REGSHELL(1) System Administration tools REGSHELL(1)

# [NAME](#NAME)

regshell - Windows registry file browser using readline

# [SYNOPSIS](#SYNOPSIS)

.HP 216u

**regshell** \[--help] \[--backend=BACKEND] \[--credentials=CREDENTIALS] \[location]

# [DESCRIPTION](#DESCRIPTION)

.PP regshell is a utility that lets you browse thru a Windows registry file as if you were using a regular unix shell to browse thru a file system.

# [OPTIONS](#OPTIONS)

.PP --help

Show list of available options.

.RE .PP --backend BACKEND

Name of backend to load. Possible values are: creg, regf, dir and rpc. The default is *dir*.

.RE .PP --credentials=CREDENTIALS

Credentials to use, if any. Password should be separated from user name by a percent sign.

.RE

# [COMMANDS](#COMMANDS)

.PP ck|cd <keyname>

Go to the specified subkey.

.RE .PP ch|predef \[predefined-key-name]

Go to the specified predefined key.

.RE

.PP list|ls

List subkeys and values of the current key.

.RE

.PP mkkey|mkdir <keyname>

Create a key with the specified *keyname* as a subkey of the current key.

.RE

.PP rmval|rm <valname>

Delete the specified value.

.RE

.PP rmkey|rmdir <keyname>

Delete the specified subkey recursively.

.RE

.PP pwd|pwk

Print the full name of the current key.

.RE

.PP set|update

Update the value of a key value. Not implemented at the moment.

.RE

.PP help|?

Print a list of available commands.

.RE .PP exit|quit

Leave regshell.

.RE

# [EXAMPLES](#EXAMPLES)

.PP Browsing thru a nt4 registry file

```
regshell -b nt4 NTUSER.DAT
$$$PROTO.HIV> ls
K AppEvents
K Console
K Control Panel
K Environment
K Identities
K Keyboard Layout
K Network
K Printers
K Software
K UNICODE Program Groups
K Windows 3.1 Migration Status
$$$PROTO.HIV> exit
```

Listing the subkeys of HKEY\_CURRENT\_USER\\AppEvents on a remote computer:

```
regshell --remote=ncacn_np:aurelia -c "jelmer%secret"
HKEY_CURRENT_MACHINE> predef HKEY_CURRENT_USER
HKEY_CURRENT_USER> cd AppEvents
Current path is: HKEY_CURRENT_USER\AppEvents
HKEY_CURRENT_USER\AppEvents> ls
K EventLabels
K Schemes
HKEY_CURRENT_USER\AppEvents> exit
```

# [VERSION](#VERSION)

.PP This man page is correct for version 4.0 of the Samba suite.

# [SEE ALSO](#SEE_ALSO)

.PP regtree, regdiff, regpatch, gregedit, samba

# [AUTHOR](#AUTHOR)

.PP This utility is part of the **Samba**\[1] suite, which is developed by the global **Samba Team**\[2].

.PP This manpage and regshell were written by Jelmer Vernooij.

# [NOTES](#NOTES)

1\.

Samba

http://www.samba.org/

2\.

Samba Team

http://www.samba.org/samba/team/

11/05/2026 Samba 4.0

---

Document: regshell(1) from samba 4.25.1-r1 (Chainguard OS)
Source: https://github.com/samba-team/samba