26

Because the Windows registry is a hierarchy, the way regedit is laid out makes typical searches inefficient and slow.

Typically, when performing a search in regedit, you highlight the first line ('Computer') and then perform the search. But since some of the branches shown are really subbranches, certain large sections of the registry are searched more than once when this common strategy is used.

Thus, this typical method is not efficient due to some branches of the registry being searched more than one time.

Given that the standard technique is inefficient, what is a simple and fast strategy to fully search the registry, preferably using regedit?

10
  • Have you tried find/find next? It takes a moment, but it would avoid transversing the branches.
    – Journeyman Geek
    Oct 26, 2014 at 4:01
  • I'm not clear exactly what you mean. When you perform the Find, it searches from the the current position, without any way to avoid searching some of the subbranches more than once (due to how regedit shows the hierarchy). Oct 26, 2014 at 4:05
  • 2
    An upvote for you then, I also find this issue tremendously annoying, mainly when searching in HKEY_USERS when parts of it were already searched and are actually entries for HKEY_CURRENT_USER
    – Ryakna
    Oct 26, 2014 at 4:13
  • 2
    There are registry tools that assist in searching, one of them is called RegSeeker from hoverdesk. With disclaimer to be careful about install, and there are cleaning operations that can do some nice damage :-) One thing about it that assists most is it just creates a whole list of things matching the search term. so everything you have to deal with at the moment is in one list. Also you can select sections of the registry and be selective about data key and all just like the regedit. I am sure there are others out there, because I have use those too. it then links back to the actual regedit.
    – Psycogeek
    Oct 26, 2014 at 8:41
  • 4
    @RockPaperLizard it might be worth editing your question to include the fact that the duplicate searching is due to the fact that the registry hives are cross linked in the fashion that Arakel mentioned. As it stands I feel that this is a rather important clarification.
    – Mokubai
    Oct 26, 2014 at 9:33

5 Answers 5

8

I would recommend the little and powerful tool RegScanner by Nirsoft.

1
  • 7
    Please read How do I recommend software for some tips as to how you should go about recommending software. You should provide at least a link, some additional information about the software itself, and how it can be used to solve the problem in the question.
    – DavidPostill
    Feb 14, 2017 at 16:20
7

Faster, and dumps all results so you can go through the whole list without hitting next a hundred times. Also free since it is a powershell script:

https://github.com/KurtDeGreeff/PlayPowershell/blob/master/Search-Registry.ps1

Search-Registry.ps1 improves on regedit's Find feature in four ways:

  • The script searches by using regular expressions.
  • It can search the registry on remote computers.
  • It can limit the number of returned search results.
  • It outputs objects than can be filtered, sorted, exported to comma-separated value (CSV) files, and so on.
# Download script
curl https://raw.githubusercontent.com/KurtDeGreeff/PlayPowershell/master/Search-Registry.ps1 -OutFile Search-Registry.ps1

# View docs
Get-Help .\Search-Registry.ps1

# Simple example (search HKEY_CURRENT_USER for values with data containing "powershell")
.\Search-Registry -StartKey HKCU -Pattern "PowerShell" -MatchData
0
5

There's a very easy solution: start search in RegEdit when HKEY_LOCAL_MACHINE branch is focused on the left pane. This way you'll skip HKEY_CLASSES_ROOT and HKEY_CURRENT_USER branches, and you don't need them because HKEY_CLASSES_ROOT is actually a subkey of HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER is a subkey of HKEY_USERS.

1
  • I think this is less of a "very easy solution" sort of answer, and more of a "You can save time by..." sort of answer. But definitely good to be aware of.
    – mwfearnley
    Oct 12, 2020 at 13:30
5

1. Summary

Registry Finder I use Registry Finder to search the Windows registry.


2. Disclaimer

This answer is relevant for September 2019. In the future, its data may be outdated.


3. Features

  1. Fully free
  2. Actively maintained as of 2019
  3. Powerful
  4. Works for Windows XP and above

4. Speed

From official documentation:

Fast, non blocking search.

The Find operation is efficient and quick. All found items are displayed in a separate window as a list. Each line represents a single match with the search criteria. The icon shows where the match occurred: key name, value name or value data. Matched text is highlighted with red.

For example, I tried to search keys, values and data uTorrent in entire registry.

Registry Finder

Time — 37.4 seconds for ~500000 registry keys. That's speed enough for me.


5. Additional links

1
  • This is modern and robust, much better than the old RegScanner, and most importantly, supports the dark theme, too. Jul 15, 2023 at 8:13
1

There is a Software called RegEditX which is pretty fast: http://www.dcsoft.com/products/regeditx/

If you want a free Version search for the old v2.0, but 9.95$ isn't very much.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .