Smart Computing ® Smart Computing ®
Top Subscribe Today | Contact Us | Register Now   
middle
Home | Tech Support | Q&A Board | Article Search | Subscribe & Shop   


Register Here Email This
Print This
View My Personal Library

PC CPR
April 2003 • Vol.9 Issue 4
Page(s) 23-27 in print issue
Add To My Personal Library

Register Here
An In-Depth Look At The Windows Registry
One of the most remarkable characteristics of Windows is its customizability. You can tweak the appearance and behavior of practically everything that shows up on the Desktop, as well as the Desktop itself. Windows gathers all of your preferences and stores them in a common database along with the rest of the system settings. This database is called the Registry, and it is one of the most important components of the Windows OSes (operating systems).



About The Registry. The first versions of Windows did not have a Registry. Back then, INI (initialization) files kept track of the PC's key system settings. The computer would refer to these files during the startup routine and, from the commands and settings listed there, know how to properly load the OS and other software. The practice of using initialization files worked well as long as there weren't too many of them floating around. But as PC technology developed, the number of initialization files increased. Every software and hardware component, it seemed, deposited its own on the hard drive. To combat the problem, Microsoft decided to consolidate the settings into a common location: the Registry.

The Registry, as we know it today, made its debut with the release of Windows 95. This central repository exists as several files, including System.dat and User.dat, on the Windows drive (the hard drive or partition where Windows resides). In Windows 98 and Windows Me, the files are in the Windows folder. In Windows XP, the files are in the folders found at DOCUMENTS AND SETTINGS\<USERNAME> and WINDOWS\SYSTEM32\CONFIG. Wherever they are, these files are among the first to load when you start your computer. The files tell the computer how to configure Windows so that it looks and operates the same way each time it launches.

The bulk of the Registry's contents are set by default when you install the OS, but almost every software and hardware component you add to your system will insert its own body of settings into the Registry, as well. You also can update the Registry manually. Before you start thinking about technically sophisticated maneuvers such as this, however, you should acquaint yourself with the main parts of the Registry: the hives, keys, and values.

Hives. Also called a node or subtree, a hive is a collection of related settings and preferences. The Registry in Win98, WinMe, and WinXP consists of five or six hives, each of which is identified by an HKEY prefix and a word or two about its contents. The number of settings within a hive varies from one system to the next, but the type of settings included within a particular hive are universal.

The HKEY_CLASSES_ROOT hive, for instance, consists of a lengthy list of all registered file types and their associations, as well as information about shortcuts and OLE (object linking and embedding; technology that facilitates data sharing among different applications) objects. The HKEY_CURRENT _USER hive, on the other hand, contains the system settings and preferences that are peculiar to the person who is currently logged on to the OS.

Other hives and their contents include HKEY_LOCAL_MACHINE, which contains settings pertaining to the hardware and software installed on the PC; HKEY_USERS, which contains the settings and preferences for all registered users of the PC; and HKEY_CURRENT_CONFIG, which contains the current printer and display settings. In addition, there's HKEY_DYN_DATA (a hive not listed in the WinXP Registry), which contains plug-and-play settings and the performance status, along with any hardware and software settings stored temporarily in the computer's RAM on Win98 and WinMe systems.

Keys (and subkeys). A key is a folder of related settings within a hive. A subkey is a folder of related settings within a key. There is no discernible limit to the number or depth of subkeys contained within a key. Most of the keys and subkeys have names that identify their contents, such as Software or System Certificates. Others, such as any of the subkeys found in the HKEY_CLASSES_ROOT\CLSID key, have names that look more like a random assortment of alphanumeric characters.

Values. A value is a setting contained within a key. Every value consists of at least two parts: a name, which is a description of the value, and its data, which is the setting itself. The format of the data varies depending on the type of value involved. The Registries in Win98 and WinMe use three types of values: String (also called REG_SZ), Binary (also called REG_BINARY), and DWORD (also called REG_DWORD). WinXP adds two more value types to the mix: Multi-String (also called REG_MULTI_SZ) and Expandable String (also called REG_EXPAND_SZ). Each value type employs a unique method of defining its data.

Alphanumeric descriptions define String values (once known as Text values). The Registry presents this data within quotation marks, and it can be anything that serves as a setting, such as a product code, program location, font name, Internet address, or simply a number that corresponds to an operational mode (a "1" equals on and a "0" equals off, for instance). Multi-String and Expandable-String values are String values that support multiple and variable settings, respectively.

Binary values are defined by hexadecimal pairs, meaning a string of hexadecimal characters—the character set includes the numbers 0 through 9, plus the first six letters of the alphabet—organized into groups of two. For example, a Binary value might look like this: 01 00 ac 92.

A maximum of four bytes, presented in both hexadecimal and decimal characters, define DWORD values. The hexadecimal characters form the first part of the setting and always assume the format of 0x00000000, where the 0x remains the same for all DWORD values and the remaining eight characters represent the hexadecimal data for a particular value. The decimal characters immediately succeed the hexadecimal characters and always appear in parentheses. Each character set is referred to as a word, and the combination of hexadecimal and decimal words results in a doubleword or DWORD. A typical DWORD value might look like this: 0x00000112 (274).



Proceed With Caution. Microsoft designed its latest versions of Windows with a host of user-friendly tools for tweaking system settings and user preferences. Users can access many of these tools through the Control Panel, which provides controls for changing the appearance of the Desktop, customizing network settings, adjusting folder preferences, and more. But the Registry is not included in this category of user-friendly tools.



The most important hives are HKEY_USERS and HKEY_LOCAL_MACHINE. All of the other hives duplicate information taken from these two. The HKEY_CLASSES_ROOT hive (in the background), for instance, is identical to the HKEY_LOCAL_MACHINE\ SOFTWARE\CLASSES subkey (foreground).
As a matter of fact, we advise you to stay away from the Registry. Why? Because the functionality of your PC depends on the integrity of its settings. Changing even one of these settings without a firm understanding of how the change will affect the rest of your system is like removing a wooden block from a Jenga puzzle without analyzing how it supports the rest of the tower. Make just one wrong move and the whole thing—computer or puzzle—will come crashing down around you.

Nevertheless, advanced computer users may find it helpful to dig inside the Registry from time to time. After all, you can edit the Registry to fix unusual problems, such as the OS' failure to recognize plug-and-play devices or the computer's inability to support long file names. You also may edit the Registry to enable sophisticated customization options, such as changing the appearance of the logon screen or adding permanent shortcuts to the Start menu. Because the Registry contains all of the system settings and preferences, the list of ways in which you can use it to alter your PC are virtually endless.

The key to using the Registry effectively is exercising extreme caution. That means backing up the Registry before attempting to make any changes to it (see the "Back It Up" sidebar for more information about backing up the Registry). It also means honestly evaluating whether you have the competence to make changes to your system at this level. As a rule of thumb, you should consider yourself qualified to make advanced system changes only when you feel confident about your ability to fix any mistakes you might commit.

One of the best ways you can exercise caution is by learning to use the Registry tools provided with your version of Windows. Microsoft supplies its OSes with a pair of utilities—the Windows Registry Checker (also called ScanReg) and the Registry Editor (also called Regedit)—that can help you interact with the Registry. You should acquaint yourself with both of these tools so that you know how to use them if circumstances warrant it.



Use ScanReg. The Registry Checker is a DOS-based utility that automates the process of backing up, restoring, cleaning, and verifying the integrity of the Registry in Win98 and WinMe. You simply tell the Registry Checker what you want it to do, and it does it. In some cases, you don't even have to do that much.



The first step in creating a new value is naming it. If you miss the opportunity to name it immediately, you can right-click the default name and select Rename from the pop-up menu.
The Registry Checker takes its name from the first task it performs each time you boot the computer: It automatically checks the Registry for errors. At the same time, it backs up the existing Registry files and stores them collectively as a single CAB (cabinet) file in the Sysbckup folder (within the Windows folder), along with backups from the previous four days. If the Registry Checker finds an error during the boot routine, it quickly substitutes the most recent backup from the Sysbckup folder.

Each backup Registry Checker created remains in the Sysbckup folder for five days. After that, the Registry Checker replaces it with a more recent backup. It's important that you remember this fact. Why? Because Windows retains its ScanReg backups to help you repair Registry-related problems, which may reveal themselves through sudden bouts of bizarre PC behavior or error messages that mention the Registry. If you wait more than five days, you will lose access to the backups that can resolve the issue (backups made since the problem started may be corrupt). For this reason, it is important to address Registry-related problems as soon as you detect them.

In addition to its automated features, the Registry Checker has on-demand functionality that lets you repair the Registry, create additional backups, and restore any of the recent backups. To access these functions, open the Start menu and select Run. What you type in the Open field of the resulting dialog box depends on what you want to do, and we'll discuss each of your options throughout the rest of this section.

To fix the Registry. If you suspect problems with the Registry and are uncertain whether Registry Checker fixed those problems the last time you started your PC, you can launch the utility automatically with specific instructions to find and fix any Registry-related problems you have. Just type scanregw /fix in the Run dialog box and click the OK button. Windows will prompt you to close all open applications so your system can restart as part of the process of rebuilding the Registry. Follow these instructions and then click the Yes button to continue. Windows will restart with a new error-free Registry.

If you cannot access Windows or receive a message indicating you cannot repair the Registry from within Windows, you will have to boot the computer to a command prompt. You can do so in Win98 by holding down the CTRL key (or pressing it repeatedly) while booting the computer and then selecting Command Prompt Only from the Startup Menu. In WinMe, you can boot to a command prompt by booting with a WinMe boot disk (see "Help Is Just A Diskette Away" on page 16 for more information about boot disks) and selecting Start Computer With CD-ROM Support when the computer starts.

From there, you can check the Registry for errors by typing scanreg /fix and pressing ENTER. The DOS version of the Registry Checker will open on-screen and begin checking for errors. When it finishes, the Registry Repair Results message will appear on-screen. Hopefully, it will indicate that Windows successfully fixed the Registry. Press ENTER to exit the utility and return to a command prompt.

To back up the Registry.
If you want to create another backup of the Registry in the Sysbckup folder (within the Windows folder), you should type scanregw in the Run dialog box and click OK. After a few seconds, you will see a Registry Scan Results message stating that the utility found no errors. The message also states that the Registry was already backed up once today (remember, the Registry Checker automatically creates one backup when you turn on your computer on) and will ask if you want to back up the Registry again. Click the Yes button to create the day's second Registry backup. After a few seconds, another message will appear on-screen. This message states that the backup is complete. The new backup will appear in the Sysbckup folder in the form of a CAB file.

An alternative option for launching the same procedure is to open the Start menu and burrow through the Programs, Accessories, and System Tools folder until you see the System Information option. Click this option once. In the resulting dialog box, open the Tools menu and select the Registry Checker. The utility will scan the Registry for errors and then ask if you want to create another backup. Click the Yes button and then wait for it to finish.



Editing the Registry is easier than you think. For example, you can change the Recycle Bin's name by opening the HKEY_CLASSES_ROOT\CLSID\ {645FF040-5081-101B- 9F08-00AA002F954E} key, double-clicking the Default value, and changing the Value Data entry to whatever you want the new name to be.
You also can back up the Registry from within DOS if you can't access Windows. Boot to a command prompt and type scanreg at the prompt. When the Registry Checker opens, select the Start option and press ENTER. The utility will quickly check the Registry for errors and present a message indicating that it didn't find any errors. At that point, you have several options, including the option to back up the Registry. Highlight the Create Backups option and press ENTER. Wait a few seconds while the utility completes the backup process.

To restore a backup. Backups are meant to be restored, and the Registry Checker makes it easy to restore the backups it creates each time you boot the computer. Open the Run dialog box, type scanregw /restore in the Open field, and click the OK button. An on-screen message will prompt you to close all of your open applications so that Windows can reboot as it restores your Registry. Click the Yes button to continue. When the Restore Registry dialog box appears, select the backup that you want to restore (we suggest using the most recent backup) and then click the OK button. The computer will restart with the new Registry in place.

You can restore a backup from DOS if you have trouble accessing Windows or if Windows won't let you restore the Registry. At the prompt, type scanreg /autorun to load the most recent backup of the Registry. If you want to load an earlier backup of the Registry, you should type scanreg /restore. The DOS version of Registry Checker will open and a list of recent backups will appear on-screen. Highlight the backup you want to restore, select the Restore command, and press ENTER. After a few seconds, you will receive a message indicating that you've restored a good Registry and need to restart the computer. Remove the boot disk from the floppy diskette drive and press the ENTER key to reboot.



Use Regedit. As its name implies, the Registry Editor is a tool for editing the Registry in Win98, WinMe, and WinXP. It presents the contents of the Registry in a hierarchical fashion, with the hives represented as folders that contain subfolders of keys and values. You can use the Registry Editor to create and import new keys and values. You also can use it to rename, modify, delete, and export those that already exist. You can even use it to print the Registry (though it's unlikely you would ever need to do that). The one thing noticeably missing from the Registry Editor is a Save command. It doesn't have one because it doesn't need one. The utility automatically saves your changes as you make them.

Navigating the Registry Editor is as easy as digging through a hierarchical folder scheme. The left pane shows the various hives, and by double-clicking a hive, you can review its keys. By double-clicking a key, you can review its subkeys and values. To locate a particular key or value, you should use the Find command to simplify the process. Access this command by opening the Edit menu and selecting the Find option. In the resulting dialog box, type the search criteria in the Find What field and click the Find Next button. The Find dialog box will disappear and the first setting to match the criteria will appear highlighted in the Registry Editor window. Press the F3 key to find other settings that match the criteria.

To delete a key or value. Deleting a key or value from the Registry is dangerous, but there are times when you can do so with impunity. For example, you can safely remove keys and values that correspond to uninstalled software and hardware. As long as you know for sure that the unwanted settings have no purpose for your PC, you can delete them.

The easiest way to delete a key or value is to highlight it and press the DELETE key. Alternately, you can right-click the unwanted key or value and select Delete from the pop-up menu. Either way, a verification message will ask whether you want to delete the selected setting. Click Yes to proceed with the removal. Keep in mind that the deletion of a particular key will result in the deletion of all values and subkeys contained within it.

To edit a key or value. Changing an existing Registry key or value is just as dangerous as deleting it. The modification of something as minor as a backslash or a hexadecimal pair, could cause your entire system to malfunction. We advise against editing the Registry unless a reputable source has provided specific instructions about how and why you should do it.

The Registry Editor gives you two basic editing options: renaming a key and modifying a value. To rename a key, right-click it and select Rename from the pop-up menu. Alternately, you can highlight the key and click the Rename command in the Edit menu. Either way, type the new name immediately after executing the command. Press the ENTER key when you finish.



The Registry Checker simplifies the process of restoring a Registry backup. Simply select the one you want to restore from the list, click the OK button, and wait for your PC to restart.
To modify a value, you should right-click it and select Modify from the pop-up menu. Or you can highlight the value and select the Modify command from the Edit menu. Either method will open the Edit dialog box. Locate its Value Data field and edit the value contained therein. If you modify a DWORD value, you also must indicate whether the new value is a hexadecimal or decimal value. Indicate your selection by selecting the appropriate choice under the Base heading in the Edit DWORD Value dialog box.

After modifying the value, click OK to save your changes.

To add a value or key. In addition to modifying keys and values, you also have the option of adding new ones. The easiest way to do that is by inserting the new key or value into the appropriate section of the Registry. You can start by right-clicking the hive or key where you want to locate the new key or value and then highlighting New on the pop-up menu. Or you can highlight the hive or key, open the Edit menu, and select New. In both cases, a list of options will appear next to the New command. The options include Key, String Value, Binary Value, and DWORD Value (in WinXP, you'll see options for Multi-String Value and Expandable Key Value, too). Click the one you want to create.

If you opt to add a key, a new folder called New Key #1 will appear in the Registry Editor (the number in the folder name varies depending on how many keys you create). To change the name, type a name for the key and press ENTER.

If you opt to add a new value, a value labeled New Value #1 (the number may vary depending on how many values you create) will appear under the Name heading in the Registry Editor. Type a name for the value and press ENTER. To set the data for the value, right-click the new value and select Modify from the pop-up menu. In the resulting dialog box, type the new value in the Value Data field. If you create a new DWORD value, you also must specify whether it is a hexadecimal or decimal value.

An alternative method for adding new values and keys to the Registry is to create a text file and save it with the .REG file extension. You then can import the file into the Registry. Experienced programmers are the users who primarily take advantage of this method, especially if they want to add numerous keys and values to the Registry at once. You shouldn't use this method unless a support technician or another reputable source specifically instructs you to do so.

To import and export keys. Sometimes you may want to back up only a few keys of the Registry before editing it. That's a prudent decision, especially when your intended changes will affect only a tiny part of the entire Registry. Simply export the selected keys to a safe location, and if something does goes astray during the editing process, you can just import those keys back into the Registry.

Exporting a key to the location of your choice is easy. After highlighting the key, open the Registry menu and select Export Registry File (in Win98 and WinMe) or Export (in WinXP). When the Export Registry File dialog box appears on-screen, locate the Export Range heading and make sure the Selected Branch option appears selected. You also should verify that the key described in the Selected Branch field is the one you want to export. Assuming it is, type a name for the exported file in the File Name field. Finally, open the Save In drop-down menu and select a location for the file. Click the Save button to complete the exportation.

To import the key later, open the Registry menu and select the Import Registry File (in Win98 and WinMe) or Import (in WinXP) option. When the Import Registry File dialog box appears on-screen, use the Look In and File Name fields to locate and identify the file you want to import. Click the Open button to restore the key to the Registry. A message indicating a successful import will appear on-screen. Click OK to close the message.



Now Leave It Alone. The process of learning about the Registry is like that of learning about venomous vipers. Once your curiosity is satisfied about how they look and where they live, you can take whatever steps are necessary to avoid interacting with them. Then again, if you must venture into your Registry because you can't fix a misbehaving system or application in any other way, make sure you take extra precautions before doing so. Heeding such prudent advice could save you from a painful bite.

by Jeff Dodd


Back It Up


Before you even worry about learning how to modify various Registry settings, it's more important that you know how to back up your Registry first. Indeed, you should never attempt the latter unless you have already accomplished the former. Fortunately, each version of Windows offers several options for backing up this important database of system settings and user preferences.

In Windows 98. The Registry Checker in Win98 automatically backs up your Registry each time you boot the computer. It then retains those backups for five days. If you need a permanent backup for your system archives, you can use the Registry Editor's Export function. If you choose the All option when selecting the Export Range, you can export the entire Registry to the backup media of your choice.

In Windows Me. WinMe supports both of the backup options Win98 offers, plus it includes the System Restore utility. This utility takes a snapshot of your system settings, including the Registry, at least once per day and then saves these snapshots indefinitely. You can revert to a previous Registry simply by restoring any of the saved restore points.

In Windows XP. WinXP features System Restore and its daily backups. Microsoft's latest OS (operating system) also sports its own backup utility, which simplifies the process of archiving the Registry. You can access the utility by opening the Start menu and burrowing through the All Programs, Accessories, and System Tools folder (if you don't see a shortcut to Backup in this last folder, it means the utility is not installed on your PC; see "Microsoft Backup" on page 116 for details). After you launch the utility, open its Advanced Mode and choose to back up the system state data. This option will save all system settings, including the Registry.


Third-Party Registry Editor


Microsoft may have invented the Registry, but plenty of other companies have developed utilities to help you manage it. These utilities do everything the Registry Editor included with Windows does, as well as provide varying degrees of extended functionality, such as error checking and remote editing.

Do you need a third-party Registry editor? Probably not. These editors are most useful to network administrators, programmers, and high-end hobbyists who like to keep close tabs on their systems. If your computing needs demand more than the Registry Editor has to offer, however, here are some options of third-party Registry editors for you to check out.

Advanced Registry Tracer
$40
http://www.elcomsoft.com
ART, as ElcomSoft calls its utility, helps you compare changes in the Registry over a length of time. This functionality comes in handy when tracing problems to the installation or removal of a particular program or peripheral.

Reg Organizer

$25
http://www.chemtable.com
More than just an editor, the Reg Organizer from ChemTable Software provides a friendly interface and plethora of tools for managing the Registry, as well as most other system configuration files.

Registry Crawler
$29.95
http://www.4dev.com
4Developers designed Registry Crawler for power users who want fast access to important Registry keys. To that end, the utility lets you bookmark keys and values so that you can access them from the System Tray.

Resplendent Registrar ($44.95; http://www.resplendence.com) If you need to manage Registries across a network, you should pick up a copy of Resplendent Registrar from Resplendence Software Projects. Among other things, the Resplendent Registrar lets you monitor who makes changes to the Registry and secure the Registry against unauthorized access.






Want more information about a topic you found of interest while reading this article? Type a word or phrase that identifies the topic and click "Search" to find relevant articles from within our editorial database.

Enter A Subject (key words or a phrase):
ALL Words (‘digital’ AND ‘photography’)
ANY Words (‘digital’ OR ‘photography’)
Exact Match ('digital photography'- all words MUST appear together)





Home     Copyright & Legal Information     Privacy Policy     Site Map     Contact Us

Copyright © by Sandhills Publishing Company 2010. All rights reserved.