winregistry.org
v0.1 · MIT licensed

The Registry CLI that never asks for admin.

regx reads, converts and merges .reg files and writes them to HKEY_CURRENT_USER — from a single portable executable manifested asInvoker. It never elevates, so it never raises a UAC prompt. No installer, no runtime, no registry footprint of its own.

Get regx Read the docs
powershell 
# Preview what a machine-wide .reg would do as a standard user
> regx convert app.reg --redirect auto

  redirect [high]   HKLM\SOFTWARE\Classes\.acme  ->  HKCU\SOFTWARE\Classes\.acme
  redirect [medium] HKLM\SOFTWARE\Acme\Editor    ->  HKCU\SOFTWARE\Acme\Editor
  skip     [low]    HKLM\SOFTWARE\Policies\...   (Group Policy overwrites it)
  refuse            HKLM\SYSTEM\CurrentControlSet\Services\AcmeSvc
656 KB
Single executable, static CRT
0
UAC prompts, ever
0
Runtime dependencies
40
Tests against the live registry
The problem

"Access is denied." — every registry tool, on a locked-down machine

regedit.exe, reg.exe and every GUI alternative assume you can elevate. On a corporate machine you cannot, so importing a perfectly ordinary .reg file fails on the first HKEY_LOCAL_MACHINE line — even when the setting has a per-user equivalent that would have worked all along.

Registry virtualization will not save you. Because regx ships an explicit manifest, LUAFV is disabled: a write to HKLM returns a clean ACCESS_DENIED instead of being silently diverted to VirtualStore. That honest failure is what Smart Redirection reacts to.

Capabilities

Built for the standard-user path

Not a privileged tool with the elevation removed — every feature is designed around what a non-admin token can actually do.

Never elevates

Manifested asInvoker with MANIFESTUAC:NO, embedded directly in the PE. There is no code path that requests elevation, so there is no prompt to dismiss.

Smart Redirection

Rewrites HKLM paths to their per-user equivalent — and grades every mapping, so a rewrite that would quietly do nothing is refused rather than reported as success.

Offline hive engine

Mounts NTUSER.DAT and application hives through RegLoadAppKey — the one hive API that does not require SeRestorePrivilege. Read and write, no admin.

Automatic undo

The registry has no transaction, so every import computes its own inverse first and writes it as a plain .undo.reg. If anything half-applies, rolling back is one command.

Linter with auto-repair

validate --fix restores missing NUL terminators, repairs REG_MULTI_SZ lists, strips control characters from paths and folds duplicate keys — labelling every lossy repair.

Pipeline-ready

Distinct exit codes for parse errors, access denied, partial application and refused redirects. --output json everywhere, --dry-run on every write.

Reads eight formats

Not just .reg: Group Policy Registry.pol, .admx templates, GPP Registry.xml, .inf [AddReg], JSON, CSV and INI — all detected from content, all sharing one pipeline.

Finds config the way apps do

discover reproduces the sidecar search an executable performs — and flags the rungs that are security bugs, like a config picked up from the working directory.

The hard part

Redirection that tells you when it would not work

A naive HKLM → HKCU string replace always "succeeds": it writes cleanly and changes nothing. That false success is the real failure mode, so every mapping carries a confidence level and a reason, gated by --min-confidence.

Source pathConfidenceWhy
HKCR\*
HKLM\SOFTWARE\Classes\*		 High HKCR is a merged view; the per-user branch takes precedence by design.
HKLM\…\CurrentVersion\Run High Windows reads the per-user copy in addition to the machine copy.
HKLM\SOFTWARE\<Vendor>\<App> Medium Works only if the application itself falls back to HKCU. Many do not.
HKLM\SOFTWARE\Policies\* Low SYSTEM services read HKLM only — and Group Policy refresh wipes the HKCU\Software\Policies subtree every ~90 minutes.
HKLM\SYSTEM, SAM, SECURITY Refuse Services, drivers and account databases have no per-user equivalent at all.
*\UserChoice Refuse Protected by a per-SID hash since Windows 8. File associations cannot be set from a .reg file, by anyone.
Offline hive engine

Edit a hive file without administrator rights

reg load and regedit's Load Hive both call RegLoadKey, which requires SeRestorePrivilege — a privilege a standard user's token does not hold. RegLoadAppKey does not require it: it mounts the hive into a private slot visible only to the calling process, so there is no global namespace entry to protect.

powershell 
> regx hive "D:\Backup\NTUSER.DAT" exec -c "query Software\MyApp -r"

regx: mounted D:\Backup\NTUSER.DAT via RegLoadAppKey (read-only), no elevation used
<hive>\Software\MyApp
    License        REG_SZ         OK
    Seats          REG_DWORD      0x00000019 (25)
regx: unmounted D:\Backup\NTUSER.DAT

Why there is no separate mount and unmount. The handle is process-scoped — it unloads when the process exits, so a mount in one command and a set in the next would find nothing mounted. Every operation therefore runs inside a single mount, and exec chains as many as you need. Full explanation in the docs →

Input formats

Registry data does not only arrive as .reg

A locked-down machine hands you a Registry.pol from the Group Policy cache. An application ships an .inf. A colleague sends a spreadsheet. Every reader funnels into the same internal model, so redirection, coalescing, undo snapshots and apply work on all of them unchanged.

FormatTypical fileWhat it reads
reg.regregedit's own text format, UTF-16 or ANSI REGEDIT4.
polRegistry.polThe Group Policy PReg binary, including the **del., **DeleteValues and **DeleteKeys directives.
admx.admx + .admlPolicy templates. Emits the concrete enabled/disabled values; <elements> are reported rather than invented, because only an administrator knows what was typed into them.
gppRegistry.xmlGroup Policy Preferences: actions C/R/U/D, <Collection> traversed, disabled items skipped.
inf.inf[AddReg] and [DelReg] sections, with [Strings] token substitution.
json.jsonA compact {path: {name: value}} map, or the explicit {"keys": […]} form.
csv.csv, .tsvA header row naming key, name, type and data, in any order.
ini.ini, .cfg[HKEY_…] sections with an optional :type suffix on each name.
powershell 
# What does this Group Policy file actually write?
> regx convert "C:\Windows\System32\GroupPolicy\Machine\Registry.pol" --redirect off

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Policies\Acme\Client]
"ServerUrl"="https://acme.test"
"MaxRetries"=dword:00000003
"LegacyMode"=-          ; from the **del. directive

Format is detected from content first, extension second. A Registry.pol renamed to .txt is still a PReg file, and a .reg that is really JSON is a mistake worth catching before it reaches the registry. Full format reference →

Typical workflow

From a machine-wide .reg to an applied per-user setting

  1. Check the file before it touches anything

    regx validate app.reg --fix repairs the damage a .reg file picks up from forums and chat clients, and reports what it refused to guess at.

  2. See where each key would land

    regx convert app.reg --redirect auto prints the confidence and reason for every mapping without writing to the registry at all.

  3. Confirm you can actually write there

    regx probe "HKCU\Software\Acme" really opens the key — an ACL on one subkey can deny you even inside your own hive.

  4. Apply, with a rollback already on disk

    regx import app.reg writes app.undo.reg first, then applies. Reverting is regx import app.undo.reg.

One file. Drop it anywhere and run it.

No installer, no service, no scheduled task, no registry entries of its own. Delete the executable and nothing remains.

Install regx View source