The latest version of Registry Finder is 2.55 (November 06, 2022). What's new
powershell get-filehash <filename>
and compare the output with the SHA256 above.
Registry Finder is an improved replacement for the built-in Windows registry editor. It has many features that makes working with registry more productive, comfortable and safe, including:
- Cut/Copy/Paste keys and/or values.
- Undo and redo registry modifications (except changing permissions).
- Multiple local and remote registry windows.
- Fast, non blocking search.
- Whole search results are displayed in a list.
- Multiple search results window.
- Ability to search within previous search results narrowing down your search scope.
- Ability to search for hidden keys.
Registry Finder allows you to browse the local registry; create, delete, rename keys and values; modify values as its natural data type (string, multistring, DWORD) or as a binary data. It is allowed to open multiple Registry windows. Next time you start Registry Finder, those windows will be reopened on the same keys as before.
The Find operation is efficient and quick. All found items are displayed in a separate window as a list. Each line represents a single match with the search criteria. The icon shows where the match occurred: key name, value name or value data. Matched text is highlighted with red.
You can jump to any found item in the Registry window or edit/delete items right in the Find Results window.
Items in the Find Results window can be saved to file in .reg or .txt format. In latter case, items are separated by tabulator. It allows easy data importing and analyzing in other programs, such as Microsoft Excel.
With the Replace feature you can easily replace all or particular occurrences of one string with another. The replacement is performed only in items that are in the Find Results window. In the Replace dialog you specify either all items or just selected ones. After replacement is done, items in the window are updated. If some item do not match the search criteria any more it still remains in the list.
All operations that alter the registry including deletion and replacement can be undone and redone. The operations are listed in the History window. To open it, click View|History in the main menu. The last performed operation is marked with a yellow arrow.
Full name of the key can be copied to clipboard.
Registry Finder can be used without installation. Just download archive with binaries, unpack it into any folder on HDD or USB drive and start the executable. The utility does not store any of its data in the registry. It stores settings in the RegistryFinder.config file located in the same folder as the executable.
Another option is to download and run the installer. It contains both 32-bit and 64-bit versions of binaries, so you do not need to choose. The installer can deploy Registry Finder either in Normal mode or in Portable mode. The later just unpacks binaries into the folder you specify. The Normal mode performs standard things - unpack binaries, create shortcut in the Start Menu, create a desktop icon and make uninstallation entry in the Control Panel. One little difference is that in Normal mode the config file is stored in another place. Specifically, in the %APPDATA%\RegistryFinder folder.
Running as Administrator
Unlike Windows registry editor, by default, Registry Finder runs with limited privileges even when you are an administrator. This is more secure, but may cause Access denied errors when you're attempting to do some changes. To avoid such errors you should launch Registry Finder with elevated privileges.
Registry Finder allows you to restart himself as admin through the File | Restart as Administrator menu. (This menu is absent if Registry Finder already running as admin.)
If you want to always launch as admin, you can create shortcut and set the Run as administrator option (right click the shortcut, select Properties, click Advanced).
When Registry Finder is running as administrator, the window title contains the word "Administrator", for example: Registry Finder - Administrator - [Local Registry].
Registry Finder automatically uses dark theme when you turn on dark mode in Windows. (Head to Settings > Personalization > Colors. Select the "Dark" option under the "Choose your app mode" section.) Dark mode is available only in Windows 10 so, in turn, the dark theme in Registry Finder is available only in Windows 10.
It is possible to turn off dark theme when Windows dark mode is on through the config file.
After the first run, Registry Finder creates the following entry:
Make sure Registry Finder is not running and change the entry to
I could not make some UI elements to be dark (some due to technical issues, some due to I was too focused on the main window and did not noticed them on time). This include the status bar in the main window, drop-down list in all combo boxes, data controls in the Find dialog, the main control in the Modify Binary dialog, tabs in the Properties dialog, the links list in the Edit Favorite dialog.
The grayscale icons that Registry Finder uses by default are not good with the dark theme. I recommend to use custom toolbar icons.
If you notice other incompleteness or issues, don't hesitate to contact me.
To facilitate importing .reg files with Registry Finder you can add a command to Windows Explorer's context menu for .reg files.
To do so, just execute the ContextMenu-Add.bat file. To remove the command, execute the ContextMenu-Remove.bat file.
Also, you can make Registry Finder, instead of regedit, to perform import when you double-click a .reg file: execute RegFileAssoc-Add.bat. RegFileAssoc-Remove.bat restores import with regedit.
Note. You must execute files with administrator rights, otherwise you'll get the Access denied error.
Replacig regedit is equivalent to the following command:
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe" /v "Debugger" /t REG_SZ /d "\"REGISTRY_FINDER_DIR\RegistryFinder.exe\" -z" /f
Note. This is a global setting that affects all users regardless of how they start regedit (for example, through a command line, the Run dialog or by double clicking a .reg file). If you are using Registry Finder in portable mode, make sure that the folder where Registry Finder resides is accessible to any user. Make sure you revert the changes before deleting Registry Finder, otherwise regedit cannot be started. In normal mode, uninstaller will revert the changes for you.If you replaced regedit and want to launch regedit, not Registry Finder, you can do it with the --regedit command line argument:
Running from Write-protected Media
In that case, Registry Finder is fully functional except that the undo history and application settings are not saved (so called No-Save mode). On startup, appropriate message is shown and the status bar contains a yellow triangle sign.
The pop-up message can be suppressed by manually editing the RegistryFinder.config file. Add the following line at the end of the file:
Registry Finder is able to treat set of registry hive files as a separate standalone registry. This feature saves you from tedious procedure of loading and unloading hive files separately. It allows you to, say, easily examine a backup of the registry or modify registry of unbootable Windows when running Registry Finder from bootable USB drive.
The usage is simple: you specify a folder with registry hive files. Registry Finder loads particular files from that folder as hives and gives you familiar interface to work with much as it were live registry: you can browse, create keys and values, import, export, search and so on.
The following files are loaded as corresponding subkeys of HKEY_LOCAL_MACHINE: SAM, SECURITY, SOFTWARE, SYSTEM, and .DEFAULT is loaded as subkey of HKEY_USERS.
In this version, HKEY_CLASSES_ROOT and HKEY_CURRENT_USER keys are not supported. Viewing and editing the keys security information is not implemented.
Because of limitations of API, this feature is not available on Windows XP.
|--help||Prints help message.|
|--computerName arg||Specifies the name or IP address of a computer to connect to.|
|--navigate arg||Specifies a registry key to navigate to. If this parameter is set to "clipboard" then the path is taken from the clipboard.|
|--reopenLocal arg||Restore or not previously opened local registry windows when Registry Finder starts (arg: true or false, default is true).|
|--reopenRemote arg||Restore or not previously opened remote registry windows (arg: true or false, default is true).|
|--findDialog||Open the Find dialog on startup.|
|--dataFolder arg||Specifies folder to store settings and undo history.|
|--import arg||Imports the specified .reg file into the registry.|
The work is always performed in a separate instance (that is the --multiInst is implied).
|--importSilent||Do not display a confirmation of import.|
|--multiInst||When an instance of Registry Finder is already running, starts a new instance. By default, the running instance is activated instead of starting another one.|
Note 1. The parameter names are case insensitive.
Note 2. There are additional parameters (displayed with --help) but they are left undocumented since they are experimental and may not work as expected.
Registry Finder uses the following keyboard shortcuts.
|Ctrl+L||Activate address bar|
|Middle Click in address bar||Paste registry path from clipboard and navigate to it|
|Ctrl+N||Open new local registry tab|
|Ctrl+Shift+N||Connect to a remote computer's registry|
|Ctrl+S||Save changes to offline registry|
|Ctrl+E||Export current key or entire registry to a file|
|Ctrl+Z||Undo the last action|
|Ctrl+Y||Redo the previously undone action|
|F7||Create a new key|
|Ctrl+C||Copy the selection to clipboard|
|Ctrl+V||Paste content from clipboard|
|Del||Delete selected items|
|F2||Rename key or value|
|Ctrl+A||Select all content|
|Ctrl+R||Replace in search results|
|Ctrl+G||Navigate to the item in Registry tab. Uses existing tab if possible.|
|Ctrl+Shift+G||Navigate to the item in new Registry tab.|
|Alt+Enter||Open properties of registry key or favorite item.|
|Ctrl+H||Show/activate/hide the History window|
|Alt+Left Arrow||Go to the previous key in navigation history|
|Alt+Right Arrow||Go to the next key in navigation history|
|Alt+Up Arrow||Go to up one level in registry hierarchy|
|F5||Refresh current registry tab|
|Ctrl+I||Open Favorites tab|
|Ctrl+0 .. Ctrl+9||Go to corresponding favorite item|
|Ctrl+Shift+0 .. Ctrl+Shift+9||Edit corresponding favorite item|
Search Results Limit
By default, search results are limited by 1000 items. The limit protects you from bad consequences when search criteria is specified in a way what generates a huge number of matches. For example, an empty string or a single-character string, e.g. "a". (Possible consequences are unresponsive user interface, high memory and CPU usage and eventual crash.)
If it is needed, you can increase the limit, through editing the RegistryFinder.config file. Locate and modify the following entry:
Changes take effect on the next search, restart of Registry Finder is not required.
A regular expression (or regex, or regexp) is a way to specify a search pattern. This is a very powerful tool that allows you to set complex search criteria so, that the results, on the one hand, contain the required information and, on the other, that there are minimal results that do not contain the required information.
The syntax of regular expressions is quite complex, but it should not frighten you, because by mastering even the most basic things, you will significantly increase the search capabilities. For example, Registry Finder does not support the traditional usage of "*" and "?" as wildcard symbols. Instead, you can use equivalent regular expressions ".*" and ".". Or you can use the expression "word1|word2" to find a string that contains one or both of the words "word1" and "word2".
Because of the variety of constructions of regular expressions I do not try to describe even the most basic ones here. Instead, I recommend finding relevant information on the Internet. For example, an excellent starting point to learn regular expressions is regular-expressions.info. Another useful resource is regex101.com which is a tool for testing regular expressions.
To search for regular expressions, you have to enable the "Use regular expressions" option in the Find dialog.
Registry Finder uses the Boost.Regex library. It utilizes the Perl regular expression syntax. See the documentation is you need details.
Registry Finder supports searching so called hidden registry keys. These are the keys with the null character in the name. Such keys cannot be created, deleted, modified or viewed by standard Windows API, so they are not accessible by regedit and most other registry editors.
To quickly evaluate this feature, you can use the "Search only hidden keys" checkbox in the Find dialog.
In the results list the null character is displayed as the bullet sign:
The downloaded archive contains the NReg utility that you can use to create and delete hidden keys for demonstration purposes. Type NReg -h to see the usage information.
Note. HKEY_CLASSES_ROOT is a special case. Registry Finder correctly finds hidden keys in HKEY_CLASSES_ROOT, but it does not go inside them. If you need to look deeper, you have to search at least in HKEY_CURRENT_USER\Software\Classes plus HKEY_LOCAL_MACHINE\SOFTWARE\Classes.
Translations of Registry Finder
Translating Registry Finder into another language
Start MakeLang.exe with the -i parameter:
That creates RegistryFinder_lang.ini file containing all strings used in Registry Finder UI.
- Open the created language ini file in Notepad or in any other text editor.
- Translate all string entries to the desired language and save the file.
Optionally, you can add your name and/or a link to your Web site. This is the "1018=TranslationAuthor" entry under the "[Dialog_#100]" section. TranslationAuthor must be in the form of the <a> HTML tag. For example,
1018=<a href="www.johnsmith.com">John Smith</a>
This information is shown in the About box.
- Start Registry Finder. It automatically invokes MakeLang with the -d parameter to create the RegistryFinder_lang.dll file containing all translated resources in binary form.
If you want to run Registry Finder without the translation, rename the language ini and dll files, or move it to another folder.
Here you can find some clarifications to certain lines in the language file.
If you translate Registry Finder into you language, please send me the language ini file and I will share it with other people. Alternatively, you can make a pull request in the translations repository.
Custom toolbar icons
An icon set from Martin
An icon set from SirTazofMania
An icon set from Joe P. - rework of SirTazofMania's icons in Windows 11 style
An icon set from Spitfire XIV
An icon set from Marcio de Andrade
An icon set from Frédéric Bellec
An icon set from amshevch
- For portable mode, the program's folder.
- For normal installation mode, %APPDATA%\RegistryFinder.
When Registry Finder encounters an unexpected error it generates crash report and asks you to send it to the developer.
This report contains information essential to investigate and fix the problem. So please prefer pressing the Send report button. If you encounter crash multiple times, do not hesitate to send report two or three times - it is possible, the latter contain slightly different information not available in the former. Press the Close the program button when you believe you already reported the same problem several times.
Please note that due to lack of time, I analyze reports from the latest version only.