Windows Registry Commands
Windows Registry
The windows registry is a hierarchical database that contains configuration settings and options for thw Windows OS applications, hardware and user preferences. It acts as a central repository for system setting, replacing older configuration files like INI files .
Key features of windows registry
stores system-wide and user-specific settings.
used by the Windows OS, drivers, services and applications
helps configure and control hardware and software behaviour.
Enables automatic startup settings for programs.
Windows Registry Structure
The registry is organiazed into hierarchical structure, similar to folders in a file system.
Hive - A root-level container storing registry data(like a drive)
Key - A subfolder inside a hive (can contain more keys or values).
Value - A specific settings stored inside a key( like a file with data).
Example :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersionHere:
HKEY_LOCAL_MACHINE→ HiveSOFTWARE→ KeyMicrosoft→ SubkeyWindows→ SubkeyCurrentVersion→ Contains various values related to the windows version
Main Registry Hives
HKEY_CLASSES_ROOT(HKCR)
Stores the associations and COM objects.
HKEY_CURRENT_USER (HKCU)
Stores settings for the logged in users.
HKEY_LOCAL_MACHINE (HKLM)
Stores system-wide settings (hardware,drivers,software).
HKEY_USERS (HKU)
Stores information for all user accounts.
HKEY_CURRENT_CONFIG (HKCC)
Stores current system configurations.
The registry file located in directory:-
%SystemRoor%\System32\ConfigThis Directory includes the following files
Registry Files
Default - The default registry file (imp).
SAM - The Security ACcounts Manager registry file (imp).
Security - The security registry file (imp).
Software - The application software registry file (imp).
System - The system registry file (imp).
Default.sav - A backup copy of the default registry file.
Software.sav - A backup copy of application software registry file (imp).
System.sav - A backup copy of system registry file (imp).
autoexec.nt and config.nt - Files that initialize MS-DOS enviornment (old windows)
AppEvent.evt - The application event log file (old windows).
SecEvent.evt - The security event file (old windows)
SysEvent.evt - The system event log file (old windows)
Userdiff - the file that migrates preexisting user profile from previous version of windows.
Opening The Registry editor
C:\Windows\regedit.exeManaging the Windows registry from command prompt
Viewing Registry Command Options
reg /?Common Registry Commands
Query Registry
reg QUERY hkcu\software\microsoft\windows\currentversion\policies\exporer /v nodesktopAdd a Registry Entry
reg ADD hkcu\software\microsoft\windows\currentversion\policies\explorer /v nodesktop /t reg_dword /f /d 1nodesktop means there will be no icons on desktop
Delete a Registry Entry
reg DELETE hkcu\software\microsoft\windows\currentversion\policies\exploror /v nodesktop \fSave Registry Key
save in binary form
reg SAVE hkcu\software\microsoft\windows\currentversion\policies\explorer hkcu_explorer.hivRestore Registry Key
reg restore hkcu\software\microsoft\windows\currentversion\policies\explorer hkcu_explorer.hivExport Registry Key
save in human readable form
reg EXPORT hkcu\software\microsoft\windows\currentversion\policies\explorer hkcu_explorer.regImport Registry Key
reg IMPORT hkcu_explorer.regCopy Registry Key
reg COPY hkcu\software\microsoft\windows\currentversion\policies\explorer hklm\software\microsoft\windows\currentversion\policies\explorer /fCompare Registry Keys
reg COMPARE hkcu\software\microsoft\windows\currentversion\policies\explorer hklm\software\microsoft\windows\currentversion\policies\explorerUseful Registry Modification
Disable USB Device
reg ADD hklm\system\currentcontrolset\services\usbstor /v Start /t reg_dword /f /d 4Add Programs to Windows Startup
reg ADD hkcu\software\Microsoft\windows\currentversion\run /v program_name /t reg_sz /f /d "C:\\path\\to\program.exeQuery USB Devices
reg QUERY HKEY_LOCAL_MACHINE\SYSTEM\controllerset002\Enum\USBSTOR\Query Mounted Devices
reg QUERY HKEY_LOCAL_MACHINE\SYSTEM\mounteddevicesQuery Recent Application
reg QUERY HKEY_CURRENT_USER\software\microsoft\windows\currentversion\search recentappsFind Windows Install Time and Date
the output will be UNIX hex so convert it.
reg QUERY "HKLM\SOFTWARE\Microsoft\windows NT\currentversion" /v InstallDateModify Utilman.exe to cmd.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\currentversion\Image File Execution Option\Utilman.exe /t REG_SZ /v Debugger /d "%systemroot%\system32\cmd.exe" /gPassword Mining
reg QUERY HKLM /f passw /t REG_SZ /s
reg QUERY HKCU /f passw /t REG_SZ /sSaving Windows Passwords
mkdir c:\pass
reg SAVE hklm\sam c:\pass\sam
reg SAVE hklm\system c:\pass\systemWindows Explorer Policy Settings (Registry Keys)
These registry keys can be found at:
For Current User: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
For All Users: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Each key should be set as a REG_DWORD (1 to Enable, 0 to Disable).
🧷 List of Registry Restrictions in Windows 11
NoDesktop
Hides all desktop icons & right-click
✅
❌
NoRun
Removes “Run” from Start Menu
✅
❌
NoPower
Hides Shutdown, Restart, Sleep in Start Menu
✅
❌
NoClose
Disables the Shut Down option in Start Menu
✅
❌
NoTaskManager
Disables Task Manager (Ctrl + Shift + Esc)
✅
❌
NoControlPanel
Blocks Control Panel & Settings app
✅
❌
NoFolderOptions
Hides Folder Options in File Explorer
✅
❌
NoDrives
Hides specific drives (C:, D: etc.)
✅
❌
NoSearchCommands
Disables Windows Search in Start & Taskbar
✅
❌
NoRecentDocsMenu
Removes Recent Documents from File Explorer
✅
❌
NoTrayContextMenu
Disables System Tray right-click menu
✅
❌
NoNetworkConnections
Blocks Network Settings
✅
❌
HideFastUserSwitching
Hides Switch User option
✅
❌
Last updated