Frequently Asked Questions

Q: Windows 2000 registry explanation

A:

A Brief Introduction

The Registry is the central database that Windows and Windows applications use to track all software and hardware settings on a given machine, including configuration details. It has been around in one form or another since Windows 3.0, but Windows 2000 uses the Registry more heavily than any previous version of Windows.

Why Do We Care?

Why do any of us need to know about the Registry? For many users, the appropriate extent of Registry knowledge is simply how to back it up and restore it. Any number of mishaps can damage the Registry, and if you have a fairly recent Registry backup and know how to restore it, you can sometimes save yourself from having to reinstall Windows entirely.

For other users, especially those who do their own troubleshooting, it may be necessary occasionally to modify the Registry’s contents. Windows and Windows applications store tens of thousands of settings in the Registry. Not all of them can be modified through a control panel, Microsoft Management Console, or object property sheet. When one of those settings goes awry, it may be that the only way to correct it is to edit the Registry directly.

A Tale of Two Registry Editors

Regardless of which group you fall into (and some of us may fall into more than one), you should know a few basics about the Registry. First of all, Windows 2000 comes with two Registry editors: REGEDIT and REGEDT32. REGEDIT descends from the Windows 95/98 product line, and REGEDT32 descends from the Windows NT line. Microsoft hasn’t unified these tools, so you need to know when to use one rather than the other. The following table should help.

REGEDIT REGEDIT32
Uses newer Windows 98/95 user interfaceUses older Windows 3.1 user interface
Can search the entire Registry: key names, value names, value contentsCan only search key names
Can search and edit remote RegistriesCan search and edit remote Registries
Shows whole Registry in one windowShows separate windows for each root key
Very similar to Windows 98/95 Registry editorVery similar to Windows NT 4.0/3.51 Registry editor
Can export and import text filesCan export, but not import, text files
Cannot export or import binary filesCan export and import binary files
Offers no "read-only" modeDoes offer "read-only" mode, but not as default
Offers no security featuresSupports full Windows 2000 access control and auditing
Lives in C:\WINNT folderLives in C:\WINNT\SYSTEM32 folder
Fully supports Windows 98/95 Registry data types only (string, binary, DWORD)Supports full range of Windows 2000 Registry data types (string, binary, DWORD, multi-string, expandable-string, resource descriptor)

For those of you familiar with earlier versions of these tools, the Windows 2000 versions haven’t changed a great deal. REGEDIT now has a "bookmarking" feature that returns you to the last viewed key when you run the program, and REGEDT32 has changed the Security menu so it only has one entry, "Permissions."

Neither tool has an "undo" feature, and both immediately save any changes you make. So use these tools with great care!

Registry Structure, Part 1: Branches

The Windows 2000 Registry has five branches which are the main organizational structures at the top level of the Registry’s inverted-tree layout. (Some Microsoft documents also call a branch a "root key.") These branches all start with the notation "HKEY," where the "H" stands for handle, and so these branch names act as handles to particular keys (specific Registry entries) that you may need to view, change, or delete.

Some of the Registry branches are really nothing more than aliases, or pointers, to specific keys located elsewhere. These particular keys are chosen because you use them frequently, so using a shorthand notation to refer to them is handy.

For example, HKEY_CURRENT_USER (abbreviated HKCU) contains all the user-specific Registry settings for the currently logged-on user. Saying (and writing) HKCU is easier than figuring out the current user’s Security ID and specifying a key such as HKU\S-1-5-21-448539723-842925246-2089417427-500. Also, Windows 95/98 programs don’t know about Security IDs and therefore need to see HKCU in order to run under Windows 2000.

You often spend time in HKEY_CLASSES_ROOT (abbreviated HKCR) because it contains information about how different file types behave. Saying (and writing) HKCR is easier than HKLM\SOFTWARE\Classes. The two locations contain pretty much the same information, though. Check it out yourself. If you’re familiar with either Registry Editor, look at HKCR\avifile and compare it to HKLM\SOFTWARE\Classes\avifile.

HKCR and HKLM\SOFTWARE\Classes contain pretty much the same information because HKCR now contains a merged view of information in HKLM\SOFTWARE\Classes and HKCU\Software\Classes. Therefore, HKCR is actually an alias for the combination of those two keys, when in prior versions of Windows it was an alias for the HKLM key only.

HKCC, HKCR, and HKCU just point to other places in HKLM and HKU. The "core" branches HKLM and HKU actually contain the entire Registry contents. (For the curious, HKLM corresponds to the physical files SAM, SECURITY, SOFTWARE, and SYSTEM, while HKU corresponds to the physical files NTUSER.DAT, USRCLASS.DAT, and DEFAULT. The machine-specific files live in C:\WINNT\SYSTEM32\CONFIG, but the user-specific files live under C:\DOCUMENTS AND SETTINGS in the user profile folders.)

Registry Structure, Part 2: Keys and Values

Each branch contains a number of keys. A Registry key is simply a location for storing data. A key is a container and can contain a value, another key, or any number of both. You can think of a key as similar to a directory or folder in Windows Explorer.

Most of the useful information in the Registry resides in values. A value is like a leaf on a tree branch: You can’t have anything else hanging off a leaf. Or, if you prefer to think of keys as directories in Windows Explorer, then think of values as individual files.

The Windows 2000 Registry uses three main types of values: string, binary, and DWORD. The string type has a couple of variations, expandable string and multi-string. A few other value types exist, although you’ll rarely see them. In the Registry editors, value types appear using "Hungarian" notation beginning with the prefix REG, as in REG_BINARY, REG_DWORD, and so on.

Microsoft says that the maximum size of a single value is about a megabyte, but in practice most values are just a few bytes in length.

TIP #1: Making a Quickie Registry Backup

Backing up the Registry can be achieved a variety of ways. The simplest is to use Windows 2000’s Emergency Recovery Diskette (ERD) program, which is an option of the supplied backup program (NTBACKUP.EXE). The ERD lets you back up your Registry as a byproduct of creating the ERD.

The Windows 2000 Registry is far too large to fit onto a single diskette. When you make the ERD, you get the opportunity to make a backup copy of the Registry files to a special folder on your hard drive. (Assuming you’ve installed Windows 2000 into the usual folder C:\WINNT, this special Registry backup folder is C:\WINNT\REPAIR\REGBACK.) Windows 2000 can then use that backup copy to restore the Registry.

The ERD method is not be a perfect Registry backup solution. What if Windows 2000 can’t get to your hard drive, for example? Or what if your hard drive fails? The ERD wizard doesn’t provide a dialog box where you can select an alternative destination location. So, you may want to explore other backup options when deciding on a permanent Registry backup strategy. For now, though, the ERD method is a whole lot better than nothing, and it has the virtue of being mighty easy.

Activate the ERD wizard by choosing Start -> Programs -> Accessories -> System Tools -> Backup and then select the Emergency Repair Disk button.

You’ll see a prompt to put a diskette into your A drive, and a check box labeled "Also back up the registry to the repair directory. This backup can be used to help recover your system if the registry is damaged." Click the check box and then click the OK button.

When the backup operation is complete, click OK again to close the Backup program. You can now use Windows Explorer to check out the date stamps on the files in C:\WINNT\REPAIR\REGBACK. At this point, you have at least some measure of protection against Registry damage.

TIP #2: Restoring the Registry

OK, so you have a good Registry backup. What if you need to restore the Registry, say for example after a software or hardware installation that goes horribly wrong?

The good news is that if you’ve installed a hardware device whose driver is now not permitting Windows 2000 to boot normally, you can very conveniently restore that part of the Registry that deals with the current "control set," that is, the list of device drivers and their associated settings. At boot time, press F8 at the text-mode "Starting Windows" screen, then choose "Last Known Good Configuration." This restores the Registry’s current control set data to the same state as the last time Windows 2000 successfully booted and allowed a user to log on.

The bad news is that if the Last Known Good configuration trick doesn’t work, you may need to restore the Registry manually. You have to boot to the Recovery Console in order to accomplish this task. This requires starting the system with the four setup diskettes (or booting the Windows 2000 Professional CD, if you have a PC that supports booting from CD).

At the "Welcome to Setup" screen, press R for repair, then press C to enter the Recovery Console. You must then press a number to indicate which Windows 2000 installation you want to modify (it’s usually "1") and then press Enter. Log on with your administrator password, and then you can copy your backed-up Registry files from C:\WINNT\REPAIR\REGBACK to C:\WINNT\SYSTEM32\CONFIG. You’ll lose any configuration information since you made your last Registry backup, but that’s probably better than having to reinstall Windows 2000 from scratch.

Information in this document was provided by the following:
Glenn Weadock, MCSE, author of "Windows 2000 Registry For Dummies" and "Windows 98 Registry For Dummies" (IDG Books Worldwide) and president of Independent Software, Inc.