4.2. Registry Structure The Registry is enormous and complex; a full Registry might easily contain 15,000 keys and 35,000 values. Entire books have been written about it, and I can't do it justice here. The purpose of this section is to arm you with a basic understanding of how the Registry is organized, not to document individual values in detail or suggest changes you might want to make with the Registry Editor. The top level of the Registry is organized into five main root branches. By convention, the built-in top-level keys are always shown in all caps, even though the keys in the Registry are not case-sensitive. (For example, HKEY_CURRENT_USER\ SOFTWARE\MICROSOFT\Windows is identical to HKEY_CURRENT_USER\Software\Microsoft\Windows.) Their purposes and contents are listed in the following summaries. Note that the root keys are sometimes abbreviated for convenience in documentation (although never in practice); these abbreviations are shown in parentheses. Subsequent sections discuss the contents of the root keys in more detail.
HKEY_CLASSES_ROOT (HKCR) Contains file types, filename extensions, URL protocol prefixes, and registered classes. You can think of the information in this branch as the "glue" that binds Windows with the applications and documents that run on it. It is critical to drag-and-drop operations, context menus, double-clicking, and many other familiar user interface semantics. The actions defined here tell Windows how to react to every file type available on the system. This entire branch is a mirror (or symbolic link) of HKEY_LOCAL_MACHINE\SOFTWARE\Classes, provided as a root key purely for convenience.
HKEY_CURRENT_USER (HKCU) Contains user-specific settings for the currently logged-in user. This entire branch is a mirror (or symbolic link) of one of the subkeys of HKEY_USERS (discussed shortly). This allows Windows and all applications to access and store information for the current user without having to determine which user is currently logged in. An application that keeps information on a per-user basis should store its data in HKEY_CURRENT_USER\Software and put information that applies to all users of the application in HKEY_LOCAL_MACHINE\SOFTWARE. However, what Windows applications consider user-specific and what applies for all users on the machine is somewhat arbitrary. Like many aspects of Windows, the Registry provides a mechanism for applications to store configuration data, but it does little to enforce any policies about how and where that data will actually be stored.
HKEY_LOCAL_MACHINE (HKLM) Contains information about hardware and software on the machine that is not specific to the current user.
HKEY_USERS (HKU) Stores underlying user data from which HKEY_CURRENT_USER is drawn. Although several keys will often appear here, only one of them will ever be the active branch. See the discussion of HKEY_USERS, later in this chapter, for details.
HKEY_CURRENT_CONFIG (HKCC) Contains hardware configuration settings for the currently loaded hardware profile. This branch works similarly to HKEY_CURRENT_USER in that it is merely a mirror (or symbolic link) of another key. In this case, the source is HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\XXXX, in which XXXX is a key representing the numeric value of the hardware profile currently in use. On a system with only a single hardware profile, its value will most likely be 0001. |
