FileRisk: Caution
regedit.exe C:\Windows\regedit.exe
Windows Registry Editor: graphical tool to read and modify registry hives; an incorrect change can make the system unstable.
What it’s for
regedit.exe is the Registry Editor: you browse, export, import and modify keys and values with it. One wrong value in the wrong key is enough to make a system unstable, and Microsoft reserves the tool for advanced users. A 32-bit version exists in C:\Windows\SysWOW64.
What it contains
- A Microsoft-signed executable with no configuration of its own.
- Its interface settings (last opened key, favorites) are in
HKCU\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit. - It accepts switches:
/sto import a.regfile without confirmation,/eto export.
Risks and best practices
- Export the key to a
.regfile before changing it, and create a restore point if possible. It is the only easy way back. - Deleting
regedit.exedoes not protect the Registry:reg.exeand PowerShell reach it too. To block the tool, use the “Prevent access to registry editing tools” policy. - Never import a
.regfile of unknown origin:regedit /sapplies it without confirmation.
Useful commands
# Export a key before changing itreg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "$env:USERPROFILE\Desktop\Run-before.reg"
# Read a value without the editorGet-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
# Import a .reg file silently (as administrator, use with caution)regedit /s "$env:USERPROFILE\Desktop\Run-before.reg"