CHAPTER 34 Tweaking Windows with the Registry Editor

Both Windows Vista and Windows XP offer lots of tools for tweaking and customizing. All these tools are hidden so that novice users can’t get their mitts on them and do untold damage to their PCs. Fortunately for the likes of you and me, most of these tweaking tools are hidden in plain sight, meaning that you can get to them with just a mouse click or three. For example, most Windows objects (such as the desktop and Start menu) have an associated property sheet with various customization options, and you display the property sheet by right-clicking the object and then clicking Properties. Similarly, the various icons in the Control Panel (click Start, Control Panel) are a customizer’s delight.

You learned about these relatively easy-to-find tools throughout this book, but you also saw lots of tweaks that used a more deeply hidden tool called the Registry Editor. As its name implies, you use this program to edit the Registry, which is a massive storehouse of Windows settings, stored values, and saved data. If you can tweak an object, Windows almost certainly stores that object’s settings somewhere in the Registry.

Most of the time, you change an object’s Registry values using its property sheet or tools such as Control Panel and the Group Policy Editor (which you learn about in Chapter 35, “Controlling Windows with the Group Policy Editor”). However, tons of Windows tweaks happen only by adjusting some Registry setting directly, so it’s crucial that you know how to operate the Registry Editor. This chapter tells you everything you need to know to find settings, modify them, and, most importantly, to keep the Registry safe.

Firing Up the Registry Editor

All the direct work you do with the Registry will happen inside the reasonably friendly confines of a program called the Registry Editor, which enables you to view, modify, add, and delete Registry settings. It also has a search feature to help you find settings and export and import features that enable you to save settings to and from a text file.

To launch the Registry Editor, use one of the following techniques:

• Windows Vista—Click Start, type regedit into the Search box, and then click regedit.exe in the results. (You can also press Windows Logo+R or select Start, All Programs, Accessories, Run to open the Run dialog box, type regedit, and click OK.) Enter your User Account Control credentials to continue.

• Windows XP—Press Windows Logo+R or select Start, Run to open the Run dialog box, type regedit, and click OK.

Figure 34.1 shows the Registry Editor window that appears. (Note that your Registry Editor window might look different if someone else has used the program previously. Close all the open branches in the left pane to get the view shown in Figure 34.1.)

FIGURE 34.1 Run the regedit command to launch the Registry Editor, the program that enables you to work with the Registry’s data.

Taking a Tour of the Registry

The Registry Editor is divided into two sections:

• Keys pane—This is the left side of the Registry Editor window, and it contains the hierarchy of keys that Windows uses to organize the data in the Registry.

• Settings pane—This is the right side of the Registry Editor window, and it shows the settings associated with the currently selected key.

Getting Around in the Keys Pane

The keys pane is organized in a treelike hierarchy. The five keys that are visible when you first open the Registry Editor are special keys called handles (which is why their names all begin with HKEY). These keys are collectively referred to as the Registry’s root keys. The root keys are your Registry starting points, so you need to become familiar with what kinds of data each key holds. Here’s a quick summary:

• HKEY_CLASSES_ROOT—This root key—usually abbreviated as HKCR—contains data related to file extensions and their associated programs, the objects that exist in the Windows Vista system, as well as applications and their Automation information. There are also keys related to shortcuts and other interface features.

• HKEY_CURRENT_USER—This root key—usually abbreviated as HKCU—contains data that applies to the currently logged on user. It contains user-specific settings for Control Panel options, network connections, applications, and more.

• HKEY_LOCAL_MACHINE—This root key—usually abbreviated as HKLM—contains non-user-specific configuration data for your system’s hardware and applications.

• HKEY_USERS—This root key—usually abbreviated as HKU—contains settings that are similar to those in HKEY_CURRENT_USER. HKEY_USERS is used to store the settings for users with group policies defined, as well as the default settings (in the .DEFAULT subkey), which get mapped to a new user’s profile.

• HKEY_CURRENT_CONFIG—This root key—usually abbreviated as HKCC—contains settings for the current hardware profile.

These keys all contain subkeys, which you can display by clicking the plus sign (+) to the left of each key, or by selecting a key and pressing the plus-sign key on your keyboard’s numeric keypad. When you open a key, the plus sign changes to a minus sign (-). To close a key, click the minus sign or highlight the key and press the minus-sign key on the numeric keypad.

Understanding Registry Settings

The settings pane on the right side of the Registry Editor window displays the settings contained in each key. The settings pane is divided into three columns:

• Name—This column tells you the name of each setting in the currently selected key.

• Type—This column tells you the data type of the setting. There are six possible data types (in Vista; XP has only five):

REG_SZ—This is a string value.

REG_MULTI_SZ—This is a series of strings.

REG_EXPAND_SZ—This is a string value that contains an environment variable name that gets “expanded” into the value of that variable. For example, the %SystemRoot% environment variable holds the folder in which Windows Vista was installed. So, if you see a Registry setting with the value %SystemRoot%System32, and Windows Vista is installed in C:Windows, the setting’s expanded value is C:WindowsSystem32.

REG_DWORD—This is a double word value: a 32-bit hexadecimal value arranged as eight digits. For example, 11 hex is 17 decimal, so this number would be represented in DWORD form as 0x00000011 (17). (Why “double word”? A 32-bit value represents four bytes of data, and because a word in programming circles is defined as two bytes, a four-byte value is a double word.)

REG_QWORD (Vista only)—This is a quadruple word value: a 64-bit hexadecimal value arranged as 16 digits. Note that leading zeros are suppressed for the high 8 digits. Therefore, 11 hex appears as 0x00000011 (17) and 100000000 hex appears as 0x1000000000 (4294967296).

REG_BINARY—This value is a series of hexadecimal digits.

• Data—This column displays the value of each setting.

Keeping the Registry Safe

Windows is utterly dependent on the Registry, so it’s not even remotely a stretch to say that if something bad happens to the Registry, chances are that Windows itself will go belly up. That sounds ominous and more than a little intimidating, no doubt, but I have two pieces of good news that I trust will mitigate these feelings. First, it’s actually fairly hard to really mess up the Registry. I’ve been tweaking the Registry regularly on dozens of different Windows boxes over the past decade and half or so, and not once have I ever had a machine crash because of an improper Registry edit. Second, even if you do cause Windows to go haywire with an injudicious Registry edit, all is not lost because you can usually use System Restore or a backup copy of all or part of the Registry to recover with no permanent harm done.

So how can you avoid problems when mucking around in the Registry’s innards? Here are the three most important pieces of advice you’ll ever learn about working with the Registry:

• If you’re not completely sure what a Registry setting does, don’t mess with it. Ever. Seriously.

• If you’re following someone else’s directions for making a Registry edit (such as the directions you see throughout this book), make only the change (or changes) outlined in the steps. Don’t suddenly go random and start modifying nearby settings “just to see what happens.” Also, double-check your edits to make sure you’ve done them exactly as described in the steps.

• Never delete anything from the Registry. If you want Windows to stop using a particular setting, rename it (as described a bit later) instead of deleting it. This way, if the results aren’t what you want, you can usually recover just by restoring the setting’s original name.

Preventing Other Folks from Messing with the Registry

Do you share your computer with other people? How brave! In that case, there’s a pretty good chance that you don’t want them to have access to the Registry Editor. In Windows Vista, User Account Control automatically blocks Standard users unless they know an administrator’s password. For other administrators, or if you’re using Windows XP, you can prevent any user from using the Registry Editor by setting a group policy (again, see Chapter 35):

1. Press Windows Logo+R to open the Run dialog box, type gpedit.msc, and then click OK.

2. In Windows Vista, enter your UAC credentials to continue.

3. Open the User Configuration, Administrative Templates, System branch.

4. Double-click the Prevent Access to Registry Editing Tools policy.

5. Click Enabled.

6. In the Disable Regedit from Running Silently? list, click Yes.

7. Click OK.

Note that you won’t be able to use the Registry Editor, either. However, you can overcome that by temporarily disabling this policy prior to running the Registry Editor. Even better, you can run the following script, which toggles the Registry Editor between enabled and disabled:

Note that in Vista you need to run this script as the Administrator. I show you a tweak for doing this in Chapter 12, “Taking Advantage of the Administrator Account.”

• See “Run a Script as the Administrator,” p. 141.

Backing Up the Registry in Vista

Windows Vista maintains what is known as the system state: the crucial system files that Windows Vista requires to operate properly. Included in the system state are the files used during startup, the system files, and, naturally, the Registry files. Windows Vista’s Backup utility has a feature called Complete PC Backup that enables you to easily back up the current system state, so it’s probably the most straightforward way to create a backup copy of the Registry should anything go wrong. See the “Backing Up Your Files” section in Chapter 26, “Building Better Backups,” for the details.

• See “Create a Backup of Your Entire Computer,” p. 302.

Backing Up the Registry in XP

Windows XP also maintains a system state, which includes the startup files, system files, and the Registry files. The Backup utility has a feature that enables you to easily back up the current system state, so it’s probably the most straightforward way to create a backup copy of the Registry should anything go wrong.

Here are the steps to follow to back up the system state in Windows XP:

1. Select Start, All Programs, Accessories, System Tools, Backup. (Note that if you’re using Windows XP Home, you might need to install Backup from the Windows XP CD.)

2. If the Backup or Restore Wizard appears, click the Advanced Mode link.

3. Display the Backup tab.

4. In the folder tree, open the Desktop branch and then the My Computer branch, if they’re not open already.

5. Activate the System State check box.

6. Choose your other backup options, click Start Backup, and then follow the usual backup procedure.

Saving the Current Registry State with System Restore

Another easy way to save the current Registry configuration is to use the System Restore utility. This program takes a snapshot of your system’s current state, including the Registry. If anything should go wrong with your system, the program enables you to restore a previous configuration. It’s a good idea to set a system restore point before doing any major work on the Registry. Later in this book I show you a script that enables you to create an on-the-fly restore point; see Chapter 24, “Dealing with Disk Drives.”

• See “Create an Instant Restore Point,” p. 280.

Protecting Keys by Exporting Them to Disk

If you’re just making a small change to the Registry, backing up all its files might seem like overkill. Another approach is to back up only the part of the Registry that you’re working on. For example, if you’re about to make changes within the HKEY_CURRENT_USER key, you could back up just that key, or even a subkey within HKCU. You do that by exporting the key’s data to a registration file, which is a text file that uses the .reg extension. That way, if the change causes a problem, you can import the .reg file back into the Registry to restore things the way they were.

Exporting the Entire Registry to a .reg File

The easiest way to protect the entire Registry is to export the whole thing to a .reg file on a separate hard drive or network share. Note that the resulting file will be 90 to 100MB, and possibly larger, so make sure the target destination has enough free space. Here are the steps to follow:

1. Open the Registry Editor.

2. Select File, Export to display the Export Registry File dialog box.

3. Select a location for the file.

4. Use the File Name text box to type a name for the file.

5. Activate the All option.

6. If you’ll be importing this file into a system running Windows 9x, Windows Me, or Windows NT, use the Save As Type list to choose the Win9x/NT 4 Registration Files (*.reg) item.

7. Click Save.

Exporting a Key to a Registration File

Here are the steps to follow to export a key to a registration file:

1. Open the Registry Editor and select the key you want to export.

2. Select File, Export to display the Export Registry File dialog box.

3. Select a location for the file.

4. Use the File Name text box to type a name for the file.

5. Activate the Selected Branch option.

6. If you’ll be importing this file into a system running Windows 9x, Windows Me, or Windows NT, use the Save As Type list to choose the Win9x/NT 4 Registration Files (*.reg) item.

7. Click Save.

Importing a Registration File

If you need to restore the key that you backed up to a registration file, follow these steps:

1. Open the Registry Editor.

2. Select File, Import to display the Import Registry File dialog box.

3. Find and select the file you want to import.

4. Click Open.

5. When Windows Vista tells you the information has been entered into the Registry, click OK.

Working with Registry Entries

Now that you’ve had a look around, you’re ready to start working with the Registry’s keys and settings. In this section, I’ll give you the general procedures for basic tasks, such as modifying, adding, renaming, deleting, and searching for entries, and more. These techniques will serve you well throughout the rest of the book when I take you through some specific Registry modifications.

Changing the Value of a Registry Entry

Changing the value of a Registry entry is a matter of finding the appropriate key, displaying the setting you want to change, and editing the setting’s value. Unfortunately, finding the key you need isn’t always a simple matter. Knowing the root keys, as described earlier, will certainly help, and the Registry Editor has a Find feature that’s invaluable (I’ll show you how to use it later).

To illustrate how this process works, let’s work through an example: changing your registered owner name and company name. In versions of Windows prior to Vista, the installation process probably asked you to enter your name and, optionally, your company name. These registered names appear in several places as you work with Windows:

• If you select Help, About in most Windows programs, your registered names appear in the About dialog box.

• If you install a 32-bit application, the installation program uses your registered names for its own records (although you usually get a chance to make changes).

Unfortunately, if you install a clean version of Windows Vista, Setup doesn’t ask you for this data, and it takes your username as your registered owner name. (If you upgraded to Windows Vista, the owner name and company name were brought over from your previous version of Windows.) With these names appearing in so many places, it’s good to know that you can change either or both names (for example, to put in your proper names if Vista doesn’t have them or if you give the computer to another person). The secret lies in the following key:

HKLMSOFTWAREMicrosoftWindowsNTCurrentVersion

To get to this key, you open the following branches in the Registry Editor’s tree pane: HKEY_LOCAL_MACHINE, then SOFTWARE, then Microsoft, and then Windows NT. Finally, click the CurrentVersion subkey to select it. Here you see a number of settings, but two are of interest to us (see Figure 34.2):

FIGURE 34.2 Navigate to HKLMSOFTWAREMicrosoftWindows NTCurrentVersion to see your registered names.

To open the setting for editing, double-click it (or select the setting name and either select Edit, Modify or press Enter). The dialog box that appears depends on the value type you’re dealing with, as discussed in the next few sections. Note that edited settings are written to the Registry right away, but the changes might not go into effect immediately. In many cases, you need to exit the Registry Editor and then either log off or restart Windows.

Editing a String Value

If the setting is a REG_SZ value (as it is in our example), a REG_MULTI_SZ value, or a REG_EXPAND_SZ value, you see the Edit String dialog box, shown in Figure 34.3. Use the Value Data text box to enter a new string or modify the existing string, and then click OK. (For a REG_MULTI_SZ multistring value, Value Data is a multiline text box. Type each string value on its own line. That is, after each string, press Enter to start a new line.)

FIGURE 34.3 You see the Edit String dialog box if you’re modifying a string value.

Editing a DWORD or QWORD Value

If the setting is a REG_DWORD, you see the Edit DWORD (32-Bit) Value dialog box shown in Figure 34.4. In the Base group, select either Hexadecimal or Decimal, and then use the Value Data text box to enter the new value of the setting. (If you chose the Hexadecimal option, enter a hexadecimal value; if you chose Decimal, enter a decimal value.) Note that editing a QWORD value is identical, except that the dialog box is named Edit QWORD (64-Bit) Value, instead.

FIGURE 34.4 You see the Edit DWORD Value dialog box if you’re modifying a double word value.

Editing a Binary Value

If the setting is a REG_BINARY value, you see an Edit Binary Value dialog box like the one shown in Figure 34.5.

FIGURE 34.5 You see the Edit Binary Value dialog box if you’re modifying a binary value.

For binary values, the Value Data box is divided into three vertical sections:

• Starting Byte Number—The four-digit values on the left of the Value Data box tell you the sequence number of the first byte in each row of hexadecimal numbers. This sequence always begins at 0, so the sequence number of the first byte in the first row is 0000. There are eight bytes in each row, so the sequence number of the first byte in the second row is 0008, and so on. You can’t edit these values.

• Hexadecimal Numbers (Bytes)—The eight columns of two-digit numbers in the middle section display the setting’s value, expressed in hexadecimal numbers, where each two-digit number represents a single byte of information. You can edit these values.

• ANSI Equivalents—The third section on the right side of the Value Data box shows the ANSI equivalents of the hexadecimal numbers in the middle section. For example, the first byte of the first row is the hexadecimal value 54, which represents the uppercase letter T. You can also edit the values in this column.

Editing a Registration File

If you exported a key to a registration file, you can edit that file and then import it back into the Registry. To make changes to a registration file, find the file in Windows Explorer, right-click the file, and then click Edit. Windows opens the file in Notepad.

Creating a Registration File

You can create registration files from scratch and then import them into the Registry. This is a handy technique if you have some customizations that you want to apply to multiple systems.

Windows Vista registration files always start with the following header:

Windows Registry Editor Version 5.00

Next is an empty line followed by the full path of the Registry key that will hold the settings you’re adding, surrounded by square brackets. Here’s an example:

[HKEY_CURRENT_USERTest]

Below the key, you add the setting names and values, which use the following general form:

“SettingName”=identifier:SettingValue

Renaming a Key or Setting

I mentioned earlier that instead of deleting an existing key or setting, it’s much safer to rename the key or setting. This enables you to recover the data just by changing the name back to the original. Here are the steps to follow to rename a key or setting:

1. In the Registry Editor, find the key or setting you want to work with, and then highlight it.

2. Select Edit, Rename, or press F2.

3. Edit the name and then press Enter.

Creating a New Key or Setting

Many Registry-based customizations don’t involve editing an existing setting or key. Instead, you have to create a new setting or key. Here’s how you do it:

1. In the Registry Editor, select the key in which you want to create the new subkey or setting.

2. Select Edit, New. (Alternatively, right-click an empty section of the settings pane and then click New.) A submenu appears.

3. If you’re creating a new key, select the Key command. Otherwise, select the command that corresponds to the type of setting you want: String Value, Binary Value, DWORD Value, Multi-String Value, or Expandable String Value.

4. Type a name for the new key or setting.

5. Press Enter.

Deleting a Key or Setting

Again, I strongly advise against deleting any of the Windows predefined keys or settings. However, if you’ve added your own data to the Registry, you can safely delete any of those keys or settings. Here are the steps to follow:

1. In the Registry Editor, select the key or setting that you want to delete.

2. Select Edit, Delete, or press Delete. The Registry Editor asks whether you’re sure.

3. Click Yes.

Finding Registry Entries

The Registry contains only five root keys, but they contain hundreds of subkeys. The fact that some root keys are aliases for subkeys in a different branch only adds to the confusion. If you know exactly where you’re going, the Registry Editor’s treelike hierarchy is a reasonable way to get there. If you’re not sure where a particular subkey or setting resides, however, you could spend all day poking around in the Registry’s labyrinthine nooks and crannies.

To help you get where you want to go, the Registry Editor has a Find feature that enables you to search for keys, settings, or values. Here’s how it works:

1. In the keys pane, select Computer at the top of the pane (unless you’re certain of which root key contains the value you want to find; in this case, you can highlight the appropriate root key instead).

2. Select Edit, Find or press Ctrl+F. The Registry Editor displays the Find dialog box.

3. Use the Find What text box to enter your search string. You can enter partial words or phrases to increase your chances of finding a match.

4. In the Look At group, activate the check boxes for the elements you want to search. For most searches, you want to leave all three check boxes activated.

5. If you want to find only those entries that exactly match your search text, activate the Match Whole String Only check box.

6. Click the Find Next button. The Registry Editor highlights the first match.

7. If this isn’t the item you want, select Edit, Find Next (or press F3) until you find the setting or key you want.

When the Registry Editor finds a match, it displays the appropriate key or setting. Note that if the matched value is a setting name or data value, Find doesn’t highlight the current key. This is a bit confusing, but remember that the current key always appears at the bottom of the keys pane.