Windows Registry Tutorial

Editing the Windows registry is not as hard as you might think. Learn how in this full length tutorial from PC Support Advisor.

This is a plain html version of the original article. For the original version in PDF format complete with pictures, click here.

Put simply, the Windows registry is a central repository of information
about all aspects of the computer - in particular, its hardware, operating system, applications and users. It can be accessed and updated under software control and also directly by users.

The registry first appeared in Windows 3. 1. In that system it was a single file, called REG. DAT, and was mainly used to store information about OLE objects. Most other configuration data was held in various INI files, of which WIN.INI and SYSTEM.INI were the most important.

The modern registry, as found in Windows 9x and NT, brings together all the information that was previously held in REG. DAT and the separate INI files.

The registry has several advantages over INI files. Because the information is centralised, it is easier for applications to access it. It is more hierarchical than INI files, and so better suited for storing large amounts of structured data. It is also free of the size limitations which affect INI files (although there is still a maximum total registry size limit).

Storage

Although the registry is usually considered to be a single entity, its contents are in fact stored in more than one physical file. In Windows 9x, there are two such files: SYSTEM. DAT and USER. DAT. These hold computer- specific and user- specific information respectively. In Windows NT, the registry is spread over a series of files, sometimes called hives.

SYSTEM. DAT and USER. DAT are usually held in the Windows directory. However, it is also possible to place USER. DAT in the user’s login directory on a network, thus allowing the user to log in at other workstations. In NT, the hive files are located in the SYSTEM32\ CONFIG directory, which is off the Windows directory.

Architecture

When you view the registry in the Microsoft Registry Editor its hierarchical nature becomes obvious. (To launch the editor, run REGEDIT. EXE from the Start/ Run menu. I’ll describe it in more detail later in the article.) The editor presents an Explorer- like view of the registry, with a tree in the left pane and data in the right (see Figure 1).

The registry tree is divided into six broad sections (five in NT). These sections, which all have names beginning with HKEY_, are called root keys or top- level keys (see Figure 2). Each root key contains sub- keys, which might in turn contain further sub- keys and so on. The lowest level keys along a given branch are called values.

Taking a hard disk as an analogy, keys are like directories and values are like files. Keys and values both hold data, which can either be binary values or ASCII strings.

Each item of data has an associated name. As a minimum, each key and value holds a single data item, named Default. The data and names are displayed in the right pane of the editor, along with an icon whichshows whether the data is binary or string.

Continuing with the hard disk analogy, you can identify any key or value by specifying the path along its branch, using the familiar backslash notation. For example, information about installed dial- up networking connections is held in HKEY_ CURRENT_ USER\ RemoteAccess\ Addresses. If you drill down through this path in the left pane, you will see the relevant data in the right pane. In this example, each data item corresponds to one DUN connection.

Windows Registry Tutorial page 2