What is the Windows Registry?

Has the Windows Registry truly earned its reputation as an unforgiving and temperamental beast? Is accessing your system’s Registry really equivalent to entering a treacherous no-man’s land, a dark place where a single typo can bring your entire computer to its knees while you stand helplessly by? Well, yes. But this is definitely a case where it is wise to keep your enemies closer. A thorough understanding of the Registry’s structure and function is therefore an important fist step toward keeping it happy and healthy, and avoiding many of the common pitfalls from which all these nasty rumors originate.

The Registry in a Nutshell

The Windows Registry was introduced by Microsoft with the release of Windows 95, and varies a bit among its subsequent versions. It is a kind of configuration file, in which the CONFIG.SYS, SYSTEM.INI, and program INI files of earlier Windows versions have been consolidated into a single hierarchical structure. Within this structure are stored the configuration settings for all installed hardware, the locations of application data and file type definitions for all installed software, and the application preferences and security definitions for all users. In short, every configuration setting for every version of Windows is now stored within the Registry.

The Registry in Windows 9x/Me is composed of two data files, SYSTEM.DAT and USER.DAT, that permanently reside in the \%WinDir%\ directory on your computer’s hard drive. In Windows NT/2000/XP, the numerous Registry files, which have been given the strangely appropriate name of “hives”, are stored in the \%SystemRoot%\ SYSTEM32\CONFIG\ folder. As permanent Registry components, these files have two functions. First, they are the supporting files from which Windows retrieves all the Registry data during startup, and second, they are the backup files that the Registry writes to each time changes are made to its data.

You can’t open up the massive hive files with a text editor like Notepad; you wouldn’t be able to make any sense of them anyway, since they are written in binary code. Opening them up with a Registry editor doesn’t improve things much—the overall Registry structure was designed more for the computer and operating system than for humans, making it completely unintuitive and excruciatingly complicated to navigate. Fortunately, you will seldom need to access Registry files directly. Instead, you can (and should) use the utilities provided in the Control Panel to make changes to your computer’s configuration settings. These utilities were designed to provide more intuitive interfaces for updating Registry entries, and are therefore much safer to use than the Registry Editor utilities.

A Closer Look at Registry Structure

You can view the overall structure of the Registry by opening it up with a Registry editor utility like REGEDIT.EXE or REGEDIT32.EXE. The Registry appears as a list of 4-6 expandable folders in the left pane of the Registry Editor window, called root keys or subtrees. These Registry subtrees and a short description of their contents are as follows:

• HKEY_LOCAL_MACHINE (HKLM): This root key (or subtree) contains information that is independent of the current user and applications or processes in use. Included within it are the configuration and parameter data for every device on your computer, even those that have been removed.
  
  
• HKEY_CLASSES_ROOT (HKCR): This root key holds information about file-classes and OLE/COM object data. In fact, it contains everything the system needs to know about all installed software on your computer, including the system software itself. The keys, subkeys, and data within this subtree are linked to (and identical to) those contained in the HKEY_LOCAL_MACHINE\ Software\ Classes\ subtree.
  
  
• HKEY_CURRENT_CONFIG (HKCC): This root key is necessary for backward compatibility with older Windows 95 applications. It is derived from
  
  
• KLM\System\CurrentControlSet\HardwareProfiles\Current and contains configuration settings for all currently active hardware.
  HKEY_CURRENT_USER (HKCU): This root key contains profile information for the user currently logged in, like Desktop icons, color schemes, and screensaver preferences. Each time a user logs onto the computer, HKCU is rebuilt with that user’s profile data from HKEY_USERS.
  
  
• HKEY_USERS (HKU): This root key contains the default profile and individual profile data for all users who have logged onto the computer.
  
  
• HKEY_DYN_DATA (HKDD): This root key contains configuration information for hardware currently installed on your PC, and is found only on Windows 95/98/ME. The idea was to speed up the system configuration by loading current hardware information into RAM during the bootup process. HKDD is linked to HKEY_LOCAL_MACHINE
  
  

The "HKEY_" at the beginning of each root key’s name identifies the key as a "Handle", or a unique identifier allowing programs to access system resources. Each of these root keys branches out, first into keys and then further down into subkeys—similar to the directories and subdirectories in Windows Explorer. At the end of the branches of keys and subkeys lay the Registry data, or value entries, that correspond the data stored in the hive files. Value entries come in several different data types, but the most common that you will see are binary values (text for machines), string values (text for humans), and DWORD values (text for Mr. Boolean).