How to Manipulate Unloaded Registry Hives Using RegFind

ID: Q146303

The information in this article applies to:

Microsoft Windows NT Server version 4.0
Microsoft Windows NT Workstation version 4.0

SUMMARY

The Windows NT 4.0 Resource Kit RegFind utility lets you search and replace data values in the registry. This article complements the information provided in the resource kit and explains how to use this tool to manipulate unloaded registry hives.

MORE INFORMATION

The syntax of the RegFind utility is:


   REGFIND [-h hivefile hiveroot | -w Win95 Directory | -m \\machinename]
      [-i n] [-o outputWidth]
      [-p RegistryKeyPath] [-z | -t DataType] [-b | -B] [-y] [-n]
      [searchString [-r ReplacementString]]

The -h option lets you specify:

the registry hive file

the keyroot name which references that hive in both the output and the command-line arguments

The -p option lets you specify the registry key path where the search starts.

Sample:


   regfind -h "c:\winnt\Profiles\UserX\ntuser.dat" KEYR -p KEYR\Software
   WINNT

In this sample, RegFind displays all keys containing the WINNT string in the data value. The search will start under the Software subkey in the UserX's registry hive The KEYR argument specifies the registry key name for the root key of this hive.

Additional query words: prodnt rkit

Keywords : kbtool nthowto ntregistry ntreskit NTSrvWkst
Version : 4.0
Platform : winnt
Issue type : kbhowto