Section 3.3. Registry Procedures

3.3. Registry Procedures

The solutions in the rest of this chapter will show you how to use the Windows Registry: how to find keys, how to automate changes, how to back up, and more. Use these techniques throughout the rest of the book, whether you're just playing around or trying to solve a problem.

Note that there are a few programs designed to make working with the Registry and its settings easier. For instance:

TweakUI: The options in this little Microsoft add-on make certain Windows settings more accessible, settings that would otherwise require editing the Registry. Note that the version of TweakUI used with older versions of Windows should not be used in Windows XP. TweakUI is available directly from Microsoft, as well as from http://www.annoyances.org. See Appendix A for a list of TweakUI settings, arranged by task.
Creative Element Power Tools: This collection of tools for Windows XP, Windows 2000, and Windows Me includes a bunch of settings, utilities, and context-menu add-ons that aren't otherwise possible with simple changes to the Registry. Among other things, a tool allowing you to search and replace in the Registry is included.

3.3.1. Backing Up the Registry

Taking a few minutes to make sure you have a good backup of your Registry now will save you hours of headaches later. But backing up the files that contain your Registry data (called hives) can be tricky.

HKEY_USERS and HKEY_LOCAL_MACHINE are, essentially, the only true root keys, because the Registry's three other root keys are simply symbolic links, or "mirrors," of different portions of the first two (see Section 3.2, earlier in this chapter). This means that only these two branches actually need to be physically stored on your hard disk.

Since the files in which the Registry is stored are never edited directly, you're likely to never need to know what they're called or where they're located. In fact, they can't even be copied while Windows is running, so you won't be able to back them up directly. However, sooner or later, you'll run into them, so the following is a list of all of the hive files in which the Registry is physically stored on your hard disk.

HKEY_LOCAL_MACHINE

Each subkey of HKEY_LOCAL_MACHINE is stored in its own file in the folder, \Windows\System32\Config. For example, the contents of HKEY_LOCAL_MACHINE\Software is stored in the file software (no extension). The only exception to this is HKEY_LOCAL_MACHINE\Hardware, which is a dynamically generated branch, and therefore not stored on the hard disk at all.

HKEY_USERS\ {SID of current user}

This key, which is the same as HKEY_CURRENT_USER, is stored a file named NTUSER.DAT, located in the user's home directory, which is usually \Documents and Settings\{username}. See Chapter 8 for more information on user accounts and the SID.

You may notice a copy of NTUSER.DAT in \Documents and Settings\Default User. However, this is not the template used for creating new users, as you might expect. Instead, this is merely a remnant of the installation process and does not appear to be used by Windows XP. When a new user account is created, the user hive is built using the data in HKEY_USERS\ .Default, which is stored in the default file in \WINDOWS\system32\config.

Now, since these hive files are in use whenever Windows is running, they can't be read or modified by any other processes. This means that there is no direct way to back up or restore your entire Registry simply by copying these files (as is possible in some earlier versions of Windows). There are, however, several ways to achieve an effective Registry backup:

Use Registry-enabled backup software

The most painless way to back up your entire Registry is to do so while backing up the rest of your system. Any decent backup software designed for Windows XP, including the Backup utility that comes with it, will be able to include the Registry in the backup. See Chapter 6 for more information.

Make Registry patches

Registry patches are the quick and easy way to store small portions of your Registry, useful for transferring Registry data to other computers or simply backing up a key before you mess with it. This is similar, at least conceptually, to a local anesthetic. See Section 3.3.5 later in this chapter for details.

Go behind Windows's back

The only time when you are permitted to copy or overwrite the hive files is when Windows isn't running. If you have a dual-boot system (Chapter 1) or wish to use the Windows Recovery Console (Chapter 6), you'll be able to read and modify the hive files.

The exception to this rule is the user hive, NTUSER.DAT, for users other than the one currently logged on. Say you have three users: Katie, Cat, and Sara. If Cat is currently logged in, the NTUSER.DAT files in both \Documents and Settings\Katie and \Documents and Settings\Sara will be ripe for the plucking.

The implications of this can be interesting. For example, you can back up or replace your own NTUSER.DAT hive simply by logging out and then logging in as another user (as long as that user has administrative privileges). You can also copy one user's settings to another user's account simply by duplicating the user's hive file, which is a quick and easy way to set the default profiles for a large number of user accounts. See Chapter 8 for more information on the administration of user accounts. Note that if you delete a user's hive, it will be reconstructed from data in HKEY_USERS\ .Default the next time the user logs in.

Use the Windows Recovery Console

The Windows Recovery Console, discussed in Chapter 6, is a back door of sorts, allowing you to access Windows files while Windows isn't running and effect repairs if Windows won't start. This means that you can use the Recovery Console to copy the hive files.

Now, this isn't exactly the most convenient means of backing up the Registry, but if you create copies of the hives in another folder on your hard disk, you can use those copies should your Registry ever become corrupted. For instance, if your HKEY_LOCAL_MACHINE branch gets screwed up, all you'd need to do is replace the active hive files with backups made on an earlier date. See "How to Delete or Replace In-Use Files" in Chapter 2 for more tips.

If your HKEY_CURRENT_USER branch should ever become corrupted, you can restore it from a backup, as described here. Or, you can log on as the Administrator (or another existing account), and effect repairs from within Windows. Unfortunately, you can't create new user accounts on the fly from the Logon or Welcome screens, as you could in some earlier versions of Windows.

The important thing to realize with all of these backup solutions is that they require advanced planning. Don't wait until your system won't start before you start thinking about backing up. See Chapter 6 for simple backup tips.

3.3.2. Finding the Right Registry Key

The two main obstacles you'll encounter when trying to make a change to the Registry are (1) finding where a setting is located in the Registry, and (2) determining what modifications are necessary to affect the desired changes.

Sometimes it's obvious, such as a theoretical value called ShowSplashScreen, with its contents set to 1 (one); changing the 1 to a 0 (zero) would most likely result in turning the option off.^[8] Other times you'll see a long, seemingly meaningless series of numbers and letters. Although there are no strict rules as to how values and keys are named or how the data therein is arranged, a little common sense and intuition will get you through most situations.

^[8] Zero and one, with regard to Registry settings, typically mean false and true (or off and on), respectively. However, sometimes the value name negates thisif the value in the example were instead called DontShowSplashScreen, then a 1 would most likely turn off said splash screen.

Here's a solution that will help you find the corresponding Registry key for a particular setting in Windows. For this example, we'll find the Registry setting associated with showing or hiding hidden files in Windows Explorer, and then we'll create the appropriate Registry patch.

A Registry patch is a convenient way of automating changes to the Registry, and therefore to Windows and your applications, and is useful if you frequently change a setting or a group of settings. It's also a convenient way to propagate a group of settings on one or more other computers. This solution provides a way to come up with a Registry patch that corresponds to one or more options in the interface.

The idea is to take snapshots (make Registry patches) of your entire Registry before and after a change is made in Explorer (or any other program). By comparing the two snapshots, we can easily see which Registry keys and values were affected:

Make sure no unnecessary applications are running (check your Windows system tray/notification area), because they could write to the Registry at any time, adding unexpected changes.
Open the Registry Editor, and highlight the HKEY_CURRENT_USER branch.
Select Export from the File menu. Specify a filename (e.g. User1.reg), place it somewhere convenient (such as your Desktop), and click Save to export the entire branch to the file.
Then, select the HKEY_LOCAL_MACHINE branch and repeat the steps, exporting it instead to Machine1.reg.^[9]
^[9] Although the Registry has five main branches, the others are simply symbolic links of portions of these two. See "Backing Up the Registry," earlier in this chapter, for details.
Next, we will make our desired change. In this case, go to Control Panel Advanced Settings list, change the Hidden Files and Folders option, and click OK when you're done.
Immediately switch back to the Registry Editor, and re-export the HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE branches into new files, such as User2.reg and Machine2.reg, respectively, as described earlier in step 2.
What we now have is a snapshot of the entire Registry taken before and after the change (or changes) was made. It's important that the snapshots be taken immediately before and after the change, so that other trivial settings, such as changes in Explorer window positions, aren't included with the changes we care about.
All that needs to be done now is to distill the changed information into a useful format. Windows comes with the command-line utility File Compare ( fc.exe), which can be used to find the differences between our before and after files.^[10]
^[10] There are several superior, Windows-based third-party alternatives, such as UltraEdit-32 (available at http://www.ultraedit.com). See "Windows XP in a Nutshell" (O'Reilly) for complete documentation on the File Compare utility (fc.exe).
At the command prompt, first use the cd command to change to the directory containing the Registry patches, such as \Windows\Desktop, if they're on your desktop (see Chapter 10 for more information on the cd command), and then type the following two lines:
```
fc /u user1.reg user2.reg > user.txt fc /u machine1.reg machine2.reg > machine.txt
```
These commands will instruct File Compare to scan both pairs of files and write only the differences between the files into new text files: user.txt for the changes in HKEY_CURRENT_USER and machine.txt for the changes in HKEY_LOCAL_MACHINE.
The user.txt file should look something like this:
```
Comparing files user1.reg and USER2.REG ***** user1.reg [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\      Explorer\Advanced] "Hidden"=dword:00000001 "ShowCompColor"=dword:00000000 ***** USER2.REG [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\      Explorer\Advanced] "Hidden"=dword:00000002 "ShowCompColor"=dword:00000000 *****
```
From this example listing, it's evident that the only applicable change was the Hidden value, located deep in the HKEY_CURRENT_USER branch. (There may be some other entries, but if you inspect them, you'll find that they relate only to MRU lists from RegEdit and can be ignored.)^[11]
^[11] MRU stands for Most Recently Used. Windows stores the most recent filenames typed into file dialog boxes; from this example, you'll notice several references to the filenames you used to save the Registry snapshots.
Note that for this particular setting, no changes were recorded in the HKEY_LOCAL_MACHINE branch, so machine.txt ends up with only the message, "FC: No differences encountered." This means our changes were only reflected in the HKEY_CURRENT_USER branch.
You'll also notice that the lines immediately preceding and following the line we care about are also shown; they're included by FC as an aid in locating the lines in the source files. We're lucky in that one of the surrounding lines in this example happens to be the section header (in brackets), which specifies the Registry key in which this value is located.^[12]
^[12] For more information on section headers, see Section 3.3.5.2, earlier in this chapter, as well as Section 3.3.7, later in this chapter (.ini files have a format similar to Registry patches).
In most cases, you'll have to search the Registry snapshots (often easier than searching the Registry) for the changed line; in this example, you'd search USER2.REG for "Hidden"=dword:00000002 and then make note of the line enclosed in square brackets ([...]) immediately above the changed line. This represents the key containing the Hidden value.
In user2.txt, the Hidden line is located in the section:
```
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\      Explorer\Advanced]
```
The next step is to convert the output from File Compare into a valid Registry patch. Because the FC output is originally derived from Registry patches, it's already close to the correct format. Start by removing all of the lines from user.txt, except the second version of the changed linethis would be the value in its after setting, which presumably is our goal. You'll end up with this:
```
"Hidden"=dword:00000002
```
Next, paste in the key (in brackets) above the value. (In the case of our example, it was part of the FC output and can simply be left in.) You should end up with this:
```
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\      Explorer\Advanced] "Hidden"=dword:00000002
```
Lastly, add the text Windows Registry Editor Version 5.00 followed by a blank line at the beginning of the file (see Section 3.3.5.2, earlier in this chapter, for more information). The final result should look something like this:
```
Windows Registry Editor Version 5.00 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\      Explorer\Advanced] "Hidden"=dword:00000002
```
Save this as a new file called User-final.reg.
If the settings you've changed have resulted in changes in the HKEY_LOCAL_MACHINE branch, simply repeat steps 9-12 for the machine.txt file as well.
If your setting resulted in changes in both HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE, your last step would be to consolidate the two patches into one file. See Section 4.3.3 for a practical example of how this is done. When consolidating, make sure you have only one instance of the Windows Registry Editor Version 5.00 line.

For some settings (such as the one in this example), you may want to make two patches: one to turn it on, and one to turn it off. Simply double-click the patch corresponding to the setting you desire.

You may notice that some changes involve the actual removal of a key or value, instead of simply the modification of an existing entry. See Section 3.3.5.2, later in this chapter for details on automating the deletion of Registry data.

This solution will help you find the appropriate keys and values associated with a particular Windows or application setting, and it can also help locate hidden settings (those that don't appear in dialog boxes). The setting in the previous example is located in a key that contains other settings, some of which aren't included in the Folder Options dialog box. Experiment with some of the more interesting sounding values, such as CascadePrinters and ShowSuperHidden.

There are some caveats to this approach, mostly that the File Compare utility will often pull out more differences than are relevant to the change you wish to make. It's important to look closely at each key in the resulting Registry patch to see if it's really applicable and necessary.

See Chapter 9 for a discussion on the Windows Script Host, which documents automating changes to the Registry that don't involve Registry patches.

It's always smart to create a corresponding undo Registry patch while you're using a solution like this. For example, because our Registry patch contains the differences in the after file, user2.reg, the corresponding undo patch would contain the corresponding lines in the before file, user1.reg. Applying the undo patch effectively returns the keys and values stored within to their state before the setting was changed. Obviously, an important caveat is that an undo patch for one computer won't necessarily be an effective undo for another computer.

3.3.3. Search the Registry Effectively

The Registry Editor has a simple search feature, allowing you to search through all the keys and values for text. Just select Find from the Registry Editor's Edit menu, type the desired text (Figure 3-6), and click Find Next.

Figure 3-6. Use Registry Editor's Search feature to find text in key names, value names, and value data

Because the Registry can become quite large and have a wide variety of settings and information, it is important to learn to search effectively, so you don't miss anything or waste a lot of time wading through irrelevant results. Additionally, the Registry Editor doesn't have a search-and-replace feature, so doing something as simple as changing every occurrence of c:\program files to d:\program files can be a monumental chore. Here are some tips that may help:

Make sure that all three options in the Find window's Look at section are checked, unless you know specifically that what you're looking for is solely a Key, Value (value name), or Data (value contents).
You'll also usually want the Match whole string only option turned off, unless you're searching for text that commonly appears in other words; searching for handle might otherwise trigger entries like PersistentHandler and TeachAndLearn.
Many folder names in the Registry are stored in both long and short versions.^[13] For example, say you want to move your Program Files folder from one drive to another. When you install Windows, any settings pertaining to this folder may be stored in the Registry as c:\Program Files or c:\Progra~1. Make sure you search for both.
^[13] See Section 5.2.5 for more information on short filename generation.
If you're searching the Registry for both Program Files and Progra~1, you may want to just search for progra, which will find both variations. Because this will stumble upon other instances of the word program, TRy limiting the results by placing a backslash ( \ ) in front of it (e.g. \progra) to limit the search to only directory names beginning with those letters. A minute of preparation can save you an hour of searching.
You may want to search the Registry for an interface element, such as a new item added to a context menu or text in a list in a dialog box. If the text contains an underlined character,^[14] you'll need to add an ampersand (&) to the search string. For example, say you've installed a program that creates .zip files (such as WinZip, available from http://www.winzip.com), and the program has added the command Add to Zip (with the Z underlined) to the context menu for all files. You'll need to search for add to &zip to match the text properly; a search for add to zip will probably turn up nothing. Note also that text searches are not case-sensitive, so you don't have to worry about capitalization.
^[14] Underlined letters in dialog box elements (buttons, menu items, etc.) are hints to the shortcut keys that can be used to activate them. However, by default in Windows XP, underlined letters are hidden in many applications until you press the Alt key. You can change this behavior by going to Control Panel Searching begins at the currently selected key. If you want to search the entire Registry, make sure the My Computer enTRy at the top of the Registry tree is highlighted before you begin. However, if you know the setting you want to change is in, for example, HKEY_LOCAL_MACHINE, you should highlight that key beforehand to reduce search time and eliminate irrelevant results.

Although the Registry Editor has a search feature, it doesn't allow you to search and replace. If you have a branch of settings you wish to change (for example, if you've moved an application from one drive to another or want to, say, replace every occurrence of notepad.exe with another application), you can use a Registry patch; see Section 3.3.5 earlier in this chapter. Just create a patch of the branch in question and use your favorite text editor's search-and-replace feature to change the values in the patch. When you apply the patch, all the settings will be changed for you. Note that you should use this with caution, because you can screw up many settings unwittingly by searching and replacing common pieces of text.

If you want to use search and replace more often and the previous Registry patch tip isn't sufficient, you may want to try the Registry Agent tool, part of Creative Element Power Tools (http://www.creativelement.com/powertools/).

3.3.4. Search and Replace Registry Data

The Registry Editor has no search-and-replace feature, and with good reason: a single poorly chosen replace operation could make Windows inoperable. But there are times when you do need to replace all occurrences of, say, a folder name like c:\stuff\Cory with another folder name like d:\stuff\Henna. Depending on the number of occurrences, such an operation could take hours.

Registry Agent (part of Creative Element Power Tools, available at http://www.creativelement.com/powertools/ not only gives you an better way to search the Registry (search results are shown in a list, instead of one at a time), but supports search-and-replace operations as well. Here's how to replace all occurrences of Microsoft with DaveSoft:

Replacing the word Microsoft in your registry is a really bad idea. Don't try this at home. Now, ordinary searching with Registry Agent is totally harmless, but the Replace feature can be dangerous if you're not careful.

Open Registry Agent.
Type text to search (e.g. Microsoft), and click Find Now.
The results are shown in a list (Figure 3-7) with three columns. The left column shows the location (key) where the text was found; you can click it to open the Registry Editor at that location. The middle and right-hand columns show the value name and contents, respectively.

Figure 3-7. Use Registry Agent for a faster Registry search, as well as for search-and-replace operations
Select the Replace tab.
Place a checkmark next to the occurrences you wish to replace. Use the checkmark above the list to check or uncheck the entire list.

Type the new text (which will replace the old text) in the With field.

You don't have to replace the same text you searched. For instance, you can search for Microsoft and then do a search-and-replace within these results for different text. Type anything you like in the Replace field.

Choose what types of text you'd like to replace by checking or unchecking the Keys, Values, and Data options. Note that the Keys checkbox is grayed-out (disabled) by default; refer to the documentation to lift this restriction.

The Replace tool has no "undo" feature, which means that if you screw something up here, the only way to recover is to restore your Registry from a backup (discussed earlier in this chapter). You can also use the Export tab to export a Registry patch (see the next section) containing the selected values, but you shouldn't rely on this as a reliable backup.

Click the Replace button to perform the search-and-replace.

Even if you don't use the search-and-replace feature, Registry Agent serves as a pretty slick searching tool, and overcomes the annoying hunt-and-peck approach of the Registry Editor's search feature.

3.3.5. Using Registry Patches

In addition to editing the Registry with the Registry Editor (see earlier in this chapter), you can make changes by using Registry patches. A Registry patch is simply a text file with the .reg extension that contains one or more Registry keys or values. If you double-click on a .reg file, the patch is "applied" to the Registry, meaning that the contents of the patch are merged with the contents of the Registry. This tool is especially handy for backing up small portions of the Registry or distributing Registry settings to other computers.

For example, if a particular application stores its custom toolbar in the Registry, you can use a Registry patch to copy the toolbar to another computer, saving time that would otherwise be spent painstakingly configuring the 431 toolbar items on the new machine.

A Registry patch is also a handy way to back up Registry data, such as file types, which are constantly at risk of being changed by other applications (see Section 4.3.3). More importantly, however, Registry patches can be used to back up portions of the Registry to safeguard them against modifications you're about to make, such as the modifications suggested throughout the rest of this book.

3.3.5.1 Create a Registry patch

Open the Registry Editor, and select a branch you wish to export.
The branch can be anywhere from one of the top-level branches to a branch a dozen layers deep. Registry patches include not only the branch you select, but all of the values and subkeys in the branch. Don't select anything more than what you absolutely need.
Select Export from the File menu, type a filename, and press OK.
All of the values and subkeys in the selected branch will then be stored in the patch file. Make sure the filename of the new Registry patch has the .reg extension.

Creating a Registry patch is the easy part; the hard part can be determining the Registry key to be exported in the first place. See Section 3.3.2 earlier in this chapter for details.

Once you've created the patch, you can modify it or apply it to your (or someone else's) system, as described in the following sections.

3.3.5.2 Edit a Registry patch

Since Registry patches are just plain text files, you can edit them with any plain-text editor, such as Notepad (notepad.exe). The contents of the Registry patch will look something like the text shown in Example 3-1.

Example 3-1. Contents of a Registry patch created from HKEY_CLASSES_ROOT \.txt

Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\.txt] @="txtfile" "PerceivedType"="text" "Content Type"="text/plain" [HKEY_CLASSES_ROOT\.txt\ShellNew] "NullFile"=""

The first line, Windows Registry Editor Version 5.00, tells Windows that this file is a valid Registry patch; don't remove this line. The rest of the Registry patch is a series of key names and values.

The key names appear in brackets ([...]) and specify the full path of the key. The values contained within each key follow. The name of the value is given first, followed by an equals sign and then the data stored in each value. The value names and value data are always enclosed in quotation marks. A value name of @ tells the Registry Editor to place the value data in the (default) value (as shown in the fourth line of the example).

Registry patches created in Windows 95, 98, or Me will have the line REGEDIT4 at the top of the file. These patches can be imported into the Windows XP Registry without a problem (that is, not taking into account the settings contained therein). However, older versions of Windows may complain if you try to import Registry patches created in Windows XP. If you encounter this problem, just replace the header line with REGEDIT4.

If you are familiar with the particular information contained within the Registry patch you've just created, you can edit anything you wish and save the changes when you're done. Note that only making changes to a Registry patch doesn't mean anything; your changes won't take effect in the Registry until the Registry patch is applied (described in the next section).

There are several reasons why you might want to edit a Registry patch file:

Streamline a lot of edits

Modifying a large number of Registry values may turn out to be much easier with a text editor than with the Registry Editor, since you don't have to open and then close each individual value.

Keep in mind that if you change the name of a value (to the left of the equals sign), as opposed to the value contents (on the right side), you'll effectively be creating a new value. See the next section for details on how Registry contents are merged.

Search and replace

The Registry Editor has no search-and-replace function (for reasons that shouldn't need explaining). However, most text editors do, so you can quite easily search for and replace text when editing a Registry patch.

If you have a branch of settings you wish to changefor example, if you've moved an application from one drive to anotheryou can use a Registry patch. Just create a patch of the branch in question and use your favorite text editor's search-and-replace feature to change the values in the patch (e.g., replace all occurrences of c:\big_program with e:\big_program). When you apply the patch, all the settings will be changed for you.

Note that it's very easy to change more than you intended with a search-and-replace, so be careful. However, one of the benefits of Registry patches is that you can double-check your changes before they're applied to your Registry. Also, a second Registry patch can be used to easily restore the modified portion of the Registry if necessary. See Section 3.3.3 earlier in this chapter for more tips.

If you want to use search and replace more often, you may want to try Registry Agent, described in Section 3.3.4.

Easily duplicate keys and branches

The Registry Editor provides no way to copy or move a key (such as using drag-drop).^[15] If you create a Registry patch of a key, change the key name, and then reimport it, it will effectively duplicate the key. This can be a handy way to create new file types (described in Chapter 4).

^[15] Trust me, this is a good thing. Keys and values are referenced by their location; change the location, and as far as Windows knows, the key is gone. The last thing you'd want to do is inadvertently hose your system by dragging an important key into oblivion.

Automate the deletion of Registry data

Lastly, there's really no way, using the Registry Editor, to create a patch that deletes a Registry key (think about it). However, you can modify a Registry patch to accomplish this feat.

To delete a key with a Registry Patch, place a minus sign before the key name, like this:

-[HKEY_CURRENT_USER\Control Panel\don't load]

If you delete a key, all of its values will also be deleted. However, a security feature present in Windows XP^[16] prevents the removal of any key that currently has subkeys. This means that to remove an entire branch, you'll have to recursively delete all of the subkeys first, which is something typically only possible from within a programming language.

^[16] This restriction is not present in Windows 9x/Me.

To delete a value with a Registry Patch (but leave the key untouched), place a minus sign after the equals sign, like this:

[HKEY_CURRENT_USER\Control Panel\don't load] "desk.cpl"=-

Merging multiple patches

One of the advantages of Registry patches is that they enable you to change several Registry settings in a single step. However, sometimes those settings are located in different parts of the Registry, and since it isn't practical to export the entire Registry just to catch all of the applicable keys, you can quite easily merge two different Registry patches into a single file. See Section 4.3.3 for a practical example.

3.3.5.3 Apply a Registry patch

You can apply a Registry patch at any time and to any computer. There are three ways to do this, but there is really no difference between them, at least as far as the final results are concerned. Do whatever is most convenient.

3.3.5.4 Solution 1: From Explorer

Double-click on a Registry patch file (with the .reg extension) in Explorer or on your desktop. It doesn't matter if the Registry Editor is running or not.
Answer Yes to the warning message that asks, "Are you sure you want to add the information in c:\stuff\MyPatch.reg to the Registry?"
Immediately thereafter, you'll see the message, "Information in MyPatch.reg has been successfully entered into the Registry."

3.3.5.5 Solution 2: From within the Registry Editor

Select Import from the File menu, and select the patch you wish to import.
Click OK to merge the file. You won't be prompted to confirm that you actually do want to apply the patch (as with Solution 1), but you will receive the confirmation message that the patch was successful.

3.3.5.6 Solution 3: From the command line

Open a Command Prompt window (cmd.exe).
Using the cd command, as described in Chapter 10, navigate to the folder containing the Registry patch. Note that instead of changing the working directory, you can also simply specify the full path of the patch in the next step.
Assuming the Registry patch is named MyPatch.reg, type the following:
```
regedit mypatch.reg
```
You'll then receive the same "Are you sure?" message, as when double-clicking the Registry patch in solution 1. However, the advantage of using the command line is the ability to apply Registry patches from a WSH script or batch file, so the preferred method is to bypass the confirmation, like this:
```
regedit /s mypatch.reg
```
where the /s switch instructs the Registry Editor to import the patch silently (without the prompt).

If the Registry Editor is currently running and you are viewing a key that was modified by a patch that was just applied, RegEdit should refresh the display automatically to reflect the changes. If it doesn't, press the F5 key or go to View

When you apply a Registry patch, you are merging the keys and values stored in a patch file with the Registry. Any keys in the applied patch that don't already exist will be added to the Registry. Pre-existing keys in the patch will be left alone. If a specific value already exists, the value will be changed to whatever is in the patch. However, any values already in an existing key that aren't in the Registry patch will remain. This means that if you create a patch, rename a key or value (different from changing its data), and then apply it, the original key or value will remain intact and you'll have a duplicate.

If you're creating a Registry patch on your computer for use on another, make sure any folder names or drive letters are corrected for the new computer. If, for example, a Registry patch created on one computer references c:\my_ folder\my_ program.exe, you'll need to make sure to change all occurrences of the text to d:\her_ folder\my_ program.exe to reflect any applicable differences. Using Expandable String values, as described earlier in this chapter, virtually eliminates this problem.

See Chapter 9 for a discussion on the Windows Script Host, which documents how to further automate changes to the Registry.

3.3.5.7 Using Registry patches on earlier versions of Windows

Many of the Registry patches you create and modify in Windows XP will be applicable in other versions of Windows. But there are two issues you'll need to address before you can use Registry patches on a computer running Windows 9x/Me:

Unicode versus ANSI: Registry patches created in Windows XP and Windows 2000 are encoded as Unicode text, a format not supported by the Registry Editor in Windows 9x/Me. Unless you convert these files to ANSI or ASCII files, they'll just show up as jibberish in earlier versions of Windows.
The header: As stated previously, the single-line header placed at the beginning of every Registry patch in Windows XP is Windows Registry Editor Version 5.00. If you change this to REGEDIT4, the Registry patch will be readable in Windows 9x/Me, as well as in Windows 2000/XP.

Here's a quick procedure to convert a Registry patch created in Windows XP so that it can be used in Windows 9x/Me. Note that this procedure won't stop Windows XP and Windows 2000 from recognizing the patches, which makes one wonder why Microsoft changed the format.

Open a newly created Registry patch file in Notepad (notepad.exe).
Remove the line that reads:
```
Windows Registry Editor Version 5.00
```
and replace it with the following:
```
REGEDIT4
```
Go to File ANSI from the Encoding list at the bottom of the Save As dialog. Make sure the filename is correct, and click Save when you're done.

You can also save Registry patches for use in earlier versions of Windows right in the Registry Editor. Go to File Win9x/NT 4 Registration Files from the Save as type list.

Despite the different format, Registry patches are applied in the same way in all versions of Windows. Refer to the instructions earlier in this section for details.

3.3.6. Create an Interface for a Registry Setting

The whole point of accessing the Registry is to view and modify settings that are otherwise inaccessible in Explorer, the Control Panel, or the hundreds of dialogs boxes scattered throughout the operating system. However, there is a way to patch into the interface and add checkboxes and radio buttons that are linked to whatever Registry settings we want.

Start by going to Control Panel Advanced settings list in this dialog box is presented in a somewhat awkward list format, apparently to accommodate the large number of options. However, the less-than-ideal presentation is actually designed to allow customization, permitting Microsoft (or you) to easily add or remove items from the list. See Figure 3-8 for an example of a customized version of this window.

Figure 3-8. The Advanced Folder Options dialog box is a flexible, customizable list of Registry settings

Although the "customizability" of this dialog isn't necessarily intended for you to add an option for any Registry setting you want, whether it's related to Explorer or not, that's precisely what you can do with it, thanks to the following solution.

The idea of this solution is that you link up a checkbox or radio button to a valueany value you choosein your Registry. This would, for example, allow you to make certain Registry changes accessible to yourself or others (such as users in a workgroup that you administer), reducing the need for them to mess around in the Registry. You can also remove any unwanted options that normally appear here but that you don't want easily changed.

The format is actually quite remarkable, because you don't have to be a programmer to utilize this feature. You can add new options to a certain portion of the Registry and then tie those options to other Registry settings. The downside is that the syntax requires that numerous parameters be typed, which can be cumbersome. The following procedure should allow you to make changes to existing settings, as well as add your own settings fairly easily:

Open the Registry Editor.
Expand the branches to: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder.
Notice that the actual hierarchy in the Folder Options window is reproduced here in the Registry, although the list items may appear in a different order than their corresponding Registry entries. This is because the captions in the Folder Options list aren't necessarily the same as the names of the corresponding Registry keys here, yet both collections are sorted alphabetically. For example, the Remember each folder's view settings option is represented by the ClassicViewState key in the Registry.
Take this opportunity to back up the entire branch by highlighting the Advanced key and selecting Export from the File menu. This way, you'll be able to easily restore the defaults without having to reinstall Windows.
At this point, you can remove any unwanted entries by deleting the corresponding keys from this branch; the Text value in each key should be enough to explain what each key is for.
To add a new item, start by simply creating a new key, keeping the hierarchy in mindfor example, are you adding a setting to the top level, or possibly a new setting to an existing group, or are you creating a new group for additional options?
Name the key anything you want, although the more descriptive, the better.

The values inside each key determine the properties of the corresponding setting. For example, one value affects the caption, while another affects the default value. Feel free to fish around the existing keys for examples.

To add a property, create a new value, name it appropriately (described later), double-click it, and then type the contents for the value. Table 3-2 lists the properties that affect the visual appearance of a specific item, and Table 3-3 lists the properties that affect what happens when a specific item is turned on or off in the Folder Options window.

Table 3-2. Visual properties of Folder Options items
Value name	Data type	Description of value contents
Type	String	This can be set to either `group`, `checkbox`, or `radio`, representing a folder, checkbox, or radio button, respectively. Checkboxes are square options and can either be either on or off. Radio buttons are round options that are linked to other radio buttons in the same folder, in that only one at a time can be selected (you can have multiple groups of radio buttons). And folders, of course, are used to organize the various other options. This parameter is required by all items.
Text	String	This is the actual caption of the option as it will appear in the dialog box. This can be as long as you want (better too descriptive than too vague), but the paradigm dictates that only the first word be capitalized and that there be no period. This parameter is required by all items.
Bitmap	String	This specifies the icon, used for folder items only. If omitted, it's a rather ugly bent arrow. The syntax^[17] is `filename`,`index`, where `filename` is the full path and filename of the file containing the icon, and `index` is the icon number (starting with zero), if the file contains more than one icon. To specify the familiar yellow folder, type `%SystemRoot%\system32\Shell32.dll,4` here. This parameter is optional for all folders and has no effect on checkboxes and radio buttons.
HelpID	String	This is the filename and optionally the help context ID, pointing to the documentation for this item. If the user selects the item and presses the F1 key, this specifies the help note that will appear. The syntax is `filename`#`id`, where `filename` is the name of a .hlp or .chm file, and `id` is the numeric help context id (commonly used by programmers) of the topic you want to display. Omit `id` to simply show the index page of the specified help file. This parameter is optional.

^[17] The Bitmap value uses the same syntax as the DefaultIcon property for file types, as documented in Section 4.3.2.

Table 3-3. Registry-related properties of Folder Options items
Value name	Datatype	Description of value contents
HKeyRoot	DWORD	This is an eight-digit number representing the root of the Registry path containing the target Registry setting. Use the hexadecimal number `80000000` for `HKEY_CLASSES_ROOT`, `80000001` for `HKEY_CURRENT_USER`, `80000002` for `HKEY_LOCAL_MACHINE`, `80000003` for `HKEY_USERS`, or `80000005` for `HKEY_CURRENT_CONFIG`. For some reason, it must be separated from the rest of the Registry path, specified in `RegPath`, later. This parameter is required for all checkbox and radio items.
RegPath	String	This is the path specifying the location of the target Registry setting, not including the root (see `HKeyRoot`, earlier). For example, for `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion`, you would only enter `Software\Microsoft\Windows\CurrentVersion` here. This parameter is required for all checkbox and radio items.
ValueName	String	This is the name of the target Registry value. This value is where the setting data is stored when the option is turned on or off in the Folder Options window. The key containing said value is specified by the `RegPath` and `HKeyRoot` parameters, listed earlier. This parameter is required by all checkbox and radio items.
CheckedValue	Should match target value data type	This holds the data to be stored in the target Registry value (specified by the `RegPath` and `ValueName` parameters earlier), when said option is turned on. If you're configuring an option to be used on both Windows 9x/Me and Windows XP/2000 systems, use both the `CheckedValueW95` and `CheckedValueNT` parameters instead of this value. Otherwise, this parameter is required by all checkbox and radio items.
CheckedValueW95	Should match target value data type	Use this instead of `CheckedValue`, above, if you're configuring an option to be used on both Windows 9x/Me and Windows XP/2000 systems. This value contains the data that will be applied if the system is running Windows 9x/Me. Used in conjunction with `CheckedValueNT`, below.
CheckedValueNT	Should match target value data type	Use this instead of `CheckedValue`, above, if you're configuring an option to be used on both Windows 9x/Me and Windows XP/2000 systems. This value contains the data that will be applied if the system is running Windows XP, 2000, or NT. Used in conjunction with `CheckedValueW95`, later.
UnCheckedValue	Should match target value data type	This holds the data to be stored in the target Registry value, when said option is turned off. This value is optional; if omitted, it is assumed to be `0`.
DefaultValue	Should match target value data type	This is the default value, used only if the target Registry value does not already exist. As soon as the option in the Folder Options window is turned on or off at least once, this parameter is ignored, and Windows instead reads the state of the target value, comparing it to `CheckedValue` and `UnCheckedValue` to determine if the option should appear checked or unchecked. This value is optional; if omitted, it is assumed to be `0`.

The value type (String, Binary, DWORD) of the CheckedValue, UnCheckedValue, and DefaultValue parameters all depend on what the target value requires. For example, if the target value you're changing is a DWORD value, then all three of these parameters must also be DWORD values.

After you've created keys and entered the appropriate property values, your Registry should look something like Figure 3-9, and the resulting Folder Options dialog box should look like Figure 3-8. If Folder Options is open, you'll have to close it and reopen it for the changes to take effect.

Figure 3-9. Settings that appear in the Advanced Folder Options list are configured in the Registry

If you try to add a setting using the previous procedure and it doesn't show up in Folder Options, most likely one or more required values are missing.
Close the Registry Editor when you're finished.

The examples shown in Figure 3-8 and Figure 3-9 show how another solution in this book (see the discussion of the Recycle Bin in Section 4.1.1) can be turned into an advanced Folder Options setting. Here, a single checkbox allows you to easily turn on and off the Rename and Delete commands in the Recycle Bin's context menu.

When the Folder Options dialog box is first displayed, each option is set according to the current value of the corresponding settings. More specifically, the current data stored in each target value is compared with the corresponding CheckedValue and UnCheckedValue, and the option in the Advanced settings list is set accordingly. When the OK button is pressed in Folder Options, the settings in the Registry are then written using the same criteria.

To reproduce a setting elsewhere in the Windows interface or the interface of a third-party application, you'll first need to find the respective Registry setting; see Section 3.3.2, earlier in this chapter, for more information. Refer also to the section on Registry patches, which offers a very handy way to reproduce the customizations made here on any number of computers.

3.3.7. Using INI Files

If you've been using a Windows PC for any length of time, you've probably come across files with the .ini filename extension. Initialization files (or Configuration Settings, as they're known in any recent release of Windows) were used in the old days to store settings for applications, as well as Windows itself, before the Registry was implemented. INI files are simply text files (editable with any plain-text editor, such as Notepad) that are specially formatted to store such settings. Because INI files are limited in their maximum file size (64 KB) and are not as efficient as the Registry, application developers have been strongly encouraged to abandon INI files and instead store settings in the Registry. Since some applications still use INI files to store certain settings, it may become necessary to look for and change settings in INI files as well.

An example of an application that may still use an INI file today is an application installer. An INI file would allow a program to read and store settings without having to rely on the Registry; that way, the settings would be accessible regardless of the computer on which the program was run. INI files are also handy (for the same reason) for programs that run over a network. Windows also includes a few INI files, although they're generally used only to maintain compatibility with older applications.

To edit an INI file, just double-click it, and it will open in Notepad.^[18] A typical INI file looks something like this:

^[18] To configure another text editor to be the default INI file editor, see the discussion of file types in Chapter 4.

[Episodes] 2F01=The Last Traction Hero 9F22=Spay Anything 4f12=Why do Fools fall in Lava? 7F09=Porch Pals [Cities] first=Brockway second=Ogdenville third=North Haverbrook

Section names are always enclosed in square brackets ([...]); the lines that follow are the settings contained in that section. A section continues until the next section begins or the file ends. Settings include a setting name, followed by an equals sign, and then the data assigned to that setting.

You'll notice that the structure of INI files is similar (but not identical) to that of Registry patches, discussed earlier in this chapter.

3.3.7.1 Searching INI files for settings

In addition to searching the Registry, you may want to search all INI files for a particular setting:

Open a Search window (see Chapter 2).
Type *.ini in the All or part of the file name field, and type the text for which you want to search in the A word or phrase in the file field.
Double-click on any file in the search results to view it, and use your text editor's search feature to find the specific instance of text in the file.

3.3.7.2 Special case: System.ini and Win.ini

INI files can be found in a variety of places; some applications place their INI files in the application folder, while others store them in the Windows folder (the preferred location, recommended by Microsoft many years ago). Although it's becoming less common, some applications store their settings in the file, Win.ini, which is the INI-file equivalent of the HKEY_USERS branch of the Registry.

Right alongside Win.ini is the System.ini file, the INI-file equivalent of the HKEY_LOCAL_MACHINE Registry branch. Both of these files are still included in Windows XP, although it's primarily to maintain compatibility with such older applications that expect to find or store certain settings therein.

There's typically little interest anymore in either of these files. If you're familiar, for example, with the now-obsolete Load= and Run= lines in the [Windows] section of Win.ini, that functionality is taken care of by the Startup folder in the Start Menu, as well as several locations in the Registry (see Chapter 6 for details). Similarly, the shell= line of System.ini, which was used to specify an alternate Windows shell (replacing Program Manager in Windows 3.x or Explorer in Windows 95) is no longer supported at all in Windows XP.