Mastering the Windows Registry

on
PCWizKid has demonstrated how to hack and tweak your registry settings for optimizing your Windows configuration. Now lets take a look on how the registry is setup to better give you an understanding on what you are doing when you edit the registry next time.

First I cant stop reminding people to always do a Windows Restore point or backup your registry in case something goes wrong should you edit the registry and do something to it yourself.

To start the Registry Editor, click the Start button (in XP) or the ORB button (in Vista) and then click RUN and type regedit and press OK. Watch the video walkthrough for step by step instructions.

Hives

The registry is constructed as a database, and offers DB-like features such as automatic updates.

The Registry is split into a number of logical sections, or "hives". Hives are generally named by their Windows API definitions, which all begin "HKEY". They are abbreviated to a three- or four-letter short name starting with "HK" (e.g. HKCU and HKLM).

The HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER nodes have a similar structure to each other; applications typically look up their settings by first checking for them in "HKEY_CURRENT_USER\Software\Vendor's name\Application's name\Version\Setting name", and if the setting is not found look instead in the same location under the HKEY_LOCAL_MACHINE key. When writing settings back, the reverse approach is used — HKEY_LOCAL_MACHINE is written first, but if that cannot be written to (which is usually the case if the logged-in user is not an administrator), the setting is stored in HKEY_CURRENT_USER instead.

HKEY_CLASSES_ROOT

Abbreviated HKCR, HKEY_CLASSES_ROOT stores information about registered applications, such as file associates and Object Class IDs tying them to the applications used to handle these items. On Windows XP and Vista HKCR is a compilation of HKCU\Software\Classes and HKLM\Software\Classes. If a given value exists in both of the subkeys above, the one in HKCU\Software\Classes is used.

HKEY_CURRENT_USER

Abbreviated HKCU, HKEY_CURRENT_USER stores settings that are specific to the currently logged-in user. The HKCU key is a link to the subkey of HKEY_USERS that corresponds to the user; the same information is reflected in both locations. On Windows-NT based systems, each user's settings are stored in their own files called NTUSER.DAT and USRCLASS.DAT inside their own Documents and Settings subfolder (or their own Users subfolder in Windows Vista). Settings in this hive follow users with a roaming profile from machine to machine.

HKEY_LOCAL_MACHINE

Abbreviated HKLM, HKEY_LOCAL_MACHINE stores settings that are general to all users on the computer. On NT-based versions of Windows, HKLM contains four subkeys, SAM, SECURITY, SOFTWARE and SYSTEM, that are found within their respective files located in the %SystemRoot%\System32\Config folder. A fifth subkey, HARDWARE, is volatile and is created dynamically, and as such is not stored in a file. Information about system hardware drivers and services are located under the SYSTEM subkey, while the SOFTWARE subkey contains software and Windows settings.

HKEY_USERS

Abbreviated HKU, HKEY_USERS contains subkeys corresponding to the HKEY_CURRENT_USER keys for each user profile actively loaded on the machine, though user hives are usually only loaded for currently logged-in users.

HKEY_CURRENT_CONFIG

Abbreviated HKCC, HKEY_CURRENT_CONFIG contains information gathered at runtime; information stored in this key is not permanently stored on disk, but rather regenerated at the boot time.

Backing up the registry
The entire registry can be backed up more easily as it is just a small number of files in specific locations. Click here to learn how to backup your registry in this video tutorial.

For Windows XP
1.Click Start, click Run, type %SystemRoot%\system32\restore\rstrui.exe, and then click OK.
2.On the Welcome to System Restore page, click Create a restore point, and then click Next .
3. On the Create a Restore Point page, type a name for the restore point and then click Create
4.After the restore point has been created, click Close.

For Windows Vista
1. Click StartStart button, type systempropertiesprotection in the Start Search box, and then press ENTER.
User Access Control permission If you are prompted for an administrator password or for a confirmation, type the password, or click Allow.
2. Wait for Windows to search for available disks and most recent restore points. In the System Properties dialog box, on the System Protection tab, click Create,
3. Type a name for the restore point and then click Create.
4. After the restore point has been created successfully, click OK two times.

Other Registry Tweaks Users read and watched