How to check if a registry key with %SystemRoot% in its pathname exists?

Question

I'm trying to use the reg query command to programmatically check if the QuickEdit value of the Computer\HKEY_CURRENT_USER\Console\%SystemRoot%_System32_WindowsPowerShell_v1.0_powershell.exe registry key exists. If so, I will set that value to 0 (to disable QuickEdit in powershell).

Because the key's pathname contains %SystemRoot% macro, which evaluates to C:\Windows in the macro expansion, the reg query fails:

C:\Users\John> reg query "HKCU\Console\%SystemRoot%_System32_WindowsPowerShell_v1.0_powershell.exe\QuickEdit"
ERROR: The system was unable to find the specified registry key or value.

But I checked regedit and this key does exist.

So how do I escape %SystemRoot% and tell reg query that %SystemRoot% is part of the pathname?

I tried "HKCU\Console\%%SystemRoot%%_System32_WindowsPowerShell_v1.0_powershell.exe\QuickEdit" (note the %%) but that didn't work (same error).

score 1 · Answer 1 · answered Jun 22 '23 at 06:49

No values of HKEY_CURRENT_USER\Console at all were returned for me from reg query /v (Win11)

This worked for me:

@ECHO OFF
SETLOCAL
SET "key=HKEY_CURRENT_USER\Console\%%SystemRoot%%_System32_WindowsPowerShell_v1.0_powershell.exe"
SET "subkey=QuickEdit"
SET "value="
SET "keyfound="
FOR /f "delims=" %%e IN (' reg query "HKCU\Console" /s') DO (
 IF DEFINED keyfound (
  ECHO %%e|FINDSTR /b "HKEY" >NUL
  IF ERRORLEVEL 1 (
   ECHO %%e|FINDSTR /b /l /c:"    %subkey% " >NUL
   IF NOT ERRORLEVEL 1 SET "value=%%e"&GOTO done
  ) ELSE SET "keyfound="
 )
 IF "%%e"=="%key%" SET "keyfound=y"
)

:done
ECHO Value found=%value%

GOTO :EOF

First look for a line matching the HKEY..., set a flag to process succeeding lines.

If another HKEY... appears at the start of the line, turn off matching the processing (could also probably exit here, as the key has neem ound, and so has the next...).

Otherwise, see wether the line begins exactly requiredsubkey. If it does, grab the complete line, assign it to value and exit.

So, if value has a value, the data was found

@Mofi : I realised that I'd screwed up the terminology. Just too tired to fix it. — Magoo, Jun 22 '23 at 22:17

Mofi · Accepted Answer · 2023-08-12T13:34:34.567

There can be used directly in a Windows command prompt window:

%SystemRoot%\System32\reg.exe QUERY HKCU\Console\^%SystemRoot^%_System32_WindowsPowerShell_v1.0_powershell.exe /v QuickEdit /t REG_DWORD

Each of the two percent signs in the registry key is escaped with ^ to be interpreted as literal character. %SystemRoot% inside the registry key name is not interpreted as variable reference because of the caret character ^ left to the two percent signs.

In a batch file can be used:

%SystemRoot%\System32\reg.exe QUERY HKCU\Console\%%SystemRoot%%_System32_WindowsPowerShell_v1.0_powershell.exe /v QuickEdit /t REG_DWORD

The percent sign must be escaped in a batch file with one more percent sign to get it interpreted as literal character.

The entire registry key does not contain a space or one of these characters &()[]{}^=;!'+,`~<>| making it possible to pass the registry key without surrounding " to REG. That makes it easier in command prompt window because there must be used just twice ^ to escape the two percent signs in the registry key name.

There are three outputs possible:

There is output to STDOUT the registry value QuickEdit on the registry key %SystemRoot%_System32_WindowsPowerShell_v1.0_powershell.exe exists at all under registry key HKEY_CURRENT_USER\Console and the registry value QuickEdit exists under that registry key and being of type 32-bit double word (DWORD). The exit code of REG is in this case 0 indicating a successful execution to cmd.exe processing the batch file or interpreting and executing the entered commands in the command prompt window.
There is output the following error message to STDERR if the registry key does not exist at all:
ERROR: The system was unable to find the specified registry key or value.
The exit code is 1 in this case to indicate the error to the parent process.
There is output the following information message to STDOUT if the registry exists but does not contain a registry value with name QuickEdit at all or contains that registry value with a different type than DWORD.
End of search: 0 match(es) found.
The exit code is also 1 in this case to indicate the failed search for this registry value to the Windows Command Processor.

The output can be suppressed with >nul 2>&1 or >nul 2>nul or 1>nul 2>nul if just the result depending on exit code must be evaluated using either the conditional command operators && and/or || as described by single line with multiple commands using Windows batch file or an IF [NOT] ERRORLEVEL condition as described by the usage help of command IF output on running if /? in a command prompt window.

A FOR /F loop can be used to validate the double word value as demonstrated below.

@echo off
setlocal EnableExtensions DisableDelayedExpansion
set "QUickEdit="
for /F "skip=2 tokens=1,3" %%I in ('%SystemRoot%\System32\reg.exe QUERY HKCU\Console\^^%%SystemRoot^^%%_System32_WindowsPowerShell_v1.0_powershell.exe /v QuickEdit /t REG_DWORD 2^>nul') do if /I "%%I" == "QuickEdit" set "QuickEdit=%%J"
if not defined QuickEdit goto ValueNotFound
for /F "delims=0x" %%I in ("%QuickEdit%") do echo Quick edit is enabled explicitly for Windows PowerShell console.& goto EndBatch
echo Quick edit is disabled explicitly for Windows PowerShell console.& goto EndBatch

:ValueNotFound
echo Could not find registry value QuickEdit of type DWORD under registry key:
echo(
echo HKCU\Console\%%SystemRoot%%_System32_WindowsPowerShell_v1.0_powershell.exe

:EndBatch
endlocal
echo(
pause

There must be considered in this case that the first FOR /F command line is parsed by two cmd.exe. The first one is the Windows Command Processor which is processing the batch file. The command line after parsing before execution of FOR is with Windows installed into C:\Windows:

for /F "skip=2 tokens=1,3" %I in ('C:\Windows\System32\reg.exe QUERY HKCU\Console\^%SystemRoot^%_System32_WindowsPowerShell_v1.0_powershell.exe /v QuickEdit /t REG_DWORD 2>nul') do if /I "%I" == "QuickEdit" set "QuickEdit=%J"

FOR respectively cmd.exe starts in background one more command process with %ComSpec% /c and the command line as shown above appended as additional arguments. There is executed in background:

C:\Windows\System32\cmd.exe /c C:\Windows\System32\reg.exe QUERY HKCU\Console\^%SystemRoot^%_System32_WindowsPowerShell_v1.0_powershell.exe /v QuickEdit /t REG_DWORD 2>nul

That is the reason why in this case ^^ (escaped escape character) and %% (escaped percent sign) must be used in the batch file in the FOR /F command line to pass to REG finally twice a percent sign as part of the registry key name. The redirection operator > within 2>nul must be escaped with ^ just for the cmd.exe processing the batch file.

A less comprehensive version to check the QuickEdit value is:

@echo off
setlocal EnableExtensions DisableDelayedExpansion
%SystemRoot%\System32\reg.exe QUERY HKCU\Console\%%SystemRoot%%_System32_WindowsPowerShell_v1.0_powershell.exe /v QuickEdit /t REG_DWORD 2>nul | %SystemRoot%\System32\findstr.exe /I /R "QuickEdit.*0x0*1$" || goto NotEnabled
echo Quick edit is enabled explicitly for Windows PowerShell console.& goto EndBatch

:NotEnabled
echo Quick edit is not enabled explicitly for Windows PowerShell console.

:EndBatch
echo(
endlocal
pause

To understand the commands used and how they work, open a command prompt window, execute there the following commands, and read the displayed help pages for each command, entirely and carefully.

echo /?
endlocal /?
findstr /?
goto /?
if /?
pause /?
reg /?
reg query /?
set /?
setlocal /?

How to check if a registry key with %SystemRoot% in its pathname exists?

2 Answers2