Registry Tip #308: Dureg.exe: Registry Search

Hits: Failed to execute CGI : Win32 Error Code = 3

Microsoft releases sample utilities from the Windows 2000 Resource kits. Dureg.exe: Registry Size Estimator is available for free download. DuReg is a command-line tool that enables you to discover how much data is stored in the registry, or in any registry subtree, key, or subkey. DuReg counts data, not space. Because the space any data occupies varies with the storage method and amount of free space available, the size of data and the size of space consumed are not equal. Also, because it measures data, DuReg does not account for fragmented free space in the registry.

The most valuable capability of DuReg: the tool can search for all occurrences of a text string in the registry. This search can be limited to a specific subtree. This commandline search capability can be invaluable for scripting purposes.

The helpfile from DuReg: 


C:\Program Files\Resource Kit>dureg
ureg [/cr | /cu | /u | /lm | /a] [/s | /d] ["registry path"] ["string to search]

/cr                 Find the size of HKEY_CLASSES_ROOT
/cu                 Find the size of HKEY_CURRENT_USER
/u                  Find the size of HKEY_USERS
/lm                 Find the size of HKEY_LOCAL_MACHINE
/a                  All. Find the size of entire registry.

   "registry path"  Find the size of any registry key
e.g. dureg /lm "software\microsoft"  finds the size of the HKLM\Software\Micosoft key

/s "string"         Search for string in the registry
e.g. dureg /s "video" finds all occurrences of "video" in the registry

/s  [/subtree switch] "string"   Search for string in the registry subtree
e.g. dureg /lm /s "video" finds all occurrences of "video" in the HKLM
 (to stop a search, press Ctrl+Break)

The contents when I ran the command on my Windows NT workstation follows:


C:\Program Files\Resource Kit> dureg /a
Size of HKEY_CLASSES_ROOT   :    4339244
Size of HKEY_USERS          :     560139
Size of HKEY_LOCAL_MACHINE  :    8119434

    Total Registry data size:    13018817
The contents when I ran the search command on my Windows NT workstation follows: 


C:\Program Files\Resource Kit>dureg /s aliases
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Npfs\Aliases\netlogon : lsass
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Npfs\Aliases\srvsvc : ntsvcs
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Npfs\Aliases\netlogon : lsass
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Npfs\Aliases\srvsvc : ntsvcs
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Npfs\Aliases\netlogon : lsass
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Npfs\Aliases\srvsvc : ntsvcs
The utility is Windows NT and Windows 2000 compatible. There are a fair number of Resource kit samples available for download. Check Microsoft's Sample Tools for the list of current tools available for download.