what is windows registry

In computing, the Windows registry is a database which stores

settings and options for the operating system for Microsoft Windows 32-bit
versions, 64-bit versions and Windows Mobile. It contains information and
settings for all the hardware, operating system software (and most of
non-operating system software too), users, and preferences of the PC and so on.
Whenever a user makes changes to "Control Panel" settings, or file associations,
system policies, or installed software, the changes are reflected and stored in
the registry.The Windows Registry was introduced to tidy up the profusion of per-program INI
files that had previously been used to store configuration settings for Windows
programs. These files tended to be scattered all over the system, which made
them difficult to track.Registry Structure.The Registry is split into a number of logical sections.
These
are generally known by the names of the definitions used to access them in the
Windows API, which all begin "HKEY" (an abbreviation for "Handle to Key");
often, they are abbreviated to a three- or four-letter short name starting with
"HK".Each of these keys is divided into subkeys, which may contain further subkeys,
and so on. Any key may contain entries with various types of values. The values
of these entries can be:* String Value* Binary Value (0 or 1)* DWORD Value, a 32 bit unsigned
integer (numbers between 0 and 4,294,967,295
[232 1])* Multi-String Value* Expandable String ValueRegistry keys are specified with a syntax
similar to Windows' path names, using
backslashes
to
indicate
levels
of
hierarchy.
E.g.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
refers to the subkey "Windows" of the subkey "Microsoft" of the subkey
"Software" of the HKEY_LOCAL_MACHINE key. Values are not referenced via this
syntax. Value names can contain backslashes (any character but the first) which would
lead to ambiguities were they referred to this way. The win32 functions that
query and manipulate registry values take value names separately from the key
path and/or handle that identifies the parent key.The HKEY_LOCAL_MACHINE and
HKEY_CURRENT_USER nodes have a similar structure to
each other; applications typically look up their settings by first checking for
them in "HKEY_CURRENT_USER\Software\Vendor's name\Application's
name\Version\Setting name", and if the setting is not found looking instead in
the same location under the HKEY_LOCAL_MACHINE key. When writing settings back,
the reverse approach is used HKEY_LOCAL_MACHINE is written first, but if that
cannot be written to (which is usually the case if the logged in user is not an
administrator), the setting is stored in HKEY_CURRENT_USER
instead.HKEY_CLASSES_ROOTAbbreviated HKCR, HKEY_CLASSES_ROOT stores
information about registered
applications, including associations from file extensions and OLE object class
ids to the applications used to handle these items. On Windows 2000 and above, HKCR is a
compilation of HKCU\Software\Classes and HKLM\Software\Classes. If a

given value exists in both of the subkeys above, the one in HKCU\Software\Classes
is used.HKEY_CURRENT_USERAbbreviated HKCU, HKEY_CURRENT_USER stores settings
that are specific to the
currently logged in user. HKCU mirrors the current user's subkey of
HKEY_USERS.HKEY_LOCAL_MACHINEAbbreviated HKLM, HKEY_LOCAL_MACHINE stores
settings that are general to all
users on the computer. This key is found within the file %SystemRoot%\System32\Config\system
on NT-based versions of Windows. Information about system hardware is located
under the SYSTEM key.HKEY_USERSAbbreviated HKU, HKEY_USERS contains subkeys
corresponding to the
HKEY_CURRENT_USER keys for each user registered on the
machine.HKEY_CURRENT_CONFIGAbbreviated HKCC, HKEY_CURRENT_CONFIG contains
information gathered at runtime;
information stored in this key is not permanently stored on disk, but rather
regenerated at boot time.Windows Registry Locations.The Registry is stored in several files;
depending upon the version of Windows,
there will be different files and different locations for these files, but they
are all on the local machine, except for the NTuser or user file which may be
placed on another computer to allow for roaming profiles and the policy file,
that is usually storage on a server in the local network.Windows NT, 2000, XP, and Server
2003.The following Windows Registry files are stored in %SystemRoot%\System32\Config\:* Sam
- HKEY_LOCAL_MACHINE\SAM* Security - HKEY_LOCAL_MACHINE\SECURITY* Software HKEY_LOCAL_MACHINE\SOFTWARE* System - HKEY_LOCAL_MACHINE\SYSTEM* Default HKEY_USERS\.DEFAULT* UserdiffThe following file is stored in each user's profile folder:*
NTUSER.DATWindows 95, 98, and Me.Windows Registry files are named User.dat and
System.dat and are stored in the
C:\WINDOWS\ directory. In Windows ME Classes.dat was added.Windows 3.11.The Registry file
is called Reg.dat and is stored in the C:\WINDOWS\ directory.Policy files.Since Windows 95,
administrators can use a special file to be merged into the
Registry, a policy file. The policy file allows administrators to prevent
non-administrator users from changing registry settings like, for instance, the
security level of IE and the desktop background wallpaper. The policy file is
primarily used in a business with a large number of computers where the business
needs to be protected from the users and the users need to be protected from
themselves.The default extension for the policy file is .pol. The policy file filters the
settings it enforces by user and by group (a "group" is a defined set of users). To do that the
policy file merges
into the Registry, preventing users from circumventing it by simply changing
back the settings. The policy file is usually distributed through a LAN, but can
be placed on the local computer.Policy file editor.The policy file is created by a free tool by
Microsoft that goes by the filename
poledit.exe for Windows 95/Windows 98 and with a computer management module for NT-based
systems. The
module will not work in Windows XP Home Edition, but it does work in the

Professional edition. The editor requires administrative permissions to be run

on systems that uses permissions. The editor can also directly change the
current registry settings of the local computer and if the remote Registry
service is installed and started on another computer it can also change the
Registry on that computer. The policy editor loads the settings it can change
from .adm files, of which one is included, that contains the settings the
Windows shell provides. The .adm file is plain text and supports easy
localisation by allowing all the strings to be stored in one place. The policy
editor has been renamed to Group Policies in newer versions of Windows.Advantages of the
Windows Registry Concept.Changing from having one or more INI files per program to one
centralised
registry has its good points:* Windows Registry keeps machine configuration separate from user
configuration.
When a user logs into a Windows NT/2000/XP/Server 2003 computer, his or her
user-based Registry settings are loaded from a different path than the system
wide settings. This allows programs to more easily keep per-user configuration,
as they can just work with the "current user" key, whereas in the past they
tended to just keep system-wide per-program settings.* Group Policy allows administrators on a
Windows-based computer network to
centrally manage program and policy settings. Part of this involves being able
to set what an entry in the Registry will be for all the computers on the network, and affect nearly
any installed program something
almost impossible with per-program configuration files each with custom layouts,
stored in dispersed locations.* Because the Windows Registry is accessed through a special API
it is available to
scripts and remote management using WMI. Each script does not have to be customised for
every application's
unique configuration file layouts and restrictions.* The registry can be accessed as one item over
a network connection for remote
management/support, including from scripts, using the standard API.* It can be backed up more
easily, in that it is just a small number of files in
specific locations.* Portions of settings like any subset of an application configuration can be
saved in a text-based .REG file, which can be edited with any text editor later.
.REG files can easily be merged back into the registry both by unattended batch
file or by the user using just a double-click on the file without harming any setting that is not
explicitely stated in the .REG file. This is very useful for
administrators and support personel which want to preset or preconfigure only a
few options like approving the EULA of Acrobat Reader.* Since accessing the registry does not
require parsing it can be read from and
written to more quickly than a text file can be.* Windows Registry changes and readings can be
tracked via a tool like SysInternals
RegMon on value level. This is a big advantage for generating scripts in
networks as well as debugging problems.* Registry keys are independent of the Windows
language, the Windows

installation drive and path and even the Windows versions as such. So support personel can
easily give out one set of instructions, without having to handle
these things, unlike for example files in the user profile which can be on
different paths on each installation.Criticisms of the Registry concept.However, the centralized
Registry introduces some problems as well:* The HKEY_LOCAL_MACHINE part is a single point
of failure damage to the
Registry can render a Windows system unbootable, in extreme cases to a point
that cannot be fixed, and requires a full reinstall of Windows. There is an
automated backup mechanism, and these secondary/backup files which will be
loaded, if the primary files fail to load.* The registry does not document itself in the same way a
configuration file
can.* Restoring parts of Windows Registry is hard because the user cannot easily extract
data from backed up registry files. Offline reading and manipulation of the
registry (for example from a parallel installed Windows or a boot cd) is not
trivial (but not impossible).* Any application that doesn't uninstall properly, or doesn't have an
uninstaller, can leave entries in the registry. In most cases this leads to performance or even
stability problems,
but only if the application registers itself as a class in HKEY_CLASSES_ROOT. (Note that user
settings
usually remain in the registry, which is done by design for two reasons: first,
the user might be on a Windows domain with server-based profiles, where the
settings move with the user to other computers. Uninstalling the application on
one computer does not mean the user does not want to use the program on some
other computer on the domain. Second, the uninstall process would only be able
to modify the current user's settings anyway. In any case, unused keys in HKCU
have negligible impact on system performance.)* Since at least 1998 [4], pages on Microsoft's
support website relating to
editing the registry include the disclaimer "Use Registry Editor at your own risk." (see, for
example, [5]).Registry alternatives in other operating systems.Other systems preserve the
concept of separate configuration files for separate
application subsystems, but group
them together in a single filesystem directory for ease of management, such as
/etc/ and hidden directories
(directories that start with a period) within the home directory in Unix-like
systems.Applications running on Apple Computer's Mac OS X operating system typically
store settings in property list files
which are usually stored in each user's Library folder. An advantage of this is
that corruption to one of these
files will normally only affect a single application, whereas corruption of one
of the Registry hives can have
wide-reaching effects. However, Mac OS X also has a system database called
NetInfo that stores system-wide
settings such as user account details and network configuration.RISC OS also allows applications
to be copied into directories easily without

the need to install the application

as one would in Windows, if one wishes to remove the application, simply delete
the folder belonging to the
application [6]. This is possible because RISC OS does not support multi-user
environments with different settings
for each user.Problems with Windows 9x OS.On Windows 9x computers, an older installation can
have a very large Registry
that slows down the computer's startup and can make the computer unstable. This has led to
frequent criticisms
that the registry leads to
instability. However, these problems occur far less often on the Windows NT
family of systems, including Windows
XP. Also the regular use of good quality Windows registry cleaner such as
ERROR DOCTOR will keep your registry at a manageable size and free of
errors.
Material provided by Wikipedia.com