You wish to use the Registry Scanner to locate registry keys and values on target systems within your network.
PDQ Inventory Version 9+
Obtaining useful and accurate results from the Registry Scanner is dependent on the correct usage of the Include Pattern(s) and Exclude Pattern(s). The Usage and Available Wildcards below provide important information on how the Registry Scanner operates, how to use the correct series of patterns, and some examples to get you searching quickly or to troubleshoot issues with existing searches.
* matches zero or more characters, can be used for keys and values:
? matches a single character:
\**\ is used to indicate the current key and all subkeys:
Exclude Pattern(s) work the same way as Include Pattern(s).
When performing large searches, performance can be significantly improved by excluding large parent keys and all or some of their subkeys.
There are three common issues when you receive null or unexpected results from a registry scan:
1. Omitting the trailing "\" when performing a key search or including the "\" when doing a value search.
2. Searching for data rather than keys or values. For example, searching for "inf" in the key in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion will return null results. To return the data for "inf" you would search for HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ which would return the "DevicePath" value and the data of %SystemRoot%\inf
3. Including the hive name in the Include pattern(s):
1. Find all known values in a key:
Find the uninstall string in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
2. Find a value in an unknown location:
Find any value with the name "Viagra" in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\<keys>\
3. Find a particular key in multiple possible locations, excluding a specific instance:
Find all instances of a particular SID in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
4. Find a particular value:
Find all ProductName value data in possible multiple keys.
5. Find specific information for installed software versions in an unknown key:
You want to find the current version of Java and the Java version running on a browser, but don’t know the key it is located in, but can exclude certain keys.