Mystery Behind Windows Registry Index of Windows Registry Guide 1. What is Registry - an introduction 2. The Structure of Registry · HKEY_LOCAL_MACHINE (all of the settings for the system) · HKEY_CURRENT_CONFIG (a subset of HKEY_LM that details the current configuration) · HKEY_USERS (settings for the users of the machine) · HKEY_CURRENT_USER (subset of HKEY_USERS that details out the profile of the current user) · HKEY_CLASSES_ROOT (a subset of HKEY_LM & all of the software "classes" and extensions) · HKEY_DYNAMIC_DATA (dynamic information about PC that is built at startup) 3. Registry Corruption - Problem & Solutions · Registry Problems - Corruption of Registry · Protecting the Registry - Backup Solutions · Recovering from Registry Failure 4. Registry Tips and Secrets (Only in html version at http://srana.virtualave.net/winreg.htm ) 5. Some essential software for rescue 6. Inf files 7. Remote Registry Editing What is Registry and It's Role What is the Registry? The Registry has been made out to be a phenomenal mystery probably due to the CLSID keys alone and as such has inspired a number of books, faqs websites etc. It is very unfortunate that Microsoft has chosen to deal with the Registry and Registry editing as a "black art," leaving many people in the dark as to the real uses of all the settings in the systems. Microsoft's refusal to adequately, and publicly, supply information about the correct settings is extremely frustrating and added further mystery to registry. Certainly, more damage has and will be done because of lack of knowledge than because of too much information. The Windows Registry is a set of data files used to help Windows control hardware, software, the user's environment, and the "look and feel" of the Windows interface. The Registry is contained in two files in the Windows directory (in NT they are called "hives"): system.dat and user.dat, with backup copies system.da0 and user.da0. The Registry database is accessed with regedit.exe which is in the Windows directory. Formerly, in older version of windows (before windows 95) these functions were performed by WIN.INI, SYSTEM.INI, and other .INI files that are associated with applications. The evolution of application and operating system control has three distinct levels: · In Legacy Windows systems, SYSTEM.INI and WIN.INI held all the control functions for the operating systems and applications. Essentially, SYSTEM.INI controlled the hardware while WIN.INI controlled the desktop and applications. All changes to drivers, fonts, settings, and preferences would be stored in the .INI files. Any new application that was installed added pointers to the .INI files. Those pointers would then be referenced in the application's code. · Additional .INI files that controlled the applications were added by programmers who needed more control than was available because of the limited size of the WIN.INI and SYSTEM.INI files. For example, Microsoft included with Excel a file called EXCEL.INI, which held the options, settings, defaults, and other information critical to making Excel work correctly. The only pointer that was then required in WIN.INI was to the EXCEL.INI path and filename. · The Registry was initially developed as a reference file for data-file associations to applications. It was expanded to include all functions for 32-bit operating systems and applications. Originally, SYSTEM.INI and WIN.INI controlled all Windows and application features and access. It worked well when average users used only a few applications. As the number and complexity of applications grew, so did the number of entries to the .INI files. The downside of this approach, in a growing environment, is that everyone would make changes to the .INI files when applications were added to the system. However, no one ever removed references from their .INI files when they removed applications, so SYSTEM.INI and WIN.INI continued to get larger and larger. Each incremental size increase meant slower performance. Even upgrading applications presented its challenges. The upgrade would add entries but never take the old ones away, presumably to ensure compatibility if another program was to access the settings. Because the maximum size of an .INI file is 64KB, an obvious problem arose. To counter the problem, vendors started supplying .INI files of their own, with just pointers to the specific .INI files in WIN.INI and SYSTEM.INI. The downside of this approach was the proliferation of .INI files throughout the system and the hierarchical nature of access. If WIN.INI made a particular setting, and an application's .INI file overrode that setting, who was responsible and where should--or could--a system-wide setting that had priority be made? The Registry is a set of files that control all aspects of the operating system and how it works with outside events. Those "events" range from accessing a hardware device directly to how the interface will react to a specific user to how an application will be run and much more. It was designed to work exclusively with 32-bit applications, and file size is limited to a about 40MB. The Registry is complex by its very nature, and on purpose. What the Registry Does The Registry is the data file for all 32-bit hardware/driver combinations and 32-bit applications in both Windows NT and Windows 95. Sixteen-bit drivers do not work in NT, so all devices are controlled through the Registry, even those normally controlled by the BIOS. In Windows 95, 16-bit drivers will continue to work as real-mode devices, and they use SYSTEM.INI for control. Sixteen-bit applications will work in either NT or 95, and the applications still refer to WIN.INI and SYSTEM.INI files for information and control. Without the Registry, the operating system would not have the necessary information to run, to control attached devices, to launch and control applications, and to respond correctly to user input. Data File for OS to Hardware/Drivers The Registry is a database of all the settings and locations of 32-bit drivers in the system. When the OS needs to access hardware devices, it uses drivers, even if the device is a BIOS-supported device. Non-BIOS-supported devices that are installed must also have a driver. The drivers are independent of the OS, but the OS needs to know where to find them, the filename, the version, and other settings and information. Without Registry entries for each of the devices, they would not be usable. Data File for OS to Applications When a user attempts to launch an application, the Registry supplies application information to the OS so the application can be found, the correct data file locations are set, and other settings are available. The Registry holds information about default data and auxiliary file locations, menus, button bars, window status, and other options. It also holds installation information such as the date of installation, the user who installed the software, the version number and date, and sometimes the serial number. Depending on the actual software installed, it may contain other application-specific information. Two Types of Control Although, in general, the Registry controls all 32-bit applications and drivers, the type of control it exercises is based on users and computers, not on applications or drivers. Every Registry entry controls a user function or a computer function. User functions would include the desktop appearance and home directory, for example. Computer functions are related to installed hardware and software, items that are common to all users. Some application functions affect users, and others affect the computer and are not specifically set for an individual. Similarly, drivers may be user-specific, but, most of the time, they are for general use by the computer. All of the settings discussed in the rest of the book are separated by user and computer. Some examples of user-type functions controlled by the Registry are · Control Panel functions · Desktop appearance and icons · Network preferences · Explorer functionality and features Some of those functions are the same regardless of user; others are user-specific. Computer-related control items are based on the computer name, without respect to the logged-in user. An example of this type of control would be installing an application. The availability and access to the application is constant, regardless of the user; however, icons to launch the application are dependent on the user logging in to the network. Network protocol availability and priority is based on the computer, but current connections are based on user information. Here are some examples of computer-based control items in the Registry: · Access control · Login validation · File and print sharing · Network card settings and protocols · System performance and virtual memory settings Without the Registry, Windows 95 and Windows NT would not be possible. They are too complex to be controlled by the older .INI files, and their expansion capabilities allow almost unlimited installation and use of applications. The Registry is, however, much more complex than the .INI files, and understanding how it works, what it does, and how to work with it is critical for effective system administration. The Registry controls all 32-bit applications and their functions on the system, plus the interaction between multiple applications, such as copying and pasting. It also controls all the hardware and drivers. Though most of the settings are made during installation and through the Control Panel, understanding the Registry is fundamental to reliable and capable management of Windows NT and Windows 95 systems. The Structure of the Registry The Registry is a complex database of information that was built in a hierarchical fashion by the writers and programmers of Windows. Much like a community that is made of estates that are made of buildings that are made of walls that are made of bricks, the Registry has many components.