Skip to main content

How to Access the 64-bit Registry from a 32-bit Script

On a 64-bit version of Windows, the operating system maintains two separate views of the registry to support both modern 64-bit and legacy 32-bit applications. This is handled by a subsystem called WoW64 (Windows on Windows 64-bit). When a 32-bit process (like the 32-bit cmd.exe) tries to access a common registry key like HKEY_LOCAL_MACHINE\Software, WoW64 transparently redirects it to a special 32-bit location: HKLM\Software\WOW6432Node.

This is a major problem for any batch script that needs to check for 64-bit software or settings while running in a 32-bit context. This guide will teach you how to use a special, built-in switch for the REG.EXE command to break out of this redirection and access the true, native 64-bit registry view.

danger

CRITICAL NOTE: This is an advanced administrative task. Modifying the registry can be dangerous, and you must run these commands with administrator privileges to access the HKEY_LOCAL_MACHINE hive.

The Core Problem: Registry Redirection (WoW64)​

When a 32-bit application runs on a 64-bit OS, WoW64 isolates it to maintain compatibility. This includes redirecting its registry calls.

  • A 32-bit process tries to access: HKLM\SOFTWARE\MyCoolApp
  • WoW64 intercepts the call and transparently sends it to: HKLM\SOFTWARE\WOW6432Node\MyCoolApp

This means that if you are running in a 32-bit command prompt, a standard REG QUERY "HKLM\Software" command will not show you the contents of the real 64-bit key. It will show you the contents of the WOW6432Node instead.

The Solution: The /reg:64 Switch​

The built-in REG.EXE command is aware of this redirection. It includes a special command-line switch that allows you to specify which registry view you want to access, regardless of the process's architecture.

Syntax: REG [operation] KeyName [parameters] /reg:64

  • /reg:64: This switch forces REG.EXE to access the native 64-bit registry view.
  • /reg:32: This switch forces REG.EXE to access the 32-bit (redirected) registry view.

By adding /reg:64 to our command, we can see the true 64-bit registry.

Basic Example: Comparing the 32-bit and 64-bit Views​

This example shows the difference in output when querying the Uninstall key for a 64-bit application (like the "Microsoft Visual C++ Redistributable (x64)") from a 32-bit command prompt.

To run this, you must launch the 32-bit cmd.exe from C:\Windows\SysWOW64\cmd.exe

@ECHO OFF
REM This script must be run as an Administrator from a 32-bit CMD.

SET "RegKey=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"

ECHO --- Querying the registry from a 32-bit process ---
ECHO.
ECHO --- 1. Standard Query (Redirected to WOW6432Node) ---
ECHO Searching for a 64-bit application...
REG QUERY "%RegKey%" /s /f "Visual C++" | find "x64"
ECHO.
PAUSE

ECHO --- 2. Query with /reg:64 (Native 64-bit View) ---
ECHO Searching for a 64-bit application with the correct switch...
REG QUERY "%RegKey%" /s /f "Visual C++" /reg:64 | find "x64"

Expected Output:

  • The first command will likely find nothing, because the 64-bit application's uninstall entry does not exist in the 32-bit WOW6432Node.
  • The second command, using /reg:64, will successfully find the key for the 64-bit application.

Key REG Parameters Explained​

  • /reg:64: Forces the operation to use the 64-bit view of the registry. This is the key to this technique.
  • /reg:32: Forces the operation to use the 32-bit view. This can be useful for a 64-bit script that needs to check for 32-bit software.

This switch works with all REG operations, including QUERY, ADD, DELETE, and EXPORT.

How Do I Know if My Script is Running as 32-bit?​

You can check the %PROCESSOR_ARCHITECTURE% environment variable.

  • On a 64-bit OS, a native 64-bit cmd.exe will show AMD64.
  • A 32-bit cmd.exe running under WoW64 will show x86.
ECHO The current architecture of this cmd.exe is: %PROCESSOR_ARCHITECTURE%

Common Pitfalls and How to Solve Them​

  • Administrator Rights: The HKEY_LOCAL_MACHINE (HKLM) hive is protected. You must run your script from an elevated prompt to query or modify it.
  • Command Not Available: The /reg switch was introduced in Windows Vista. It is not available on Windows XP or older, but this is rarely an issue on modern systems.
  • Forgetting the Switch: The most common mistake is simply forgetting to add the /reg:64 switch when running in a 32-bit context, leading to a script that cannot find the 64-bit software it's looking for.

Practical Example: A 64-bit Software Check Script​

This script is designed to run in any environment (32-bit or 64-bit cmd.exe) and reliably check if a specific 64-bit application is installed.

@ECHO OFF
SETLOCAL
SET "AppName=Python 3.11 (64-bit)"
SET "IsInstalled=0"

ECHO --- Checking for installation of "%AppName%" ---
ECHO.

REM This command will work regardless of whether the script is run
REM from a 32-bit or 64-bit command prompt.
REG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s /f "%AppName%" /reg:64 | FIND /I "%AppName%" > NUL

IF %ERRORLEVEL% EQU 0 (
    ECHO [SUCCESS] "%AppName%" is installed on this system.
) ELSE (
    ECHO [FAILURE] "%AppName%" was not found in the 64-bit application list.
)

ENDLOCAL

Conclusion​

The REG.EXE command's /reg:64 switch is the definitive and only reliable way to access the native 64-bit registry from a 32-bit batch script.

Key takeaways:

  • On a 64-bit OS, 32-bit processes are subject to registry redirection to the WOW6432Node.
  • The /reg:64 switch overrides this redirection and forces REG.EXE to use the native 64-bit view.
  • This is essential for any 32-bit script that needs to find or modify software installed in the 64-bit registry hive.
  • You must run as an Administrator to access the HKLM keys.

Table of Contents