How to Use the reg Command in Windows 11 to Query, Add, and Export Registry Keys

The Windows Registry serves as the central hierarchical database storing low-level operating system configurations, hardware abstractions, device driver settings, and enterprise application parameters. While the graphical Registry Editor (regedit.exe) provides a visual interface for navigating hives and keys, automated fleet deployment, administrative remediation, and headless scripting demand a command-line interface. The native reg.exe console utility in Windows 11 enables system engineers and administrators to programmatically query, author, alter, export, and import registry keys and values via PowerShell or Command Prompt scripts without graphical overhead.

Windows Registry Hierarchy and Hive Abbreviations

The registry is organised into discrete roots termed “hives”. When using reg.exe, Windows supports shorthand abbreviations that streamline command-line construction. The table below outlines the primary root hives and their administrative roles:

Full Registry Hive Name	Command Shorthand	Scope & Stored Configurations
HKEY_LOCAL_MACHINE	HKLM	Machine-wide system settings, hardware abstraction layers, driver mappings, and global software policies.
HKEY_CURRENT_USER	HKCU	User-specific profile configurations, active desktop environment preferences, and user-level application states.
HKEY_CLASSES_ROOT	HKCR	File association handlers, COM object registrations, and programmatic identifiers (ProgIDs).
HKEY_USERS	HKU	All actively loaded individual user profiles on the host machine, indexed by Security Identifier (SID).
HKEY_CURRENT_CONFIG	HKCC	Hardware profile parameters dynamically gathered during the active hardware boot phase.

Core Registry Data Types Handled by reg.exe

When modifying registry entries, assigning the appropriate data type parameter (/t) is essential to prevent system service failures:

• REG_SZ: Standard null-terminated string, commonly used for human-readable descriptions, file paths, or state flags.
• REG_DWORD: 32-bit integer, standard for binary toggles (0 for disabled, 1 for enabled) and numerical parameters.
• REG_QWORD: 64-bit integer, employed for large memory allocations and high-precision system counters.
• REG_BINARY: Raw hexadecimal binary data, typically housing hardware profiles or encrypted tokens.
• REG_MULTI_SZ: Multiple string array separated by null characters, useful for multi-line path definitions or service lists.
• REG_EXPAND_SZ: Expandable string containing unparsed environment variables (e.g., %SystemRoot% or %USERPROFILE%) evaluated dynamically at runtime.

Querying Keys and Values with reg query

The reg query verb inspects the registry tree to retrieve keys, subkeys, and specific data entries without applying mutations.

1. Reading a Specific Named Value

To inspect whether Fast Startup is currently enabled on a Windows 11 machine, target the HiberbootEnabled value within Power Management:

reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled

The /v switch confines the output to the specified value name. If HiberbootEnabled returns 0x1, Fast Startup is active; 0x0 indicates it is disabled.

2. Recursive Searches and Pattern Matching

To recursively list all startup applications configured under the current user hive, utilise the /s parameter:

reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /s

To search for entries containing a specific string (such as locating all references to an antivirus suite), employ the /f filter flag:

reg query "HKLM\Software" /f "Defender" /s

Creating and Modifying Entries with reg add

The reg add command creates new keys, appends new values, or overwrites existing parameters. Modifying HKLM keys requires an elevated administrator command terminal.

1. Adding a DWORD Toggle

To disable automatic Windows Update driver installations via local policy registry flags, construct the command as follows:

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v ExcludeWUDriversInQualityUpdate /t REG_DWORD /d 1 /f

Command breakdown:

• "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate": Specifies the full hive path. If the intermediate subkey does not exist, reg.exe automatically generates it.
• /v ExcludeWUDriversInQualityUpdate: Declares the value name.
• /t REG_DWORD: Explicitly designates the 32-bit numerical type.
• /d 1: Imparts the assigned data value.
• /f: Forces the update without displaying an interactive confirmation prompt, ensuring seamless non-interactive script execution.

2. Adding Expandable Strings

When authoring paths containing environment variables, use REG_EXPAND_SZ:

reg add "HKLM\SOFTWARE\EnterpriseApp\Paths" /v LogDirectory /t REG_EXPAND_SZ /d "%SystemDrive%\Logs" /f

Exporting and Backing Up Registry Branches

Prior to introducing modifications, creating a point-in-time backup of the affected registry branch prevents catastrophic configuration drift.

1. Exporting to a .reg File

To export a branch to an ANSI/Unicode .reg text file, execute:

reg export "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer" "C:\Backups\LanmanServer_Backup.reg" /y

The /y flag suppresses confirmation prompts if the backup file already exists on disk.

2. Importing and Restoring Configurations

To restore a previously exported registry snapshot or apply enterprise template configurations:

reg import "C:\Backups\LanmanServer_Backup.reg"

Deleting Keys and Values with reg delete

Removing obsolete registry keys or resetting custom tweaks requires caution. Deleting a parent key permanently eliminates all contained subkeys and child values.

1. Deleting a Single Named Value

To remove a specific value while preserving the parent key structure:

reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OldUpdater" /f

2. Deleting an Entire Registry Subkey Branch

To purge a deprecated software key and all its associated configuration leaves:

reg delete "HKCU\Software\DeprecatedVendor" /f

Troubleshooting Common reg.exe Operational Errors

When running automated registry commands, administrators frequently encounter specific diagnostic errors:

• ERROR: Access is denied: Occurs when modifying keys under HKLM, HKCR, or other restricted system hives without elevated credentials. Ensure the terminal is initiated via Run as Administrator. Certain system-protected keys also require granting permissions beyond local Administrator using tools like PsExec with SYSTEM privileges.
• ERROR: The system was unable to find the specified registry key or value: Indicates a typographical error in the path or a missing parent key. Verify the spelling of the hive name and confirm path existence using reg query before running modification scripts.
• 32-bit vs. 64-bit Registry Redirection: On 64-bit Windows 11 systems, 32-bit processes querying HKLM\Software are automatically redirected to HKLM\Software\WOW6432Node. Use the /reg:32 or /reg:64 switch to explicitly force the command to target the desired view:

  reg query "HKLM\Software" /reg:64