Older Operating Systems

Class Notes # 18 Windows 9X Registry January 6, 2004

The windows 9x registry contains the operating system database. The data stored in the registry includes the following: system configuration, user settings, device manager information, application software settings, hardware settings, etc. The database has a hierarchical tree structure. See below:

Figure 1: Registry editor Note that the right of the window are value name (e.g. ScreenSaveTime) and to the right of each value of each name is the value data assigned (e.g. 900). The registry is contained in two files which are hidden: System.dat and User.dat. The registry is organized in six major keys or branches of the registry tree and are described on table one:

1

Table one: Six major keys of the Windows 9x registry Key Description HKEY_CLASSES_ROOT Contains information about file associations and OLE data (This branch of the tree is a copy of HKEY_LOCAL_MACHINE\Software\Classes HKEY_USER Includes user preferences, including desktop configuration and network connections HKEY_CURRENT_USER If there is only one user of the system, this is a duplicate of HKEY_USERS, but for a multi-user system, this key contains information about the current user preferences. HKEY_LOCAL_MACHINE Contains information about hardware and installed software HKEY_CURRENT_CONFIG Contains the same information in HKEY_LOCAL_MACHINE\Config and has information about printers and display fonts HKEY_DYN_DATA Keeps information about Windows performance and Plug and Play information You can think of the six major keys in table one as root keys. Each root keys contains a number of subkeys as shown in figure one. A registry key can contain other keys. You can think of it as a bunch of file folders inside another file folder.

Below subkeys are value entries, where Windows stores the configuration data. Each key can contain one or more value entries. Each value entry has three parts: • Name: The unique name identifies the value entry within a particular key. The same name can be found in other registry keys. • Data type: A variety of data types in a value entry. The data types are: String, Binary, DWORD (32-bit binary values in hexadecimal format) • Data: Value data can be up to 64KB in size in Windows 98.

The Windows 98 registry root keys: HKEY_LOCAL_MACHINE and HKEY_USERS are real registry keys, the others are aliases. Aliases are just shortcuts to branches within HKEY_LOCAL_MACHINE or HKEY_USERS.

The contents of each subkey under HKEY_LOCAL_MACHINE is: • Config: Contains information about multiple hardware configurations for the computer. It contains groups of individual hardware settings from which Windows 98 can choose automatically or the user can choose when starting the computer. • Enum: contains information about each device installed on the computer. Each subkey represents a particular type of bus (BIOS, PCI, PCMCIA, USB, etc.). Under each hardware class, there are one or more subkeys, which in turn contain additional subkeys that identify a single piece of hardware. The organization of this branch depends on the device installed on the computer and how the manufacture organizes its settings.

2 • Hardware: Windows 98 doesn’t do much with this subkey, as it provides hardware for compatibility with Windows NT. • Network: Contains information about the user who is currently logged on to the computer. Each time a user logs on to the computer, Windows stores details about the current network session such as user’s logon name. • Security: Contains information about the computer’s network security provider, administrative shares, and public shares. Windows 98 keeps track of all the open network connections other users have on your computer. There is a subkey for each connection. • Software: Programs store settings that are specific to the computer in this subkey. These programs store their settings in branches that look like HKEY_LOCAL_MACHINE\Software\CompanyName\ProductName\Version. CompanyName is the name of the company, ProductName is the name of the product, and Version is the current version number of the product. Also, Windows specific settings are found in this subkey too. • System: windows maintains control sets, each of which determines exactly which device drivers and services Windows loads and how it configures them when Windows starts. For example, a control set provides the various parameters Windows needs when it starts, such as the computer’s name on the network and the current hardware profile.

The following lists describes what you’ll find in HKEY_USERS\.DEFAULT: • AppEvents: contains associations between the sounds Windows produces and events generates by Windows and other programs. Under AppEvents, you’ll find two subkeys: EventLabels, which describes each sound event, and Schemes\Apps, which assigns sound files to each event. • Control Panel: Contains settings that the user can change using the control panel. • InstallLocationsMRU: Contains the last several paths from which you’ve installed Windows extensions. That is, every time you double click the add\remove programs icon in the control panel and click the have disk button on the Windows setup tab to install an extension. • Keyboard layout: Defines the language used for the current keyboard layout. You change these values by clicking the keyboard icon in the control panel. • Network: Windows 98 stores persistent network connections in HKEY_CURRENT_USER\Network\Persistent. Each subkey represents a mapped drive letter. Under each drive letter’s subkey, you’ll find a handful of value entries – such as provider name, remote path, and user name (describes the connection). • Software: Contains software settings that are specific to each user. Windows stores each user’s desktop preferences under this subkey. In addition, each program installed on the computer installs user-specific preferences in this subkey.

The remaining root keys are aliases that refer to branches within the other two root keys mentioned above. If you change a value in one of the aliases, that value is actually

3 changed in either HKEY_LOCAL_MACNINE or HKEY_USERS. Aliases are like shortcuts in explorer.

Registry Editor The program REGEDIT.EXE allows you to edit the registry. To open regedit, choose the start button on your task bar, clicking on run, and in the dialog box type regedit and click on OK. The regedit window should appear. Within the registry editor program, you can search for keys, value names, and value data. To use the search feature choose Edit from the menu, then select Find and regedit displays a dialog box. Type the text for which you want to search and deselect the parts of the registry in which you don’t want regedit to search: keys, values, and/or data.

To change a value entry with the registry editor, double click on a value entry in the right hand pane to open the edit dialog box. Change the value, and then click OK to save your changes. Be careful what you change as this could prevent Windows from working properly.

Windows 98 automatically backs up the registry for you. Once each day, it uses the Windows registry checker (SCANREGW.EXE) to back up the registry in CAB files in C:\Windows\SYSBCKUP. The first backup is named RB000.CAB, the second is RB001.CAB, and so on. The contents of the CAB files are: SYSTEM.DAT, SYSTEM.INI, USER.DAT, and WIN.INI. Windows registry checker keeps only five backup copies of the registry, but you can increase that by changing the MaxBackupCopies entries in SCANREG.INI to a higher number.

To force Windows registry checker to make additional backups: 1. Run SCANREGW.EXE. After scanning the registry for errors, the Windows registry checker asks you if you want to make another backup copy of the registry. 2. Click yes, and Windows registry checker backs up the registry to another CAB file. 3. Click OK to close the Windows registry checker.

To restore the Windows registry, use the utility named SCANREG.EXE. Follow the steps below to restore the registry: 1. Start Windows in MS-DOS mode. 2. Type scanreg /restore to start the Microsoft registry checker. 3. Select a backup from the list provided. 4. Press enter and Microsoft registry checker restores the backup to your computer. 5. Press enter to restart your computer.

If you made a backup copy of SYSTEM.DAT and USER.DAT, then you can restore these files directly into their proper folders: 1. Copy your backup copy of SYSTEM.DAT to C:\Windows 2. Copy USER.DAT to your own personal profile folder to C:\Windows. 3. Restart your computer.

4 Emergency Repair Utility The Emergency Repair Utility (ERU) is a tool that you can use to back up your important configuration files. Microsoft preconfigures ERU to backup the most important configuration files, including: AUTOEXEC.BAT, COMMAND.COM, CONFIG.SYS, IO.SYS, MSDOS.SYS, PROTOCOL.INI, SYSTEM.DAT, SYSTEM.INI, USER.DAT, AND WIN.INI.

The ERU utility is located on the Windows 98 CD-ROM under \Tools\MISC\ERU. Copy all four files to a folder on your computer. Then add a shortcut to your start menu by dragging ERU.EXE and dropping it on the start button.

To backup your configuration files, follow these steps: 1. Start ERU. Click next after ERU pops up. In the dialog box choose between backing up to a floppy or backing up to another folder. 2. Click custom to change the files that ERU includes in the backup. 3. Click next, and ERU will start the backup process. 4. ERU displays a dialog box that explains how to restore your configuration settings in the event that something bad happens to them. Click OK to close.

Exporting registry files You can export the entire registry or just a specific branch as follows: 1. If you want to export specific branches, select the key that represents that branch otherwise skip this step if you want to export the entire registry. 2. From the main menu in the registry editor, choose registry, export registry file. 3. A dialog box will appear. If you are exporting the entire registry, select all in the export range section. Otherwise, select Selected branch. 4. In the file name text box, type the name of the file into which you want to export the registry. Registry will add the default extention (.REG) 5. Click save.

Importing a registry file To import an exported copy of the registry you need to start your computer in the DOS prompt. Type regedit /L:system /R:user regfile at the DOS prompt. System is the path and filename of SYSTEM.DAT. User is the path and filename of USER.DAT. Regfile is the path and filename of the REG file containing the backup. Restart your computer.

5