Managing The Windows 2000 Registry

Searching for Keys and Values

One of RegEdit ’s best features is its ability to search the Registry for a particular key or value. For example, let’s say that you want to find where the Dial-Up Networking (DUN) service stores its list of phonebook entries. You could go to Microsoft’s Knowledge Base and look it up, but the fastest way to find your answer is to use RegEdit ’s search function to look for entries whose contents match the name of one of your phonebook entries.

There are a few things you need to know about how searches work. Searches are case-insensitive, so you don’t have to pay attention to proper capitalization. By default, searches are substring searches, not literal searches. Searching always starts with the “first” root key, which in RegEdit ’s case means that all searches have to plow through HKCR first. Finally, the search process accepts only ASCII text and looks only in string values. That makes it impossible to find all the values whose DWORD value is 0x220 or to find data stored in values of type REG_BINARY.

You activate the Find command with the Edit→Find menu command. You then see the dialog box shown in Figure 4-3.

Figure 4-3. RegEdit’s Find dialog

Finding values is pretty straightforward: if you want to search the entire Registry, just type your search string into the “Find what” field and click the Find Next button. Of course, you can be more selective by using the four checkboxes in the Find dialog:

• The “Look at Keys” checkbox (on by default) tells RegEdit to look for the specified string in the names of keys. Searching for “software” would thus find HKLM\SOFTWARE, HKCU\Software, HKU\.DEFAULT\Software, and perhaps other keys whose names contain “software” in some form or other.

• The “Look at Values” checkbox (on by default) instructs RegEdit to search for your string in the names of values, too; searching for “User” with this checkbox set might find HKCR\DAO.User, HKLM\Software\SMIME\Users, and HKCU.

• The “Look at Data” checkbox (on by default) enables RegEdit to actually look within values’ data for the specified string. Searching for “System” turns up a treasure trove of string values that contain the search string.

• The “Match whole string only” checkbox (off by default) constrains RegEdit to reporting only those items that match exactly. Searching for “User” with this option off finds both HKCR\DAO.User and HKLM\Software\SMIME\Users; turning the option on doesn’t find either, but does match HKLM\Software\LJL\CurrentVersion\User.

While the search is proceeding, you see a progress dialog. That’s perhaps a misnomer, since it doesn’t actually indicate the search’s progress; it gives you a Cancel button, though. RegEdit ’s searching performance is poor, so don’t be alarmed if searches seem to take a long time.

As with many other programs that include search capability, RegEdit provides a convenient shortcut for finding the next item that matches your search target. To find the next match, use the Edit→Find Nextcommand or its accelerator key, F3. When you do, RegEdit finds the next match; if it can’t find any more matches, it displays a dialog box telling you that no more matches exist.