C:\>reg query /? REG QUERY KeyName [/v [ValueName] | /ve] [/s] [/f Data [/k] [/d] [/c] [/e]] [/t Type] [/z] [/se Separator] [/reg:32 | /reg:64] KeyName [\\Machine\]FullKey Machine - Name of remote machine, omitting defaults to the current machine. Only HKLM and HKU are available on remote machines FullKey - in the form of ROOTKEY\SubKey name ROOTKEY - [ HKLM | HKCU | HKCR | HKU | HKCC ] SubKey - The full name of a registry key under the selected ROOTKEY /v Queries for a specific registry key values. If omitted, all values for the key are queried. Argument to this switch can be optional only when specified along with /f switch. This specifies to search in valuenames only. /ve Queries for the default value or empty value name (Default). /s Queries all subkeys and values recursively (like dir /s). /se Specifies the separator (length of 1 character only) in data string for REG_MULTI_SZ. Defaults to "\0" as the separator. /f Specifies the data or pattern to search for. Use double quotes if a string contains spaces. Default is "*". /k Specifies to search in key names only. /d Specifies the search in data only. /c Specifies that the search is case sensitive. The default search is case insensitive. /e Specifies to return only exact matches. By default all the matches are returned. /t Specifies registry value data type. Valid types are: REG_SZ, REG_MULTI_SZ, REG_EXPAND_SZ, REG_DWORD, REG_QWORD, REG_BINARY, REG_NONE Defaults to all types. /z Verbose: Shows the numeric equivalent for the type of the valuename. /reg:32 Specifies the key should be accessed using the 32-bit registry view. /reg:64 Specifies the key should be accessed using the 64-bit registry view. Examples: REG QUERY HKLM\Software\Microsoft\ResKit /v Version Displays the value of the registry value Version REG QUERY \\ABC\HKLM\Software\Microsoft\ResKit\Nt\Setup /s Displays all subkeys and values under the registry key Setup on remote machine ABC REG QUERY HKLM\Software\Microsoft\ResKit\Nt\Setup /se # Displays all the subkeys and values with "#" as the seperator for all valuenames whose type is REG_MULTI_SZ. REG QUERY HKLM /f SYSTEM /t REG_SZ /c /e Displays Key, Value and Data with case sensitive and exact occurrences of "SYSTEM" under HKLM root for the data type REG_SZ REG QUERY HKCU /f 0F /d /t REG_BINARY Displays Key, Value and Data for the occurrences of "0F" in data under HKCU root for the data type REG_BINARY REG QUERY HKLM\SOFTWARE /ve Displays Value and Data for the empty value (Default) under HKLM\SOFTWARE C:\>