As you might expect, HKEY_LOCAL_MACHINE contains information specific to your computer, settings that aren't user-specific. They include hardware settings and software information that is global for all users.

The main keys in HKEY_LOCAL_MACHINE are shown in Table 32.1.

The fun bits are in the SOFTWARE keys under HKEY_LOCAL_MACHINE. Under SOFTWARE is the special Classes subkey, which I'll describe in the HKEY_CLASSES_ROOT section of this chapter. Also, there are subkeys named after software manufacturers that contain systemwide settings for these companies' various programs.

Under Microsoft, naturally, is a slew of subkeys for the software systems provided with Windows and for any add-ons you've purchased, such as Office. You'll have more than 100 subkeys in HKEY_LOCAL_MACHINESoftwareMicrosoft just after installation and more when you start adding your own software.

Most of the juicy settings that control Windows itself are found in HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersion.

I'll discuss just one of these juicy keys. When you log in to your computer, you know that Windows can start up some programs automatically. You can actually set a program to be started up at login in any of five ways:

The Run keys are often set by software manufacturers who want their software to run automatically when you log on. Sometimes this is a good thing—as when Windows uses it to start the taskbar program. But this technique is sometimes used to install annoying programs you really don't want to run. If the programs don't have configuration or preference settings that will disable the run-on-logon behavior, you can delete their value entries under these keys.

The RunOnce and RunOnceEx keys are used mostly by installation programs that need to complete their work after you restart your computer. Windows normally deletes these entries after you've logged in once and these programs have run, but they are sometimes not properly removed.

Note

HKEY_CURRENT_CONFIG is a virtual top-level key containing information Windows uses to initialize during its bootup phase, and very little else. Despite its important-sounding name, you'll find virtually nothing of interest to humans in here. The information is all set up automatically when you create Hardware Profiles.

By virtual, I mean that the keys in HKEY_CURRENT_CONFIG are really contained in other parts of the Registry, and using HKEY_CURRENT_CONFIG is just a convenient way to get at them. A curious feature of this one is that its subkeys come from several different parts of the Registry. Its SystemCurrentControlSet subkey comes from one of the HKEY_LOCAL_MACHINESYSTEMControlSet### keys, and various parts of its Software subkey come from other parts of HKEY_LOCAL_MACHINE. The Registry presents the information from these various keys again under HKEY_CURRENT_CONFIG as a matter of convenience.

HKEY_CLASSES_ROOT is another of these virtual keys, provided to give programmers quick access to information from other places in the Registry. What you see under HKEY_CLASSES_ROOT are the contents of HKEY_LOCAL_MACHINESoftwareClasses, plus any additional user-specific settings stored under HKEY_CURRENT_USERSoftwareClasses, whose entries add to or override the HKEY_LOCAL_MACHINE entries.

A large part of the Classes section is devoted to the associations the Explorer makes between file types (or filename extensions, like .doc) and the programs that are used to open, display, or edit them. This is the information you're editing when you change associations in the Explorer by choosing Tools, Folder Options, File Types, as discussed in Chapter 21.

These entries contain the nitty-gritty linkage information that Windows uses to locate software components based on ActiveX Controls, OLE, and the COM+ interprocess communication system. These entries are confusing, complex, and best left completely alone.

Table 32.2 gives an overview of the structure of HKEY_CLASSES_ROOT.

HKEY_USERS contains a subkey for each authorized user of the computer and an entry named .DEFAULT. The .DEFAULT section contains just that—the basic settings given to each new local user added to the computer. (I say local because, on a Windows 200x Server domain-based network, when a user logs in for the first time using a domain login name, his or her default Registry entries are obtained from the domain's server, not the local computer.)

The user subkeys of HKEY_USERS have long numeric names. These names are the GUID or Globally Unique User Identification numbers generated by Windows as a computer-friendly representation of the user's name. It's by these numbers that Windows tracks users, whether local or domain-based.

Nothing else is in HKEY_USERS besides these per-user subkeys. They appear as the contents of HKEY_CURRENT_USER and HKEY_CLASSES_ROOT when the associated user is logged in.

HKEY_CURRENT_USER contains settings, preferences, and other information specific to the currently logged-in user. This whole “section” is actually a subkey of HKEY_USERS, as discussed previously, but is provided this way as an easy way to get to the information.

The Software keys in HKEY_CURRENT_USER are similar to the Software subkeys in HKEY_LOCAL_MACHINE. They're grouped by software manufacturer, and Windows entries are stored in HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersion.

Windows has several ways to associate filename extensions with applications. Besides the .xxx and filetype keys under HKEY_CLASSES_ROOT, Explorer also uses HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerFileExts. This registry key holds the application associations you see when you right-click a file and see the “Open With…” choices. Have you ever noticed that Windows remembers which application you last used to open a given file type?

Take a look under this key and you'll see subkeys of the form .xxx, listing many file extensions. Under these are subkeys named OpenWithList and/or OpenWithProgids. OpenWithList has values named with the letters a, b, c, and so on, each of which has as its value the path to an application program that could be used to open the file type. The value MRUList lists the letters of the applications in the order in which they were most recently used. This is why Explorer remembers which application to offer first in the list of possible choices.

You can back up the Registry in Windows XP in three main ways: You can back it up as part of a regular disk backup, you can use the Registry Editor to save a key to a disk file, or you can use a special-purpose Registry backup program.

I suggest that you set your favorite disk backup program to back up the Registry files every time you back up your hard disk. Before you install a piece of new hardware or a significant software package, do a full disk backup, including the Registry. Before you manually edit the Registry for other purposes, back up the Registry by any of the means I'll discuss in the next few sections.

If you've made Registry changes that cause problems, you can try to remember each and every change you made, re-enter the original information, delete any keys you added, and thus undo the changes manually. Good luck! If you were diligent and made a backup before you started, however, you can simply restore the backup and have confidence that the recovery is complete and accurate.

Note

To restore a Registry backup you made, follow the steps described in the following sections.

The Registry Editor doesn't have a Start menu item. You must run it from the Start, Run dialog. Enter regedit and click OK.

Regedit displays a two-pane display much like Explorer, as shown in Figure 32.5. The top-level keys, which are listed below My Computer, can be expanded just like drives and folders in the Explorer. In the pane on the right are the values for each key. The name of the current selected key is shown in the status bar.

Figure 32.5. The Regedit screen shows keys on the left and values on the right.

Values have names, just as the files in a folder do, and it's here that configuration information is finally stored. Each key has a (Default) value, which is the value of the key itself, and any number of named values. For example, in Figure 32.5, key HKEY_CURRENT_USERDesktop is shown. The value of HKEY_CURRENT_USERDesktop itself is undefined (blank), and the value HKEY_CURRENT_USERControl PanelDesktopCoolSwitch is 1.

Registry values have a data type, which is usually one of the types shown in Table 32.3.

You can search for a Registry entry by key name, value name, or the contents of a value string. First, select a starting point for the search in the left pane. You can select My Computer to select the entire Registry, or you can limit your search to one of the top-level keys or any subordinate key. Next, select Find from the menu, and enter a search string into the Find dialog. The Find feature is not case sensitive, so upper- and lowercase don't matter. You can check any of the Look At boxes, as shown in Figure 32.6, to designate where in the Registry you expect to find the desired text: in the name of a key, in the name of a value, or in the data, the value itself.

Figure 32.6. In the Find dialog, you can select whether to search key names, value names, or value data.

Check Match Whole String Only to search only for items whose whole name or value is the desired string.

Select Find Next to start the search. The Regedit display indicates the first match to your string, and by pressing F3, you can repeat the search to look for other instances.

Regedit has no Save or Undo menu items. Changes to the Registry happen immediately and permanently. Additions, deletions, and changes are for real. This is the reason for all the warnings to back up before you poke into the Registry.

Adding a Value

To add a value to a key, select the key in the left pane, and choose Edit, New. Select the type of value to add; you can select any of the supported Registry data types: String, Binary, DWORD, Multi-String, or Expandable String. (The instructions you're following will indicate which type of value to add.) A new value entry then appears in the right pane, as shown in Figure 32.7.

Figure 32.7. New value adds an entry in “Rename” mode.

Enter the new value's name, and press Enter to edit the value.

• For string values, enter the text of the desired string.

• For DWORD values, choose Decimal or Hexadecimal, and enter the desired value in the chosen format (see Figure 32.8).

  

  Figure 32.8. You can choose to enter a DWORD value in either decimal or hexadecimal notation.

• For binary values, enter pairs of hexadecimal characters as instructed. (You'll never be asked to do this, I promise.)

Adding or Deleting a Key

Keys must be added as subkeys to existing keys; you can't add a top-level key. To add a key, select an existing key in the left pane, and select Edit, New, Key from the menu. Alternatively, right-click the existing key, and select New, Key from the context menu. A new key appears in the left pane, where you can edit its name, as shown in Figure 32.9. Press Enter after you enter the name.

Figure 32.9. A new key appears in “Rename” mode.

You can delete a key by selecting it in the left pane and choosing Edit, Delete from the drop-down menu, or by right-clicking it and selecting Delete from the context menu. Click OK to confirm that you do intend to delete the key. Deleting a key deletes its values and all its subkeys as well, so without the protection of Undo (or a Registry Recycling Bin), this action is serious.

The Registry Editor has some advanced features you'll need only if you're managing a network of Windows XP computers or if you run into really serious problems with your Windows installation.

The Registry Editor permits administrators to edit the Registry of other computers on a network. Of course, this operation is highly privileged, and you must have administrator privileges on the computer whose Registry you want to edit. To edit a remote computer's Registry, choose File, Connect Network Registry. Next, enter the name of the remote computer, or click Advanced, then Find Now to select one graphically; then click OK. (Interestingly, Browse doesn't let you use Active Directory to select a computer to manage, only the basic “local computers” list.)

When you've connected, the computer's Registry keys appear in the list along with your own, as shown in Figure 32.10.

Figure 32.10. Viewing and editing a remote computer's Registry.

Note that only the two main “real” top-level keys will appear: HKEY_LOCAL_MACHINE and HKEY_USERS—the virtual keys will not. When you have finished editing the remote computer's Registry, right click its name in the left-hand pane and select Disconnect.

If you open a Registry Editor and look under HKEY_USERS, you will find that the only available subkeys are .DEFAULT, four entries for system services, and your own subkey, which is also accessible as HKEY_CURRENT_USER. As I mentioned earlier, Windows stores various parts of the Registry in data files called hives, and loads the hive containing your part of HKEY_USER only when you are currently logged on. When you log out, your subkey is unloaded from the Registry, and the hive file is left in your user profile folder. (And if you have a roaming user profile, your profile folder is copied back to the domain server. That's how your settings are able to follow you from one computer to another.)

As an administrator, you might find it necessary to edit HKEY_USER entries for another user. For example, a startup program in HKEY_CURRENT_USERSoftwareWindowsCurrentVersionRun might be causing such trouble that the user can't log on. If you can't log on as that user, you can edit his or her HKEY_CURRENT_USER Registry keys in another way:

If you need to retrieve Registry entries from an installation of Windows 2000 or XP on another hard disk or partition, you can load any of that installation's hive files for editing or exporting. This might happen when you

To edit the other installation's Registry, you will need to locate its hive files. They are usually found in the locations shown in Table 32.4.

To edit another Windows installation's Registry, use the technique I described under “Editing Registry Entries for Another User” But instead of locating a user's NTUSER.DAT file, locate the desired hive file on the other hard drive or partition. Unload it after you've exported or corrected the desired information.

Just as files and folders have security attributes to control access based on user and group identity, Registry keys and values have a complete set of Access Control attributes that determine who has rights to read, write, and modify each entry. For example, the Registry keys that control system services can't be modified by non-Administrator users; otherwise they could conceivably make the entries refer to their own programs which would then run at a high privilege level. Access controls on the Registry is thus a key part of Windows security.

If you absolutely must change permissions or auditing controls, locate the desired key or value, right-click it, and select Edit, Permissions. The Permissions dialog looks just like the comparable dialog for files and folders (see Figure 32.12), and lets you set read, write, and modify rights for specific groups and users. There is a corresponding set of audit settings.

Figure 32.12. Registry Key Permissions control which users or groups are allowed to see or modify the Registry key and its values.

Needless to say, incorrectly changing Registry key access rights can cause profound problems with Windows, so I encourage you not to make any changes to Registry access settings unless you're explicitly instructed to do so.

Microsoft produced a tool called TweakUI. If you don't geek-speak, its name means “adjust the user interface in cool and arcane ways.” You can download TweakUI from Microsoft's Web site at www.microsoft.com; search for “Windows XP powertoys.”

Using TweakUI, you can adjust mouse sensitivity, window movement, animation effects, the appearance of icons in the Explorer views, the visibility of desktop icons such as Internet Explorer, the visibility of local and network drives in the Explorer, and some security features such as hiding the name of the last-logged-on user. Tweak UI is covered in more detail in Chapter 23, “Tweaking the GUI.”

X-Setup Pro, by Xteq, is like TweakUI on steroids. This shareware program offers nearly 1,700 settings and tweaks using a slick graphical Explorer-like interface. It includes wizards for some of the more complex tasks like mapping file types to Explorer icons. One of its niftiest features is its ability to record a series of changes to a log file that it can then play back on other computers. Its pricing structure was undergoing change at press time, but the cost should be somewhere between free and US $7. You can download it from www.x-setup.net.

Registry Toolkit is a shareware Registry Editor made by Funduc software with a nifty search-and-replace system. You can scan the Registry, changing all occurrences of one string to another, which is great for some nasty jobs. It also keeps a log of changes made so that edits can be undone. Its user interface isn't very comfortable or slick, but if you need to manage a lot of identical changes in the Registry, this is one tool to check out. It's free to try; $25 to register, at www.funduc.com.

Resplendent Registrar is a powerful Registry editing tool produced by Resplendence Software Projects (www.resplendence.com) with a drag and drop interface. Other features include a Registry defragmentation tool, a Registry compare tool, support for volatile Registry keys, and the option to edit Registry hive files on disk, allowing power users and administrators to edit Registry images of broken Windows installations. It's also shareware ($44.95), and there's a free “lite” version.

Tweak-XP Pro, available from www.totalidea.com combines tweaking tools with additional enhancements and optimizing tools such as a RAM-disk, pop-up ad blocker, RAM reorganizer, file shredder, and so on. The cost is $39.95 for one computer, with multiple-license discounts available.

Not surprisingly, whole Web sites have sprung up to share Windows Registry tips and tricks. If you're interested, you might check out these two sites that I've found to be occasionally useful:

www.winguides.com/registry

www.jsiinc.com/reghack.htm

But to be honest, I don't find all of the listed tips to be helpful, and the TweakUI program I discussed earlier provides an easier way to many of the more useful things.

As for so many things, when it comes to demystifying the Registry, Google is your best friend. If you're looking for the purpose and valid settings of a particular registry key, search Google for the full key name. It's easy: Right-click the key name in the Registry Editor, select Copy Key Name, and paste the name into the Google search field. If you don't get an answer, pare the name down section by section, starting at the left side:

name1
ame2
ame3
ame4

then

name2
ame3
ame4

then

name3
ame4

finally

name4

You can also try searching the microsoft.com Web site using Microsoft's search function, but frankly, Google does a much better job of indexing Microsoft's site than Microsoft does.

How can I determine whether Windows problems are caused by the Registry?

Registry corruption can take two forms: either the Registry's database files can be damaged by an errant disk operation, or information can be entered incorrectly, by hand or by a buggy program. No matter what the cause, the result can be a system that won't run, or one that reboots itself over and over.

Other signs of Registry corruption or errors could be as follows:

How do I recover from a Registry problem?

If any of the signs of a Registry problem occur just after you install new software or hardware, after you've edited the Registry manually, or after an unexpected and unprotected power loss to the computer, then you might have a Registry problem. Try these fixes in turn, checking after each step to see whether the problem is resolved:

How do I track down and eliminate startup programs that don't appear in the Start menu but start anyway when I launch Windows?

When you log on, Windows examines the Startup folder in your personal Start MenuPrograms folder as well as in the corresponding folder under Documents and SettingsAll Users.

In addition, Windows examines the Startup folder in the Start Menu Programs folders of both the user logging in and the All Users folder.

Windows also looks in the Registry for values in the following keys:

HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunOnce
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunOnce

The LOCAL_MACHINE entries are run for all users, and the CURRENT_USER entries are, of course, specific to each individual user.

If you're trying to eliminate a Startup program and can't find it in your own Startup folder, look in the following places: