Registry Tasks and Tools (part 1) - Search the Registry & Search and Replace Registry Data

1. Search the Registry

The Registry Editor has a simple (to a fault) Search feature, allowing you to search through all the keys and values for text. Just select Find from the Registry Editor's Edit menu, type the desired text (Figure 1), and click Find Next.

The Registry Editor's Search feature is pretty terrible. For one, it's hopelessly slow, and doesn't show a history of past searches. But its biggest drawback is that it only shows one match at a time; you have to click Find Next repeatedly to cycle through all the search results, one by one. And if you accidentally double-click Find Next, there's no going backward. Finally, there's no search-and-replace feature, but more on that later.

Press Ctrl-F or select Edit → Find to begin a search at the selected key. (Scroll to the top and select Computer beforehand to search the entire Registry.)

In the Find window, make sure that all three options in the Look at section are checked, unless you know specifically that what you're looking for is solely a Key, a Value (value name), or Data (value contents). You'll also usually want the Match whole string only option turned off, unless you're searching for text that commonly appears in other words; searching for handle might otherwise trigger entries like PersistentHandler and TeachAndLearn.

You may need to employ some tricks to find certain types of things in the Registry, such as:

Context menu items

Context menu items are usually stored in the HKEY_CLASSES_ROOT branch. When searching for any menu items, keep in mind that most of them have underlined characters to signify keyboard shortcuts, even though, ironically, Windows Vista doesn't display them by default. For instance, the Datasheet action associated with Access Form Shortcuts in Microsoft Office 2007 is actually stored as Data&sheet in the Registry. This allows it to be displayed as Datasheet if you manage to open the menu with the keyboard (an increasingly difficult task in Windows Vista). The &Data&sheet instructs Windows to underline the character that follows it (the s in this case), and since it's present in the Registry value, you'll need to include the & character in your searches; if you don't, the Search tool won't find it. character in

Text searches are not case-sensitive, so you don't have to worry about capitalization when typing your search terms.

File and folder names

Despite the fact that long filenames (those longer than the archaic 8-dot-3 standard left over from the early days of DOS) had been in wide use on the PC platform for well over a decade before Windows Vista was released, short filenames^[3] still have a role in modern Windows computing, particularly in the Registry. Specifically, a folder path like C:\Program Files may be occasionally represented in its short 8.3 form: C:\PROGRA~1.

Why, even Microsoft still uses short filenames; a fresh installation of Office 2007 (introduced alongside Windows Vista) placed a reference in the Registry to C:\PROGRA~1\MICROS~2\Office12\1033\ACCESS12.ACC.

Unfortunately, this means you need to search for both the long and short versions of a file or folder name if you want to find them all. For example, say you want to move your Program Files folder from one drive to another. When you install Windows, any settings pertaining to this folder may be stored in the Registry as C:\Program Files or C:\Progra~1. Make sure you search for both.

Now, when searching the Registry for both Program Files and Progra~1, it may occur to you to just search for progra, which will indeed catch both variations. Because this will stumble upon other instances of the word program, try limiting the results by placing a backslash (\) in front of the text (e.g., \progra) to limit the search to only directory names beginning with those letters. Neato.

DLLs, classes, components, extensions, and CLSIDs

Windows and all your applications are constructed from smaller building blocks, sometimes referred to as classes, extensions, or objects. I'll spare you a tirade on COM components, .NET architecture, and a bunch of other developer jargon (sorry). Suffice it to say, the majority of these building blocks are registered in the HKEY_CLASSES_ROOT\CLSID branch of your Registry, and are identified by a 32-digit (16-bit hex) code called a Class ID, or CLSID. CLSIDs are formatted like this:

{AC0EEBCA-73FA-4EB3-87FF-96E58401FA1F}

Why is this important? It means that you can track down where a class is referenced (in other words, where in Windows it's used) as well as where it's registered, all by searching the Registry for the CLSID.

For instance, configuration data for the aforementioned class is located in:

HKEY_CLASSES_ROOT\CLSID\{AC0EEBCA-73FA-4EB3-87FF-96E58401FA1F}

If a component isn't working, odds are you can fix the problem, or at least help diagnose it, by fussing with the values in this key. Or, delete the key altogether to effectively unregister the class with Windows. For instance, to turn off Vista's support for "compressed folders" (ZIP files appearing as folders in Windows Explorer), you need to delete two such CLSID branches.

If a CLSID is found elsewhere (even within another key under HKEY_CLASSES_ROOT\CLSID), it means that the program that owns the key is using said component. Delete the reference, and the link is broken.

2. Search and Replace Registry Data

The Registry Editor has no search-and-replace feature, seemingly with good reason: a single poorly chosen replace operation could make Windows inoperable. But there are times when you do need to replace all occurrences of, say, a folder name like C:\Program Files\My Program with another folder name like D:\My Folder. Depending on the number of occurrences, such an operation could take hours.

Registry Agent (part of Creative Element Power Tools, available at http://www.creativelement.com/powertools) not only gives you a better way to search the Registry (search results are shown in a list, instead of one at a time), but supports search-and-replace operations as well. Here's how to move an application from one drive to another without having to reinstall it:

Even if you don't use the search-and-replace feature, Registry Agent is a pretty slick searching tool, as it overcomes the annoying hunt-and-peck approach of the Registry Editor's Search feature and ends up being much faster, too.