policies\Microsoft
HKEY_LOCAL_MACHINE\software\Policies\Tumbleweed

Now is where I run into problems...

If I type reg query HKLM /f policies... I get
End of search: 0 match(es) found.

No matter what key I try this with I get the same result.

Oh and reg delete will successfully delete a key in the place as the two mentioned above.

Any ideas?

 

[umphorton]

reg query hklm /f Software does work and I get this...
HKEY_LOCAL_MACHINE\SOFTWARE
End of search: 1 match(es) found.

It seems like it is having problems with each hive at the 2nd subkey level and below. e.g. HKEY_LOCAL_MACHINE\SOFTWARE\Policies.

 

[umphorton]

I can also do this...
reg query "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\shop.nuan
ce.com"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\shop.nuance.com
(Default) REG_DWORD 0x0

but not reg query HKCU /f "shop.nuance.com" or reg query HKCU /f shop.nuance.com

 

[Ztruker]

Not sure what this is supposed to do: reg query hklm /f Software

What is the /f for? The query should be reg query hklm\Software and on my system returns:

C:\WINDOWS\system32>reg query HKLM\software

HKEY_LOCAL_MACHINE\software\7-Zip
HKEY_LOCAL_MACHINE\software\AGEIA Technologies
HKEY_LOCAL_MACHINE\software\ATI Technologies
HKEY_LOCAL_MACHINE\software\BillP Studios
HKEY_LOCAL_MACHINE\software\Brother
HKEY_LOCAL_MACHINE\software\Classes
HKEY_LOCAL_MACHINE\software\Clients
HKEY_LOCAL_MACHINE\software\Code Sector
HKEY_LOCAL_MACHINE\software\CyberLink
HKEY_LOCAL_MACHINE\software\Dell
HKEY_LOCAL_MACHINE\software\Dolby
HKEY_LOCAL_MACHINE\software\DTS
HKEY_LOCAL_MACHINE\software\Foxit Software
... ... ... ... ...

 

[UsernameIssues]

Not sure what this is supposed to do: reg query hklm /f Software

What is the /f for?

It seems to allow for a search term.

c:\>reg query /?

REG QUERY KeyName [/v [ValueName] | /ve] [/s]
          [/f Data [/k] [/d] [/c] [/e]] [/t Type] [/z] [/se Separator]

  KeyName  [\\Machine\]FullKey
           Machine - Name of remote machine, omitting defaults to the
                     current machine. Only HKLM and HKU are available on
                     remote machines
           FullKey - in the form of ROOTKEY\SubKey name
                ROOTKEY - [ HKLM | HKCU | HKCR | HKU | HKCC ]
                SubKey  - The full name of a registry key under the
                          selected ROOTKEY

  /v       Queries for a specific registry key values.
           If omitted, all values for the key are queried.

           Argument to this switch can be optional only when specified
           along with /f switch. This specifies to search in valuenames only.

  /ve      Queries for the default value or empty value name (Default).

  /s       Queries all subkeys and values recursively (like dir /s).

  /se      Specifies the separator (length of 1 character only) in
           data string for REG_MULTI_SZ. Defaults to "\0" as the separator.

 [COLOR=Red] /f       Specifies the data or pattern to search for.
           Use double quotes if a string contains spaces. Default is "*".
[/COLOR]
  /k       Specifies to search in key names only.

  /d       Specifies the search in data only.

  /c       Specifies that the search is case sensitive.
           The default search is case insensitive.

  /e       Specifies to return only exact matches.
           By default all the matches are returned.

  /t       Specifies registry value data type.
           Valid types are:
             REG_SZ, REG_MULTI_SZ, REG_EXPAND_SZ,
             REG_DWORD, REG_QWORD, REG_BINARY, REG_NONE
           Defaults to all types.

  /z       Verbose: Shows the numeric equivalent for the type of the valuename.

Examples:

  REG QUERY HKLM\Software\Microsoft\ResKit /v Version
    Displays the value of the registry value Version

  REG QUERY \\ABC\HKLM\Software\Microsoft\ResKit\Nt\Setup /s
    Displays all subkeys and values under the registry key Setup
    on remote machine ABC

  REG QUERY HKLM\Software\Microsoft\ResKit\Nt\Setup /se #
    Displays all the subkeys and values with "#" as the seperator
    for all valuenames whose type is REG_MULTI_SZ.

  REG QUERY HKLM /f SYSTEM /t REG_SZ /c /e
    Displays Key, Value and Data with case sensitive and exact
    occurrences of "SYSTEM" under HKLM root for the data type REG_SZ

  REG QUERY HKCU /f 0F /d /t REG_BINARY
    Displays Key, Value and Data for the occurrences of "0F" in data
    under HKCU root for the data type REG_BINARY

  REG QUERY HKLM\SOFTWARE /ve
    Displays Value and Data for the empty value (Default)
    under HKLM\SOFTWARE

 

[GokAy]

According to Technet; "This parameter only returns entries that are in the tier directly below the specified subkey. Entries that are located in subkeys under the current subkey will not be found. When EntryName is omitted, all entries under the subkey are returned. "

You can try experimenting with the /s switch, I am getting mixed results. See for yourself

C:\Users\User>reg query hklm\software\policies /s /f windows
HKEY_LOCAL_MACHINE\software\policies\Microsoft\SQMClient\Windows
HKEY_LOCAL_MACHINE\software\policies\Microsoft\Windows
HKEY_LOCAL_MACHINE\software\policies\Microsoft\Windows NT
HKEY_LOCAL_MACHINE\software\policies\Microsoft\Windows NT\Windows File Protection
Arama sonu: 4 eşleşme bulundu. (found 4)
 
With /e switch added
C:\Users\User>reg query hklm\software\policies /s /f windows /e
HKEY_LOCAL_MACHINE\software\policies\Microsoft\SQMClient\Windows
HKEY_LOCAL_MACHINE\software\policies\Microsoft\Windows
Arama sonu: 2 eşleşme bulundu. (found 2)

 

[Pyprohly]

I too, think that the OP wants to search an entire hive for a specific key name. The Reg Query for that would be like,

reg query [COLOR="Red"]HKXX[/COLOR] /f [COLOR="red"]KeyNameToFind[/COLOR] /s /k /e

You can try experimenting with the /s switch, I am getting mixed results.

What is so mixed result-y?

 

[GokAy]

Sorry it was a vague argument

I couldn't manage to find the exact search commands for what I wanted to search (while testing).