How to search for specific value in Registry keys

Question

Hi,

How can I search for specific value in the registry keys?

For example I want to search for XXX in

HKEY_CLASSES_ROOT\Installer\Products

any code sample in C# will be appreciated,

thanks

Answer 1

Help here...

Microsoft has a great (but not well known) tool for this - called LogParser

It uses a SQL engine to query all kind of text based data like the Registry, the Filesystem, the eventlog, AD etc... To be usable from C#, you need to build an Interop Assembly from the Logparser.dll COM server using following (adjust LogParser.dll path) command.

tlbimp "C:\Program Files\Log Parser 2.2\LogParser.dll"
/out:Interop.MSUtil.dll

Following is a small sample, that illustrates how to query for the Value 'VisualStudio' in the \HKLM\SOFTWARE\Microsoft tree.

using System;
using System.Runtime.InteropServices;
using LogQuery = Interop.MSUtil.LogQueryClass;
using RegistryInputFormat = Interop.MSUtil.COMRegistryInputContextClass;
using RegRecordSet = Interop.MSUtil.ILogRecordset;

class Program
{
public static void Main()
{
RegRecordSet rs = null;
try
{
LogQuery qry = new LogQuery();
RegistryInputFormat registryFormat = new RegistryInputFormat();
string query = @"SELECT Path from \HKLM\SOFTWARE\Microsoft where
Value='VisualStudio'";
rs = qry.Execute(query, registryFormat);
for(; !rs.atEnd(); rs.moveNext())
Console.WriteLine(rs.getRecord().toNativeString(","));
}
finally
{
rs.close();
}
}
}

Answer 2

In case you don't want to take a dependency on LogParser (as powerful as it is): I would take a look at the Microsoft.Win32.RegistryKey class (MSDN). Use OpenSubKey to open up HKEY_CLASSES_ROOT\Installer\Products, and then call GetSubKeyNames to, well, get the names of the subkeys.

Open up each of those in turn, call GetValue for the value you're interested in (ProductName, I guess) and compare the result to what you're looking for.

Answer 3

I've used logparser, just as shown in the example above, but after I've moved the code to an x64 platform, I'm only getting results from \HKLM\SOFTWARE\WOW6432node\

How do I force the query to search outside \WOW6432node\ ????