The reg command can query, modify, and manipulate the Windows registry from the command line.

Availability

Reg is an external command available for Windows XP, Windows Vista, Windows 7, Windows 8, Windows 10, and Windows 11.

  • Availability
  • Syntax
  • Examples
  • Windows command line overview

Its executable file is installed at %WINDIR%/System32/reg.exe.

Syntax

The syntax for the reg command changed after Windows XP and is listed separately on this page.

Windows Vista and later syntax

REG Operation [Parameter…]

The Operation is one of QUERY, ADD, DELETE, COPY, SAVE, LOAD, UNLOAD, RESTORE, COMPARE, EXPORT, IMPORT, and FLAGS.

  • Windows Vista and later syntax.
  • Windows XP syntax.

Parameters are listed below, and vary depending on Operation.

The return code for all operations (except COMPARE) is 0 for success or 1 for failure.

QUERY operation

REG QUERY KeyName [{/v [ValueName]} | /ve] [/s] [/f Data [/k] [/d] [/c] [/e]] [/t Type] [/z] [/se Separator] [/reg:32 | /reg:64]

Examples:

For more information about the /reg:32 and /reg:64 parameters, including when to use them and how they interact with the registry, see this Microsoft support document.

REG QUERY HKLM\Software\Microsoft\ResKit /v Version

Displays the value of the registry value Version.

REG QUERY \ABC\HKLM\Software\Microsoft\ResKit\Nt\Setup /s

Displays all subkeys and values under the registry key Setup on remote machine ABC.

REG QUERY HKLM\Software\Microsoft\ResKit\Nt\Setup /se #

Displays all the subkeys and values with “#” as the separator, for all valuenames whose type is REG_MULTI_SZ.

REG QUERY HKLM /f SYSTEM /t REG_SZ /c /e

Displays Key, Value, and Data with case sensitive and exact occurrences of “SYSTEM” under HKLM root for the data type REG_SZ.

REG QUERY HKCU /f 0F /d /t REG_BINARY

Displays Key, Value, and Data for the occurrences of “0F” in data under HKCU root for the data type REG_BINARY.

REG QUERY HKLM\SOFTWARE /ve

Displays Value and Data for the empty value (the default) under HKLM\SOFTWARE.

ADD operation

REG ADD KeyName [/v ValueName | /ve] [/t Type] [/s Separator] [/d Data] [/f] [/reg:32 | /reg:64]

REG ADD \ABC\HKLM\Software\MyCo

Adds a key HKLM\Software\MyCo on remote machine ABC

REG ADD HKLM\Software\MyCo /v Data /t REG_BINARY /d fe340ead

Adds a value (name: Data, type: REG_BINARY, data: fe340ead).

REG ADD HKLM\Software\MyCo /v MRU /t REG_MULTI_SZ /d fax\0mail

Adds a value (name: MRU, type: REG_MULTI_SZ, data: fax\0mail\0\0).

REG ADD HKLM\Software\MyCo /v Path /t REG_EXPAND_SZ /d ^%systemroot^%

Adds a value (name: Path, type: REG_EXPAND_SZ, data: %systemroot%). Note: Use the caret symbol ( ^ ) inside the expand string.

DELETE operation

REG DELETE KeyName [/v ValueName | /ve | /va] [/f] [/reg:32 | /reg:64]

REG DELETE HKLM\Software\MyCo\MyApp\Timeout

Deletes the registry key Timeout and of all its subkeys and values.

REG DELETE \ZODIAC\HKLM\Software\MyCo /v MTU

Deletes the registry value MTU under MyCo on remote machine ZODIAC.

COPY operation

REG COPY KeyName1 KeyName2 [/s] [/f] [/reg:32 | /reg:64]

REG COPY HKLM\Software\MyCo\MyApp HKLM\Software\MyCo\SaveMyApp /s

Copies all subkeys and values under the key MyApp to the key SaveMyApp.

REG COPY \ZODIAC\HKLM\Software\MyCo HKLM\Software\MyCo1

Copies all values under the key MyCo on ZODIAC to the key MyCo1 on the local machine.

SAVE operation

REG SAVE KeyName FileName [/y] [/reg:32 | /reg:64]

Example:

REG SAVE HKLM\Software\MyCo\MyApp AppBkUp.hiv

Saves the hive MyApp to the file AppBkUp.hiv in the current directory.

LOAD operation

REG LOAD KeyName FileName [/reg:32 | /reg:64]

REG LOAD HKLM\TempHive TempHive.hiv

Loads hive data from the file TempHive.hiv (in the current directory) into the registry location HKLM\TempHive.

UNLOAD operation

UNLOAD removes a section of the registry that was loaded using the LOAD operation.

REG UNLOAD KeyName

REG UNLOAD HKLM\TempHive

Unloads the hive TempHive in HKLM.

RESTORE operation

REG RESTORE KeyName FileName [/reg:32 | /reg:64]

REG RESTORE HKLM\Software\Microsoft\ResKit NTRKBkUp.hiv

Restores the hive file NTRKBkUp.hiv, overwriting the key ResKit.

COMPARE operation

REG COMPARE KeyName1 KeyName2 [/v ValueName | /ve] [Output] [/s] [/reg:32 | /reg:64]

Return codes for REG COMPARE are:

  • 0 if the result compared is identical.
  • 1 if a comparison was impossible.
  • 2 if the result compared is different.

Symbols preceding each line of REG COMPARE’s output:

  • = precedes FullKey1 data that is the same as FullKey2 data.
  • < precedes FullKey1 data that is different than FullKey2 data.

  • precedes FullKey2 data that is different than Fullkey1 data.

REG COMPARE HKLM\Software\MyCo\MyApp HKLM\Software\MyCo\SaveMyApp

Compares all values under the key MyApp with SaveMyApp.

REG COMPARE HKLM\Software\MyCo HKLM\Software\MyCo1 /v Version

Compares the value of Version under the key MyCo and MyCo1.

REG COMPARE \ZODIAC\HKLM\Software\MyCo \. /s

Compares all subkeys and values under HKLM\Software\MyCo on ZODIAC with the same key on the local machine.

EXPORT operation

REG EXPORT KeyName FileName [/y] [/reg:32 | /reg:64]

REG EXPORT HKLM\Software\MyCo\MyApp AppBkUp.reg

Exports all subkeys and values of the key MyApp to the file AppBkUp.reg

IMPORT operation

REG IMPORT FileName [/reg:32 | /reg:64]

REG IMPORT AppBkUp.reg

Imports registry entries from the file AppBkUp.reg.

FLAGS operation

REG FLAGS KeyName [QUERY | SET FlagName…] [/reg:32 | /reg:64]

REG FLAGS HKLM\Software\MyCo\MyApp QUERY

Displays the current flags of the key MyApp.

REG FLAGS HKLM\Software\MyCo\MyApp SET DONT_VIRTUALIZE /s

Sets the DONT_VIRTUALIZE flag (and clears DONT_SILENT_FAIL and RECURSE_FLAG) on MyApp and all its subkeys.

Windows XP syntax

REG Operation [Parameters]

Operation is one of QUERY, ADD, DELETE, COPY, SAVE, LOAD, UNLOAD, RESTORE, COMPARE, EXPORT, and IMPORT.

Parameters are listed below and vary depending on Operation.

QUERY operation (Windows XP)

REG QUERY KeyName [/v ValueName | /ve] [/s]

ADD operation (Windows XP)

REG ADD KeyName [/v ValueName | /ve] [/t Type] [/s Separator] [/d Data] [/f]

DELETE operation (Windows XP)

REG DELETE KeyName [/v ValueName | /ve | /va] [/f]

COPY operation (Windows XP)

REG COPY KeyName1 KeyName2 [/s] [/f]

SAVE operation (Windows XP)

REG SAVE KeyName FileName

RESTORE operation (Windows XP)

REG RESTORE KeyName FileName

LOAD operation (Windows XP)

REG LOAD KeyName FileName

UNLOAD operation (Windows XP)

COMPARE operation (Windows XP)

REG COMPARE KeyName1 KeyName2 [/v ValueName | /ve] [Output] [/s]

  • 0: compared items are identical.
  • 1: comparison failed.
  • 2: compared items are different.

EXPORT operation (Windows XP)

REG EXPORT KeyName FileName

IMPORT operation (Windows XP)

REG IMPORT FileName

Examples

The following examples use the modern reg syntax found in Windows Vista, 7, 8, and 10.

REG QUERY HKLM\Software\Microsoft\ResKit\Nt\Setup /s

Displays all subkeys and values under the registry key Setup.

Adds a key HKLM\Software\MyCo on remote machine ABC.

Adds a value (name: MRU, type: REG_MUTLI_SZ, data: fax\0mail).

REG ADD HKLM\Software\MyCo /v Path /t REG_EXPAND_SZ /d %%systemroot%%

Adds a value (name: Path, type: REG_EXPAND_SZ, data: %systemroot%). Note: Use the double percentage ( %% ) inside the expand string.

Deletes the registry key Timeout and its all subkeys and values.

Deletes the registry value MTU under MyCo on ZODIAC.

Copies all values under the key MyCo on ZODIAC to the key MyCo1 on the current machine.

Saves the hive MyApp to the file AppBkUp.hiv in the current folder.

Restores the file NTRKBkUp.hiv overwriting the key ResKit.

Loads the file TempHive.hiv to the key HKLM\TempHive.

Compares all values under the key MyApp with SaveMyApp

Compares the value Version under the key MyCo and MyCo1

Compares all subkeys and values under HKLM\Software\MyCo on ZODIAC with the same key on the current machine.

Exports all subkeys and values of the key MyApp to the file AppBkUp.reg.

  • See our registry definition for further information and related links on this term.