I've often wondered how to use Windows Search Filters. The available documentation is extremely limited, but its potential uses are quite large.

When I type something, the only search filters I see are "Date modified" and "Size". Googling shows me a few other options that, sometimes, work. Every time I try to use it I'm pondering "what search filters can I use, and what options does each filter support?". Anybody any idea where to find an extensive list or how to configure Search to give me a dropdown of the possibilities?

To find something, I always go back to a command prompt. I'd like to think I can do otherwise.

enter image description here


2 Answers 2


Instead of "Search Filters", the keywords/phrase you're actually looking for is "Advanced Query Syntax".

As always, MSDN is the place to turn to for further help and details:

BTW, if you need a far better search utility with RegEx support, try AstroGrep or Everything.

  • AQS is said to be used by WDS, "an obsolete technology" but still used in Windows 10. AQS keywords are dependent on Windows locale: kind, in, folder, date are valid for English. Here comes the funny part. Localized syntax user guides with local keywords are machine translated, a smarter choice. For French instead of using sent:yesterday, it suggests envoyé:hier, this may work with accents, but mots clés:"projections de ventes » in place of keywords:"sales projections" is highly suspicious...
    – mins
    Jun 24, 2022 at 10:37

To search based on file system attributes (e.g., hidden, system, read-only, etc.), use the intuitively obvious but largely undocumented attributes keyword.  As discussed in this thread on Windows 7 Help Forums, the usage is


The file attribute values (constants) are


(The aforementioned Windows 7 Help Forums says that FILE_ATTRIBUTE_ENCRYPTED is 64, but this page about the ATTRIB command says that it is 16384.  My testing (on Windows 7) indicates that 16384 is the correct value.)

So, for example, attributes:1 searches for files that have the READONLY attribute set.  Only.  This will not find files that have both the READONLY and the ARCHIVE attributes set, use attributes:33 for that.  To find both (i.e., files that have the READONLY attribute set, but not HIDDEN, SYSTEM, ENCRYPTED, COMPRESSED, or any of the other exotic, extended attributes, regardless of the state of the ARCHIVE attribute), you could use

attributes:1 OR attributes:33

But this syntax gets unwieldy quickly.  Luckily, there is an abbreviated form:

attributes:(1 OR 33)

Conjunction/disjunction keywords (AND and OR) must be capitalized; search filter (property) keywords like attributes (and filename, kind, type, date, datemodified, size, owner, datetaken, author, title, etc.) are case-insensitive.  By the way, if you like extra typing, you can say system.fileattributes instead of attributes.

So here are the numeric search codes for all possible searches based on the R, H, and A attributes.  (+R represents all read-only files, regardless of H and A status; +R -H is the example from above – all non-hidden read-only files.)

Attributes (symbolic)          Numeric attributes: value(s)
  +R   (1 OR 3 OR 33 OR 35)
  +R +H   (3 OR 35)
  +R +H +A   35
  +R +H -A   3
  +R -H   (1 OR 33)
  +R -H +A   33
  +R -H -A   1
  +R +A   (33 OR 35)
  +R -A   (1 OR 3)
  -R   (0 OR 2 OR 32 OR 34 OR 128)
  -R +H   (2 OR 34)
  -R +H +A   34
  -R +H -A   2
  -R -H   (0 OR 32 OR 128)
  -R -H +A   32
  -R -H -A   (0 OR 128)
  -R +A   (32 OR 34)
  -R -A   (0 OR 2 OR 128)
  +H   (2 OR 3 OR 34 OR 35)
  +H +A   (34 OR 35)
  +H -A   (2 OR 3)
  -H   (0 OR 1 OR 32 OR 33 OR 128)
  -H +A   (32 OR 33)
  -H -A   (0 OR 1 OR 128)
  +A   (32 OR 33 OR 34 OR 35)
  -A   (0 OR 1 OR 2 OR 3 OR 128)


  • Any query term can be inverted by preceding it with - (minus).  For example, you can find everything except hidden read-only files with -attributes:(3 OR 35).
  • Naturally, even if you use the attributes keyword to search for hidden files, you will not find any unless you have “Show hidden files, folders, and drives” selected in “Folder Options”.
  • Logically, files with no attributes set should have an attributes value of 0, but this seems not to be the case.  In my experience, they have an attributes value of NORMAL (128).
  • To search for directories, and/or files/directories that are compressed, encrypted, not indexed, or have the SYSTEM attribute set, add the appropriate constant(s) from the first table to the values in the above table.  It should not be necessary to include the “128” values; e.g., for -R -H +S -A, it should be good enough to search for 4 rather than (4 OR 132).
  • Remember that folders that are “customized” (e.g., with a non-standard icon) have the READONLY attribute set.  (Customizations are stored in a hidden, system desktop.ini file.)
  • You don’t need to use the attributes keyword to search for directories only (i.e., excluding files) if you don’t care about the other attributes; just use type:folder.  Likewise, -type:folder searches for files only (excluding directories).  Do not confuse this with kind:folder, which will find true file system folders, but also collection files like *.CAB and *.ZIP.
  • Also, you can search for encrypted files and directories with encryptionstatus:encrypted or is:encrypted.  The inverse can be specified as -encryptionstatus:encrypted, -is:encrypted, or encryptionstatus:unencrypted.
  • Naturally, even if you use the attributes keyword to search for system files, you will not find any unless you have “Hide protected operating system files” deselected in “Folder Options”.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .