:Windows Registry Basics

From The University of Akron Support Wiki
Revision as of 17:24, 17 July 2006 by WikiSysop (Talk | contribs)

Jump to: navigation, search

Windows Registry Basics

warning: Using the Windows Registry Editor incorrectly can cause serious problems requiring the reinstalltion of your operating system and possible loss of data.
The registry is a hierarchial database, like Windows Explorer, where folders are nested withing folders. Depending on your Windows version, the Registry comprises four to six subtrees of keys called hives.

Accessing the registry

There are two registry-editing programs. Regedit (16-bit) and Regedit32 (32-bit). Windows 95/98/Me use the 16-bit version, while Windows NT and 2000 use both versions. The 16-bit version offers faster searches, while the 32-bit version allows you to prevent automatic saving. In Windows XP the funcationality of both verisons has been combined into Regedit, and Regedit32 is no longer provided. To start either program, click Start | Run and enter the command regedit or regedit32, dpeending on which one you want to use.

Backing up the registry

Backing up the registry is tricky since many of its parts are constantly in use by Windows. Trying to back up the registry while Windows is accessing the registry can cause a sharing violation. To solve this issue, Windows NT and Windows 2000 Resrouce Kits offer two programs: RegBack.exe to back up the registry and RegRest.exe to restore the registry. A Windows Emergency Repair Disk can also be used as a registry backup, if it was updated recently using the RDISK utility.

The hives

To get a better understanding of the inner workings of the registry, let's take a stroll through the hives (or keys). See the figure to the right.


This key contains file-extension associations. For instance, Windows can regocnize a .doc file as a Microsoft Word document because of the settings in this key. Use the Folder Options command from the Tolls menu in Windows Explorer isntead of adding new extensions to this key.


This key holds profile information for the user that is currently logged on. Each time a user logs on, the user's profile is copied from the HKEY_USERS key to the HKEY_CURRENT_USER key. This key cannot be edited.


This key holds hardware and software information within its five subkeys, which are the following:

  • Hardware
  • Security accounts manager (SAM)
  • Software
  • System

The first three (Hardware, SAM, and Security) cannot be modified.
The hardware subkey stores settings for device drivers, IRQ hooks, and so forth. It is re-created each time your computer boots. The SAM subkeys stores information on security settings, user accounts, and group memberships. The Security subkey holds information on local security prolicies such as password policy, user rights, account lockout, and so forth. The Software subkey, which applies to all local users, stores data about installed softare. The System subkey stores information needed to boot Windows.


This key contains the default profile as well as profiles for all users have logged on to the computer. This key can be edited, but exercise care when doing so.


This key holds hardware information that is currently in use and allows for backwards compatibility with older applications and device drivers. The information sotred here cannot be edited.