# Scripts to manage registry keys on Windows devices The registry is a vital component of the Windows operating system that stores essential system and application settings. Modifying registry keys can be a powerful way to customize and configure Windows devices, but it can also be a daunting task, especially when managing many devices. To simplify the process, administrators can use scripts to automate the management of registry keys on Windows devices. Using Hexnode’s [Execute Custom Script](https://www.hexnode.com/mobile-device-management/help/executing-custom-scripts-for-windows/) feature you can deploy scripts on multiple devices from a single platform. Disclaimer:- Edit the registry only when there are no other alternatives. Altering the registry settings may have conflicts with the standard safeguards and damage the system. - The sample scripts provided below are adapted from third-party open-source sites. PowerShell commands to manage registry keys ------------------------------------------- ### List all subkeys in local machine registry To list all the subkeys present in the local machine registry, use the following command: Script to list all subkeys of a local machine registry Get-ChildItem -Path HKLM:\\ | Select-Object Name 1 Get-ChildItem -Path HKLM:\\ | Select-Object Name ### Create a subkey inside the local machine registry To add a subkey in the local machine registry, use the following syntax: PowerShell script to add a subkey in local machine registry New-Item -Path HKLM:\\\\ 1 New-Item -Path HKLM:\\\\ For example, to create a subkey named ‘newkey’ inside the SOFTWARE subkey of the local machine registry. `New-Item -Path HKLM:\SOFTWARE\newkey` To add a new key having spaces in its name, use the following code: `New-Item -Path ‘HKLM:\SOFTWARE\new key’` ### Delete a subkey from the local machine registry To silently delete a subkey from the local machine registry, use the following syntax: PowerShell script to delete a subkey in local machine registry Remove-Item -Path HKLM:\\\\ 1 Remove-Item -Path HKLM:\\\\ For example, to delete a subkey named ‘key\_to\_be\_deleted’ inside the SOFTWARE subkey of the local machine registry. `Remove-Item -Path HKLM:\SOFTWARE\key_to_be_deleted ` ### Delete all keys under a specific key To remove all keys within a specified subkey but not the key itself, use the syntax: PowerShell script to delete all keys under a specific key Remove-Item -Path HKLM:\\\\\\\* -Recurse 1 Remove-Item -Path HKLM:\\\\\\\* -Recurse For example, to remove all keys under the key ‘key\_name’ but itself, inside the HARDWARE subkey of the local machine registry. `Remove-Item -Path HKLM:\HARDWARE\key_name\* -Recurse` Batch commands to manage registry keys -------------------------------------- ### Add a new subkey to the local machine registry To add a new subkey or entry to the local machine registry, use this syntax: Batch script to add a subkey in local machine registry reg add \[{/v value | /ve}\] \[/t datatype\] \[/s separator\] \[/d data\] /f 1 reg add \[{/v value | /ve}\] \[/t datatype\] \[/s separator\] \[/d data\] /f ParameterDescriptionStates the full path of the subkey or entry to be added in the local machine./v States the name of the add registry entry./veStates that the registry entry being added has no value./t States the registry entry type. Type must be one of the following: - REG\_SZ - REG\_MULTI\_SZ - REG\_DWORD\_BIG\_ENDIAN - REG\_DWORD - REG\_BINARY - REG\_DWORD\_LITTLE\_ENDIAN - REG\_LINK - REG\_FULL\_RESOURCE\_DESCRIPTOR - REG\_EXPAND\_SZ /s States the character that will separate multiple instances of data in the case of the **REG\_MULTI\_SZ** data type where there is more than one entry listed. In the absence of a specified separator, the default separator used will be **\\0**./d States the data for the new registry entry.For example, to add a registry entry to *HKLM\\Software\\keyname* with a value named Value, the type *REG\_BINARY*, and data of *ge453ted*, use the following command: `reg add HKLM\Software\keyname /v Value /t REG_BINARY /d ge453ted /f` ### Delete a subkey from the local machine registry To delete a subkey from the local machine registry, use the following syntax: Batch script to delete a subkey in local machine registry reg delete \[{/v value | /ve | /va}\] /f 1 reg delete \[{/v value | /ve | /va}\] /f ParameterDescriptionStates the complete path of the entry or subkey to be removed from the local machine./v Deletes a particular entry within a subkey. If no specific entry is identified, all entries and subkeys contained within the subkey will be deleted./veStates that only entries that have no value will be removed./vaStates that the specified key’s entries will be deleted, while any subkey entries contained within it will remain unaffected.For example, to delete the registry key *child\_subkey* along with its parent keys and values inside the *Software* subkey. `reg delete HKLM\Software\keyname\parent_key\child_subkey /f` ### Export subkeys, entries & values of the local machine into a file The subkeys, entries, and values of the local computer can be duplicated and saved in a file to facilitate transfer to other servers, using this syntax: Batch script to copy subkeys to a file reg export \[/y\] 1 reg export \[/y\] ParameterDescriptionStates the full path of the subkey in the local machine.States the name and path of the file with .reg extension./yOverwrites any file that already exists with the name file without requiring confirmation.For example, to export all the values and content of the subkey *child\_subkey* to the file *file\_name.reg*. `reg export HKLM\Software\child_subkey file_name.reg` ### Import file content to local machine registry The registry subkeys, entries, and values from an exported file can be transferred and added to the registry of the local computer, using this syntax: Batch script to copy file content to the local computer registry reg import 1 reg import ParameterDescriptionStates the name and path of the file with .reg extension which has content that needs to be copied to the local computer registry. It is necessary to first create the file using the “reg export” command./reg:32States that the 32-bit registry view should be used to access the specified key./reg:64States that the 64-bit registry view should be used to access the specified key.For example, to import registry subkeys, entries, and values to a file named *file\_name.reg*: `reg import file_name.reg` ### Save a copy of registry subkeys, entries & values in a file A specified file can be used to store a copy of specific subkeys, entries, and values from the registry, using the syntax: Batch script to save copy of subkeys in a registry to a file reg save \[/y\] 1 reg save \[/y\] ParameterDescriptionStates the full path of the subkey in the local machine.States the name and path for the created file. If you fail to include a path, the current path will be considered./yOverwrites any file that already exists with the name file without requiring confirmation. For example, to save the hive *child\_subkey* as a file named *Name\_of\_file.hiv* in the current folder, you can use the following command. `reg save HKLM\Software\child_subkey Name_of_file.hiv` ### Restore subkeys & entries back to the local machine registry This command writes the saved subkeys and entries back to the local machine registry. Batch script that writes saved subkeys back to registry reg restore 1 reg restore ParameterDescriptionStates the complete subkey path to be restored in the local machine.States the file path and filename containing the data to be written to the registry. It’s mandatory to create this file beforehand using the “reg save” command and ensure that it has a .hiv extension.For example, if you want to restore the file named “Name\_of\_file.hiv” and overwrite the existing contents of the key *HKLM\\Software\\child\_subkey*, you can use the following command. `reg restore HKLM\Software\child_key Name_of_file.hiv` Notes:- Before modifying any of the registry entries, it is advisable to use the reg save command to save the parent subkey. Thus, you can restore the original subkey with the reg restore command in case the modifications causes any undesired effects. - It is recommended to manually validate the script execution on a system before executing the action in bulk. - Hexnode will not be responsible for any damage/loss to the system on the behavior of the script.