IgNiTeD SoUL

To delete subkeys and values from the Windows registry, use REG delete. REG delete has several different syntaxes. If you want to delete a subkey and all subkeys and entries under the subkey, use the following syntax:

reg delete KeyName

where KeyName is the name of the subkey you want to delete. Although the subkey path can include the UNC name or IP address of a remote computer, a remote source subkey can use only the HKLM or HKU root keys. Consider the following example:

reg delete \\Mailer1\HKLM\SYSTEM\CurrentControlSet\Services\DNS2

Here you delete the DNS2 subkey and all subkeys and entries under the subkey on MAILER1.

If you want to limit the scope of the deletion, specify that only a specific entry under the subkey should be deleted using the following syntax:

reg delete KeyName /v ValueName

where KeyName is the name of the subkey you want to work with and ValueName is the name of the specific entry to delete. As before, the subkey path can include the UNC name or IP address of a remote computer. However, a remote source subkey can use only the HKLM or HKU root keys. In this example, you delete the Description entry for the DNS2 subkey on MAILER2:

reg delete \\Mailer2\HKLM\SYSTEM\CurrentControlSet\Services\DNS2 /v 
Description

Using REG copy, you can copy a registry entry to a new location on a local or remote system. The basic syntax for REG copy is

reg copy KeyName1 KeyName2

where KeyName1 is the path to the subkey you want to copy and KeyName2 is the path to the subkey destination. Although the subkey paths can include the UNC name or IP address of a remote computer, REG copy is limited in scope with regard to which root keys you can use when working with remote source or destination keys, as follows:

• A remote source subkey can use only the HKLM or HKU root keys.
• A remote destination subkey can use only the HKLM or HKU root keys.

In the following example, you copy the DNS subkey on the local system to the DNS subkey on MAILER2:

reg copy HKLM\SYSTEM\CurrentControlSet\Services\DNS
    \\Mailer2\HKLM\SYSTEM\CurrentControlSet\Services\DNS

By adding the /S parameter, you can copy the specified subkey as well as all subkeys and key entries under the specified subkey. In this example, the DNS subkey and all related subkey and values are copied:

reg copy HKLM\SYSTEM\CurrentControlSet\Services\DNS
    \\Mailer2\HKLM\SYSTEM\CurrentControlSet\Services\DNS /s

If values exist at the destination path, REG copy will prompt you to confirm that you want to overwrite each existing value. Press Y or N as appropriate. You can also press A to overwrite all existing values without further prompting.

To add subkeys and values to the Windows registry, use REG add. The basic syntax for creating a key or value is

reg add KeyName /v ValueName /t DataType /d Data

where KeyName is the name of the key you want to examine, ValueName is the subkey or key value to create, DataType is the type of data, and Data is the actual value you are inserting. That seems like a lot of values, but it is fairly straightforward. Consider the following example:

reg add HKLM\SYSTEM\CurrentControlSet\Services\DNS /v DisplayName
/t REG_SZ /d “DNS Server”

Here, you add a key value called DisplayName to the DNS key in the registry. The key entry is a string with the “DNS Server” value. Note the double-quotation marks. The quotation marks are necessary in this example because the string contains a space.

When you set expandable string values (REG_EXPAND_SZ), you must use the caret (^) to escape the percent symbols (%) that designate the environment variable you use. Consider the following example:

reg add HKLM\SYSTEM\CurrentControlSet\Services\DNS /v ImagePath
/t REG_EXPAND_SZ /d ^%SystemRoot^%\System32\dns.exe

Here, you enter ^%SystemRoot^% so that the SystemRoot environment variable is properly entered and interpreted.

When you set non-string values, you don’t need to use quotation marks, as shown in this example:

reg add HKLM\SYSTEM\CurrentControlSet\Services\DNS /v ErrorControl
/t REG_DWORD /d 0x00000001