28. Editing the Registry

What Is the Registry?

The Windows Registry is a database in which Windows and application programs store all manner of configuration settings, startup information, hardware settings, user preferences, file locations, license and registration information, last-viewed file lists, and so on. In addition, the Registry stores the associations between file types and the applications that use them. For example, the Registry holds the information that tells Windows to use Media Player when you click on an MPG movie file. In the early days of DOS and Windows, programs stored this kind of information in a random collection of hundreds of files scattered all over your hard disk. Thankfully, those days are only a dim memory.

How the Registry Is Organized

The Registry is organized a lot like the files and folders on a hard disk. Just as a hard disk can contain partitions, the Registry contains separate sections called top-level keys. In each section is a list of named entries, called keys, which correspond to the folders on a hard disk. And just as a folder can contain files and more nested folders, a Registry key can contain values, which hold information such as numbers or text strings, and more nested keys. Even the way that file folders and Registry keys are described is similar: a folder might be named Usersrianchapter28, and a Registry key might be named HKEY_CURRENT_USERSoftwareMicrosoft.

The two main “top-level” keys are as follows:

• HKEY_LOCAL_MACHINE contains all the hardware and machine-specific setup information for your computer.

• HKEY_USERS contains a key for each user account created on the computer, including the accounts used only internally by Windows services.

The keys under HKEY_USERS are mostly named using long numeric strings that are the user account’s Security Identifier (SID) number. Usually, not all accounts’ keys are visible at the same time. Each account’s key is loaded into the Registry when the user logs on and is unloaded a short time after the user logs out. Each user’s key contains his or her personal Windows and application settings and preferences.

The Registry Editor displays three other sections that look like they are separate top-level keys but that are actually views of information inside HKEY_LOCAL_MACHINE or HKEY_USERS:

• HKEY_CURRENT_USER is a shortcut to the subsection of HKEY_USERS that corresponds to the currently logged-on user. That is, when you run the Registry Editor, HKEY_CURRENT_USER shows your Windows and application preferences and settings.

• HKEY_CURRENT_CONFIG is a shortcut to HKEY_LOCAL_MACHINESystemCurrentControlSetHardware ProfilesCurrent and contains hardware and device settings specific to the hardware profile used when Windows was started.

• HKEY_CLASSES_ROOT stores file associations, the information that Windows uses to link file types to applications, and a huge amount of setup information for Windows software components. It’s actually a combined view of the contents of two other Registry sections: HKEY_LOCAL_MACHINESoftwareClasses, which holds settings that are made for all users, and HKEY_CURRENT_USERSoftwareClasses, which holds personal settings made just by the current user. If the same value is defined in both HKEY_CURRENT_USER... and HKEY_LOCAL_MACHINE..., the HKEY_CURRENT_USER value is used.

New Registry Features

Windows Vista introduced some new features to the Registry: virtualization and 64/32–bit reflection. These features are also present, although somewhat changed in Windows 7, and this section gives you a brief tour. The features are called Registry virtualization, redirection and reflection. This topic is pretty gnarly and obscure, so on your first read, you might want to skip ahead to the section titled “Backing Up and Restoring the Registry.”

Registry Virtualization

On Windows 7 and Vista, if an older application attempts to store information to HKEY_LOCAL_MACHINESoftwarexxxyyy but doesn’t have permission to change that key, the information will actually be stored in HKEY_CURRENT_USERSoftwareCLASSESVirtualStoreMACHINESoftwarexxxyyy. This is called Registry virtualization. Applications that the user runs will still “see” the information as if it was in the intended location. As a result, applications that aren’t aware of the new, tighter restrictions on HKEY_LOCAL_MACHINE will run without a hitch, although their settings will be per-user instead of machinewide.

You need to know this so you can check the alternative locations when you’re investigating problems with Registry settings in your system.

If you change an application program’s preference setting that should apply to all users of the program, but it affects only you, and the setting isn’t changed when other users run the application, most likely the configuration setting is stored in a Registry key under HKEY_LOCAL_MACHINE that isn’t writeable by you. When you make the change, Windows virtualizes the Registry value, and only your account sees the change.

To fix this, first try to contact the software manufacturer for a workaround. If none exists, try this:

1. Locate the Registry key in which the setting is being saved. Either search the Registry for the setting value or use a Registry change-monitoring tool such as Registrar Registry Manager, or procmon from sysinternals.com, to see where the application saves your setting.

2. As an Administrator, locate the key in the left pane of the Registry Editor, right-click it, and select Permissions. Select the Users entry and check Full Control.

3. Using your account, locate the virtualized copy of the key under HKEY_CLASES_ROOTVirtualStore and delete it.

4. Run the application and change the setting again.

After this, everyone should share the same copy of the setting.

Virtualization doesn’t occur under some circumstances. In those cases, the application simply is allowed to fail in its attempt to make changes to HKEY_LOCAL_MACHINE. These circumstances are listed here:

• If User Account Control is disabled.

• If virtualization is disabled by your network administrator, using Group Policy on a Windows domain network.

• If the application is a 64-bit application.

• If the application program has a manifest, a block of data inside the application or in a separate file that describes advanced security settings. Almost all the applications that come with Windows—including Notepad; the command-prompt interpreter, cmd.exe; and the Registry Editor—have manifests, so almost all Windows utilities do not see virtualized Registry settings.

• If a key is marked with a special flag that indicates that it is not to be redirected. HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun is marked this way so that a virus that attempts to set itself up to run at logon via this key won’t be capable of doing so. The command-line utility REG can modify the virtualization flag. Type REG FLAGS /? at the command-line prompt for more information.

Virtualization is seen as a stopgap measure and will be unnecessary when most applications either store information in HKEY_CURRENT_USER or explicitly set less restrictive permissions on their keys in HKEY_LOCAL_MACHINE when they’re installed.

Registry Redirection and Reflection

The 64-bit versions of Windows support running 32-bit Windows applications. This presents a problem because many Windows subcomponents are present in both 32- and 64-bit versions, and information about them (such as program filenames) is stored in the Registry under keys whose names were determined before Microsoft considered the need to distinguish between the two flavors. To manage this, Windows stores information for 32-bit components in an alternate location and feeds the stored information to 32-bit applications when they ask for values from the original location. This is called Registry redirection. The information for 32-bit applications is actually redirected to HKEY_LOCAL_MACHINESoftwareWOW6432Node. When a 32-bit application requests information from a redirected key using the original location, it is fed information from below WOW6432Node.

When working with the Registry on a 64-bit system, you need to know to look under WOW6432Node when looking for setup information for 32-bit components.

Alternatively, you can use the 32-bit version of regedit; this presents all information in the standard locations seen by 32-bit applications. When you run regedit from the command line, you get the 64-bit version. However, if you run %systemroot%syswow64 egedit.exe, you get the 32-bit version and can edit the values seen by 32-bit applications.

So that the 32-bit and 64-bit versions of components and applications can communicate, some settings and values that these components store in the registry are copied to both locations. This is called Registry reflection.

Reflection was used in several sections of the Registry in Windows Vista, but in Windows 7, only two keys are subject to reflection:

For more information on reflection, see Microsoft Knowledge Base article 305097 at http://support.microsoft.com/kb/305097. Also, search msdn.microsoft.com for the article titled “Removal of Windows Registry Reflection.”

Backing Up and Restoring the Registry

Because the Registry is now the one place where all the Windows hardware and software settings are stored, it’s also the one thing that Windows absolutely needs to run. If you have to use the Registry Editor to manually change Registry settings, we strongly suggest that you back up your Registry before you make any changes.

Backing Up the Registry

You can back up the Registry several ways. In order of preference, these are using a third-party Registry-backup program, backing up the entire hard disk using a third-party program or Complete PC Backup, using System Restore, and using the Registry Editor to save a key to a text file.

I suggest that you use a third-party disk-backup solution to back up the Registry files every time you back up your hard disk. Before you install a piece of new hardware or a significant software package, do a full disk backup, including the Registry. Before you manually edit the Registry for other purposes, back up the Registry by any of the means discussed in the next few sections.

Backing Up with Third-Party Registry-Backup Software

There are third-party programs specifically designed to back up and restore the Registry. For example, SuperWin’s WinRescue program (www.superwin.com) not only can back up and restore the Registry, but also can defragment the Registry’s files and work magic to revive a nonbootable Windows system. (There is a version called WinRescue Vista that you should use if no Windows 7–specific version has been released.) There is also a free tool called ERUNT, which you can download from www.larshederer.homepage.t-online.de/erunt.

These programs come with instructions on backing up, restoring, repairing, and maintaining the Registry.

Backing Up the Hard Disk

You can save the Registry by performing a backup of the entire contents of the hard disk on which Windows resides. On the Windows 7 Home versions, you’ll have to use a third-party disk backup program to back up the entire hard disk. On Windows 7 Professional, Enterprise, and Ultimate editions, the Complete PC Backup program can do this for you, or you can use a third-party program.

As an alternative to doing a full disk backup, most third-party disk-backup programs made for Windows 7 include an option to back up the system portion of the Registry. If you use this option, be sure to include all user profiles (everything under User) so that personal Registry sections are saved as well.

Check your backup software’s manual for instructions on saving Registry and system information when you back up. I suggest that you always include the Registry in your backups.

Backing Up with System Restore

If you will be changing only entries under HKEY_LOCAL_MACHINE, you can create a restore point to back up a copy of this part of the Registry. To create a restore point, follow these steps:

1. Click Start. Right-click Computer and select Properties. Then, at the left, select System Protection. (Alternatively, type sysdm.cpl in a Command Prompt window, and then select the System Protection tab.)

2. Be sure that the disk volume that contains Windows is checked, and click Create.

3. Enter a description for the restore point, such as Before changing Registry, and then click Create.

Then, edit the Registry as described later in this chapter.

Backing Up with the Registry Editor

The Registry Editor has a mechanism to export a set of Registry keys and values to a text file. If you can’t or won’t use a more comprehensive backup system before you manually edit the Registry, at least use this editor to select and back up the key that contains all the subkeys and values you plan to modify. Remember, though, that Regedit cannot remove entries you added that were not in the Registry before the backup!

To back up a key and its subkeys and values, follow these steps:

1. To run Regedit, click Start, and type regedit in the Search box.

2. When Regedit appears under Programs in the search results, select it and press Enter. (Alternatively, type regedit in a Command Prompt window.)

3. Locate and select the key you plan to modify, or a key containing all the keys you plan to modify, in the left pane.

4. Select File, Export.

5. Choose a location and filename to use to store the Registry keys. I usually use the desktop for temporary files like this, so that I’ll see them and delete them later.

6. Select All Files from the Save As Type list, and enter a name (possibly with an extension other than .reg—for example, before.sav).

7. Click Save. The chosen key or keys are then saved as a text file.

Restoring the Registry

If you’ve made Registry changes that cause problems, you can try to remember each and every change you made, re-enter the original information, delete any keys you added, and thus undo the changes manually. Good luck! If you were diligent and made a backup before you started, however, you can simply restore the backup and have confidence that the recovery is complete and accurate.

If you made a Registry backup using a third-party disk or Registry backup tool, use the instructions that came with your product to restore the Registry. If you created a restore point or used Regedit, follow the steps described in the following sections.

Restoring the Registry from a Restore Point

If you created a restore point before modifying the Registry, you can back out the change by following these steps:

1. Click Start. Right-click Computer and select Properties. At the left, select System Protection. Then, click the System Restore button. (Alternatively, type rstrui in a Command Prompt window.)

2. Locate the restore point you created. Select it and click Next; then click Finish. Windows will restart.

If the Registry problem is severe enough that Windows can’t boot or get to the System Restore function, you can perform a system restore from the system recovery tools on your Windows setup DVD. See “Using System Recovery” on page 738 for instructions for performing a system restore this way.

Restoring the Registry from Regedit

If a Registry editing session has gone awry and you need to restore the Registry from a key you saved from within Regedit, follow these steps:

1. In Regedit, select File, Import.

2. Select All Files from the Files of Type list.

3. Locate the file you used to back up the Registry key or keys—for example, before.reg.

4. Select Open.

The saved Registry keys are then imported, replacing any changes or deletions. However, any keys or values you’ve added to the Registry are not removed. If they are the cause of the problem, this restore will not help.

If the Registry problems persist, you can try a rather drastic measure: You can use Regedit to delete the key or keys that were changed and then import the backup file again. This time, any added keys or values are removed. I suggest that you try this approach only with keys related to add-on software, not for any of the Microsoft software or hardware keys.

Using Regedit

Most people never need to edit the Registry by hand because most Registry keys are set by the software that uses them. However, you might need to edit the Registry by hand if you’re directed by a technical support person who’s helping you fix a problem, or when you’re following a published procedure to make an adjustment for which there is no Control Panel setting.

In the latter case, before going any further, I need to say this one last time, to make it absolutely clear: Unless you’re quite certain that you can’t make a mistake, back up the Registry (or at least the section you want to change) before making any changes.

The next few sections cover the basics of the Registry Editor.

Viewing the Registry

The Registry Editor doesn’t have a Start menu item. The easiest way to run it is to type regedit into the Search field on the Start menu. When regedit appears in the results pane under Programs, take one of the following actions, depending on your needs:

• If you are logged on as an Administrator, press Enter or click regedit. When the User Account Control dialog box appears, click Continue. The Registry Editor will run with full elevated privileges.

• If you are not logged on as an Administrator but need to change settings in only the HKEY_CURRENT_USER section of the Registry, press Enter or click regedit. The Registry Editor will run with reduced privileges, and you will not be able to change systemwide settings.

• If you are not logged on as an Administrator but need to change systemwide settings in HKEY_LOCAL_MACHINE, right-click regedit and select Run as Administrator. Enter an Administrator account’s username and password. The Registry Editor will then run with full elevated privileges.

Regedit displays a two-pane display much like Windows Explorer, as shown in Figure 28.1. The top-level keys, which are listed below Computer, can be expanded just like drives and folders in Explorer. In the pane on the right are the values for each key. The name of the currently selected key appears in the status bar.

Figure 28.1 The Regedit screen shows keys on the left and values on the right.

Values have names, just as the files in a folder do, and it’s in the values that configuration information is finally stored. Each key has a (Default) value, which is the value of the key itself, and any number of named values. For example, Figure 28.1 shows the key HKEY_CURRENT_USERControl PanelDesktop. The value of HKEY_CURRENT_USERControl PanelDesktop itself is undefined (blank), and the value HKEY_CURRENT_USERControl PanelDesktopDragFullWindows is 1.

Registry values have a data type, which is usually one of the types shown in Table 28.1. The Registry Editor display lists values by their technical names.

Table 28.1 Data Types Supported by Regedit

Other data types, such as REG_DWORD_BIG_ENDIAN and REG_RESOURCE_LIST, exist, but they are obscure and rare and can’t be edited with Regedit.

Searching in the Registry

You can search for a Registry entry by key name, value name, or the contents of a value string. First, select a starting point for the search in the left pane. You can select Computer to select the entire Registry, or you can limit your search to one of the top-level keys or any subordinate key. Next, select Edit, Find from the menu and enter a search string in the Find dialog box. The Find feature is not case sensitive, so it doesn’t matter whether you use upper- or lowercase letters. You can check any of the Look At boxes to designate where in the Registry you expect to find the desired text: in the name of a key, in the name of a value, or in the data, the value itself.

Check Match Whole String Only to search only for items whose whole name or value is the desired string.

Click Find Next to start the search. The Regedit display indicates the first match to your string; by pressing F3, you can repeat the search to look for other instances.

Also remember that Windows 7 might store information in some places you are not familiar with, as discussed previously under “New Registry Features.”

Editing Keys and Values

Regedit has no Save or Undo menu items. Changes to the Registry happen immediately and permanently. Additions, deletions, and changes are for real. This is the reason for all the warnings to back up before you poke into the Registry.

Adding a Value

To add a value to a key, select the key in the left pane and choose Edit, New. Select the type of value to add; you can select any of the supported Registry data types, which are listed by the “friendly” names shown previously in Table 28.1. The instructions you’re following indicate which type of value to add. A new value entry then appears in the right pane.

Type the new value’s name and press Enter to edit the value:

• For string values, enter the text of the desired string.

• For DWORD values, choose Decimal or Hexadecimal, and enter the desired value in the chosen format.

• For binary values, enter pairs of hexadecimal characters as instructed. (You’ll never be asked to do this, I promise.)

Changing a Value

If you want to change a value, double-click it in the right pane to bring up the Edit Value dialog box. Alternatively, right-click it and select Modify. Then make the desired change and click OK.

That is all you will likely ever need to do with Regedit. However, in the extremely unlikely case that you want to delete a value or add or remove a key, the following sections can help see you through these processes.

Deleting a Value

If you’ve added a Registry value in the hope of fixing some problem and found that the change wasn’t needed, or if you’re instructed to delete a value by a Microsoft Knowledge Base article or other special procedure, you can delete the entry by viewing its key and locating the value on the right pane.

Select the value and choose Edit, Delete from the menu, or right-click and select Delete from the context menu. Confirm by clicking OK.

Adding or Deleting a Key

Keys must be added as subkeys of existing keys; you can’t create a new top-level key. To add a key, select an existing key in the left pane and select Edit, New, Key from the menu. Alternatively, right-click the existing key and select New, Key from the context menu. A new key appears in the left pane, where you can edit its name. Press Enter after you enter the name.

You can delete a key by selecting it in the left pane and choosing Edit, Delete from the menu, or by right-clicking it and selecting Delete from the context menu. Click OK to confirm that you intend to delete the key. Deleting a key deletes its values and all its subkeys as well, so without the protection of Undo (or a Registry Recycling Bin), this action is serious.

Renaming a Key

As you have probably guessed, the pattern for renaming a key follows the Explorer model exactly: Choose the key in the left pane and select Edit, Rename, or right-click the key and select Rename. Finally, enter a new name and press Enter.

Using Copy Key Name

As you have probably noticed by now, the names of Registry keys can be quite long, tortuous things. The Registry Editor offers a bit of help to finger-fatigued Registry Editors (and authors): Choosing Edit, Copy Key Name puts the name of the currently selected key into the Clipboard so you can paste it elsewhere if you need to.

Editing Registry Entries for Another User

As an administrator, you might find it necessary to edit HKEY_USER entries for another user. For example, a startup program in HKEY_CURRENT_USERSoftwareWindowsCurrentVersionRun might be causing such trouble that the user can’t log on. If you can’t log on as that user, you can edit his HKEY_CURRENT_USER Registry keys in another way:

1. Log on as an Administrator and run Regedit.

2. Select the HKEY_USERS window.

3. Highlight the top-level key HKEY_USERS.

4. Select File, Load Hive.

5. Browse to the profile folder for the desired user. For a local user account, this is in Usersusername. (For a Windows Server domain, look in the folder used for user profiles on the domain controller.) The folder name of this folder might have the computer name or a domain name attached. For example, on one computer, my profile folder name is bknittel.java.

6. Type the filename NTUSER.DAT. (The file will most likely not appear in the Browse dialog box because it’s super hidden: marked with both the Hidden and System attributes.) Then click Open.

7. A dialog box appears, asking you to enter a name for the hive. HKEY_USERS normally loads user hives with a long numeric name, so I suggest that you type the user’s logon name. Click OK. The user’s Registry data is then loaded and can be edited, as shown in Figure 28.2.

Figure 28.2 An offline user’s Registry hive is now loaded and can be edited.

8. When you’re finished editing, unload the hive. Select the key you added under HKEY_USERS (for example, daves_key in Figure 28.2), and select File, Unload Hive. Confirm by clicking Yes on the warning dialog box.

Editing Registry Entries for Another Windows Installation

If you need to retrieve Registry entries from an installation of Windows installed on another hard disk or partition, you can load any of that installation’s hive files for editing or exporting.

To edit the other installation’s Registry, you need to locate its hive files. They are usually found in the locations shown in Table 28.2.

Table 28.2 Usual Location of Hive Files

To edit another Windows installation’s Registry, use the technique I described under “Editing Registry Entries for Another User,” but instead of locating a user’s NTUSER.DAT file, locate the desired hive file on the other hard drive or partition. Unload it after you’ve exported or corrected the desired information.

In some cases, you will find that you cannot view or modify keys loaded from another installation. This occurs if the keys are protected with security attributes that list specific users or groups defined in the other installation. In this case, you need to first take ownership of the keys and then add yourself as a user who is authorized to read or change the keys. The next section describes this.

Editing Registry Security

Just as files and folders in an NTFS-formatted disk partition have security attributes to control access based on user and group identity, Registry keys and values also have a complete set of Access Control attributes that determine who has rights to read, write, and modify each entry.

If you absolutely must change permissions or auditing controls, locate the desired key or value, right-click it, and select Permissions. The Permissions dialog box looks just like the comparable dialog box for files and folders (see Figure 28.3), and lets you set read, write, and modify rights for specific groups and users. You’ll find a corresponding set of audit settings.

Figure 28.3 Registry key permissions control which users or groups are allowed to see or modify the Registry key and its values.

In most cases, a software vendor supplies precise instructions for making changes necessary to work around an application problem. Here, I describe a general procedure to make a given key readable and writeable by all users. You might do this to make a key capable of sharing information between users, or to repair an alternate Windows installation, as mentioned in the previous section. To set more generous permissions, follow these steps:

1. Locate and select the key in the left pane.

2. Right-click it and select Permissions.

3. Select the Users entry in the top Group or User Names section. If Users is not listed, click Add, type Users, and click OK.

4. In the lower section, check Full Control and then click Apply. If this is successful, click OK.

5. If you are unable to make the changes even though you’re running the Registry Editor as an Administrator, click Advanced and select the Owner tab.

6. If the Current Owner is listed as unknown, select Administrators in the lower list and click OK.

7. Click OK to close the Advanced Security Settings dialog box, and return to Step 3.

This is a risky procedure because it could result in another user or application being unable to access its own Registry keys. Use this as a procedure of last resort.

Other Registry Tools

There are some third party tools that you can use to edit the registry and adjust Windows features. Here are four of the more popular utilities.

X-Setup Pro

X-Setup Pro by Xteq offers nearly 1,700 settings and tweaks using a slick graphical Explorer-like interface. It includes wizards for some of the more complex tasks, such as mapping file types to Explorer icons. One of its niftiest features is its capability to record a series of changes to a log file that it can then play back on other computers. The cost is $20. You can download it from www.x-setup.net.

Registry Toolkit

Registry Toolkit is a shareware Registry Editor made by Funduc software, with a nifty search-and-replace system. You can scan the Registry, changing all occurrences of one string to another, which is something most other Windows Registry Editors can’t do. Its user interface isn’t very comfortable or slick, but if you need to manage a lot of identical changes in the Registry, this is one cool tool. It’s free to try, $25 to register, at www.funduc.com.

Registrar Registry Manager

Registrar Registry Manager is a powerful Registry-editing tool produced by Resplendence Software Projects (www.resplendence.com), with a drag-and-drop interface. It includes a Registry backup, restore, and defragmentation tool, a Registry-compare tool, an undo capability, and many more features. The full version costs €45 (about $63), and there is a free “lite” version.

Tweak-7

Tweak-7 from Totalidea Software, available at www.totalidea.com, combines tweaking tools with additional enhancements and plug-ins. The cost is $39.99 for one computer, with multiple-license discounts available.

Registry Privileges and Policies

On Windows corporate “domain”-type networks, administrators can use the policy system to restrict users’ ability to change their computer configuration. When you log on using a Domain user account, the policy system downloads and installs Registry settings prepared by system administrators. These Registry settings not only can help automate the setup of networking and other components, but can also restrict your ability to (mis)manage your computer.

Here’s how it works: Windows looks at a boatload of Registry entries to determine what features to make available to you. For example, one value determines whether the Start menu is allowed to display the Run item; another makes the Control Panel hide the Power Management settings. Most of these values normally don’t appear in the Registry at all, but they can be installed there by the policy system, and Windows security settings prevent users from changing or deleting them.

On a computer that’s a member of a Windows Domain network, the policy system is called Group Policy. On a standalone computer, it’s called Local Security Policy. Local Security Policy is described in more detail under “Tightening Local Security Policy” on page 934.