How to Manipulate Unloaded Registry Hives Using RegFind

View products that this article applies to.

This article was previously published under Q146303

Expand all | Collapse all

SUMMARY

The Windows NT 4.0 Resource Kit RegFind utility lets you search and replace data values in the registry. This article complements the information provided in the resource kit and explains how to use this tool to manipulate unloaded registry hives.

MORE INFORMATION

The syntax of the RegFind utility is:

   REGFIND [-h hivefile hiveroot | -w Win95 Directory | -m \\machinename]
      [-i n] [-o outputWidth]
      [-p RegistryKeyPath] [-z | -t DataType] [-b | -B] [-y] [-n]
      [searchString [-r ReplacementString]]

The -h option lets you specify:

the registry hive file
the keyroot name which references that hive in both the output and the command-line arguments

The -p option lets you specify the registry key path where the search starts.

Sample:

   regfind -h "c:\winnt\Profiles\UserX\ntuser.dat" KEYR -p KEYR\Software
   WINNT

In this sample, RegFind displays all keys containing the WINNT string in the data value. The search will start under the Software subkey in the UserX's registry hive The KEYR argument specifies the registry key name for the root key of this hive.