What is a faster way to search the Windows registry?

16

3

Because the Windows registry is a hierarchy, the way regedit is laid out makes typical searches inefficient and slow.

Typically, when performing a search in regedit, you highlight the first line ('Computer') and then perform the search. But since some of the branches shown are really subbranches, certain large sections of the registry are searched more than once when this common strategy is used.

Thus, this typical method is not efficient due to some branches of the registry being searched more than one time.

Given that the standard technique is inefficient, what is a simple and fast strategy to fully search the registry, preferably using regedit?

RockPaperLizard

Posted 2014-10-26T03:36:38.403

Reputation: 5 415

Have you tried find/find next? It takes a moment, but it would avoid transversing the branches. – Journeyman Geek – 2014-10-26T04:01:13.753

I'm not clear exactly what you mean. When you perform the Find, it searches from the the current position, without any way to avoid searching some of the subbranches more than once (due to how regedit shows the hierarchy). – RockPaperLizard – 2014-10-26T04:05:00.263

2An upvote for you then, I also find this issue tremendously annoying, mainly when searching in HKEY_USERS when parts of it were already searched and are actually entries for HKEY_CURRENT_USER – Ryakna – 2014-10-26T04:13:50.250

Thanks for your understanding, Arakel. And thanks for having the knowledge and experience to understand this question and why it is important. – RockPaperLizard – 2014-10-26T04:30:52.977

2There are registry tools that assist in searching, one of them is called RegSeeker from hoverdesk. With disclaimer to be careful about install, and there are cleaning operations that can do some nice damage :-) One thing about it that assists most is it just creates a whole list of things matching the search term. so everything you have to deal with at the moment is in one list. Also you can select sections of the registry and be selective about data key and all just like the regedit. I am sure there are others out there, because I have use those too. it then links back to the actual regedit. – Psycogeek – 2014-10-26T08:41:35.103

4@RockPaperLizard it might be worth editing your question to include the fact that the duplicate searching is due to the fact that the registry hives are cross linked in the fashion that Arakel mentioned. As it stands I feel that this is a rather important clarification. – Mokubai – 2014-10-26T09:33:34.997

@Mokubai I agree. I need to think of the right words. I'm not sure if the right words are cross-linked, or subsets, or other words to accurate convey it. I'm open to all ideas. OTOH, someone with an answer will know exactly what we are all talking about :-) – RockPaperLizard – 2014-10-26T09:47:49.313

@RockPaperLizard It's not RegEdit but maybe the tool RegAlyzer is something for you? It supports RegEx and distinguishes between keys, values and data types (numeric, strings, binary)

– nixda – 2014-10-26T14:05:14.563

I removed the downvote I issued. Yes; It was because I fear answers would lead to product recommendations without any sort of additional warning like registry tools are nothing but snake oil. – Ramhound – 2014-10-26T22:54:40.960

Does this link answer your question ? http://www.howtogeek.com/howto/windows-vista/finding-registry-keys-the-easy-way-in-vista-or-xp/

– user3025288 – 2014-10-30T12:47:07.613

Answers

5

Faster, and dumps all results so you can go through the whole list without hitting next a hundred times. Also free since it is a powershell script:

https://github.com/KurtDeGreeff/PlayPowershell/blob/master/Search-Registry.ps1

Search-Registry.ps1 improves on regedit's Find feature in four ways:

  • The script searches by using regular expressions.
  • It can search the registry on remote computers.
  • It can limit the number of returned search results.
  • It outputs objects than can be filtered, sorted, exported to comma-separated value (CSV) files, and so on.

glallen

Posted 2014-10-26T03:36:38.403

Reputation: 1 886

1

The script cannot be downloaded from the URL above. But it is available at https://github.com/KurtDeGreeff/PlayPowershell/blob/master/Search-Registry.ps1.

– sax – 2018-07-26T13:38:43.647

4

I would recommend the little and powerful tool RegScanner by Nirsoft.

David.P

Posted 2014-10-26T03:36:38.403

Reputation: 41

5

Please read How do I recommend software for some tips as to how you should go about recommending software. You should provide at least a link, some additional information about the software itself, and how it can be used to solve the problem in the question.

– DavidPostill – 2017-02-14T16:20:39.533

2

There's a very easy solution: start search in RegEdit when HKEY_LOCAL_MACHINE branch is focused on the left pane. This way you'll skip HKEY_CLASSES_ROOT and HKEY_CURRENT_USER branches, and you don't need them because HKEY_CLASSES_ROOT is actually a subkey of HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER is a subkey of HKEY_USERS.

Davie Ant

Posted 2014-10-26T03:36:38.403

Reputation: 39

2

There is a Software called RegEditX which is pretty fast: http://www.dcsoft.com/products/regeditx/

If you want a free Version search for the old v2.0, but 9.95$ isn't very much.

bejonwe

Posted 2014-10-26T03:36:38.403

Reputation: 136

1

1. Summary

Registry Finder I use Registry Finder to search the Windows registry.


2. Disclaimer

This answer is relevant for September 2019. In the future, its data may be outdated.


3. Features

  1. Fully free
  2. Actively maintained as of 2019
  3. Powerful
  4. Works for Windows XP and above

4. Speed

From official documentation:

Fast, non blocking search.

The Find operation is efficient and quick. All found items are displayed in a separate window as a list. Each line represents a single match with the search criteria. The icon shows where the match occurred: key name, value name or value data. Matched text is highlighted with red.

For example, I tried to search keys, values and data uTorrent in entire registry.

Registry Finder

Time — 37.4 seconds for ~500000 registry keys. That's speed enough for me.


5. Additional links

Саша Черных

Posted 2014-10-26T03:36:38.403

Reputation: 543