[Traveler]

Windows XP Learn a little more about your Registry Part 1


How do I edit the registry?
Excluding POLICY.POL for the moment, you cannot simply open SYSTEM.DAT or USER.DAT to edit the registry. You must use the correct tool for the job. Everything you do on the PC will affect the registry in some way or another, either automatically, or by you performing some action with software.
The Control Panel applets offer a simple interface between the user and most of the hardware settings stored in the registry (such as Display properties, or Modem and Network properties). Tweak UI (part of the Microsoft Powertoys set) is a special utility designed to edit various registry settings that are otherwise unavailable via the Control Panel. Policy Editor (which we'll discuss in more detail later), is more suited to administrative registry editing. Plus there are any number of tweaking utilities that "expose" the registry's commonest entries.
Since this discussion is about the registry itself, we must use a tool that allows us to edit ALL of the registry. In this case, the correct tool is the Registry Editor. By default, Registry Editor is located in the C:\WINDOWS folder and goes by the name REGEDIT.EXE.
Before continuing, a word of warning: everything you do in RegEdit is "live". That is, all edits are made there and then - there is no apply or undo button. Therefore, use extreme caution while using RegEdit and don't change anything unless you are 100% sure of what it is your editing, and more importantly, why you are editing it. The registry isn't as fragile as some would have you believe, however, if you don't know what you're doing, you can easily end up breaking Windows. However, as we'll see, it is easy to save sections of the registry before editing them.
NOTE: Your administrator may have blocked your access to RegEdit. This is a wise precaution on his/her part, since you could easily ruin their day.

The Registry Editor
RegEdit looks very much like a Windows Explorer view, but instead of folders and sub-folders, we have keys and sub-keys, and instead of named files containing data, we have named values containing data. The data may be an ordinary text string, or a numeric value in decimal, hexadecimal or binary. In fact, the registry is so flexible it'll support 12 different types of data (compared to the one string data type available in the old INI files).
Keys always which begin with "HKEY_". The 6 listed keys are the root keys - or nodes (HKEY actually means key handle, bizarrely). Some HKEYs (like HKEY_CLASSES_ROOT) are merely pointers to sub-keys contained in one of the other HKEYs - very much like a shortcut. By creating pointers like this, access to often-used areas of SYSTEM.DAT and USER.DAT become that much quicker. Very much like creating a shortcut to a file or folder on your desktop to speed up access to it. However, unlike shortcuts, you cannot create your own pointers.
Below each of these keys there are sub-keys (much like sub-folders). When we address a key we use the familiar path convention we use when addressing a file or folder. For example, the current user's software key is addressed HKEY_CURRENT_USER\Software. HKEY_CURRENT_USER itself is actually a shortcut to HKEY_USERS\, where is the current user's username.
By addressing each key by its node path, the registry can be accessed extremely quickly (just as afile is accessed quickly when you tell Windows where it is located). If you've ever used the Windows Find, Files or Folders utility, you'll know how slow it can be to find the files you're looking for. Similarly with RegEdit's Edit > Find tool. So whenever possible, narrow your search to a particular node or sub-key, and be as specific as possible.
Let's look at each HKEY node in more detail:
HKEY_CLASSES_ROOT
Often expressed as HKCR, this area of the registry is a pointer to the HKEY_LOCAL_MACHINE\Software\CLASSES key, and contains everything from filetype associations to shell extensions. Since this area of the registry is accessed every time you open a file or use an object, creating a pointer to it speeds up access to it. Also, since it is a pointer, every edit made to this portion of the registry using RegEdit is immediately reflected in the HKLM key it refers to.
HKEY_CURRENT_CONFIG
Often expressed as HKCC, this key contains all the Plug and Play settings and information about the current configuration of a multi-configuration computer (such as a docking station). This key is actually a pointer to one of the configuration branches of HKEY_LOCAL_MACHINE\Config.
HKEY_CURRENT_USER
Often expressed as HKCU, this area of the registry contains user-specific settings, and points to the user's specific branch of the HKEY_USERS key.
HKEY_DYN_DATA
Often expressed as HKDD, dynamic data which is stored in RAM (and is therefore under constant change) is stored in this key. This information can change as devices are added or removed. Device Manager uses this data to show the current hardware configuration, and is used to constantly update System Monitor. This key doesn't actually exist in the registry files, it only exists in RAM.
HKEY_LOCAL_MACHINE
Often expressed as HKLM, this key contains machine-specific information about the hardware installed, as well as software settings. The information in this key is used by all users who log on to the machine.
HKEY_USERS
Often expressed as HKU, this key contains information regarding the default and current users. Each user who logs on has a sub-key under this key, and is made up from their own USER.DAT file. If you find a particular user is missing from this key, log on to their profile and export their from this key. Log on under all other users, including the default user, and import their .