Windows 2000 and Windows XP Network Parameters in the Registry

Windows 2000/XP networking features include several improvements. These improvements have also influenced the method of storing network data in the registry. The main improvements introduced into the networking are: support for NDIS 5.0 (Windows 2000) and NDIS 5.1 (Windows XP), Plug and Play support, power management, and the new INF file format used for installing network components.

Installing Network Components in the Windows 2000/XP Registry

To install Windows 2000/XP networking components, the operating system requires the following:

• Class installer and optional co-installer
  Class installer is a dynamically loaded library (DLL) that installs, configures, or deletes devices of a specified class. Networking components in Windows 2000/XP must be installed by Windows 2000/XP network class installer or by a vendor-supplied class installer.
  If the standard class installer doesn't provide all of the necessary functionality for an individual device, the device vendor may develop an optional co-installer. This co-installer is a Win32 DLL that implements all the necessary functions for the individual device.

  A list of existing network components is provided below:

  • Net—this class defines network adapters.

  • NetTrans—this class defines network protocols (such as TCP/IP and IPX) and connection-oriented network clients.

  • NetClient—this class specifies network clients, such as Microsoft Client for Networks or NetWare Client. The NetClient component is considered a network provider. It also can be used to provide print services (in this case, it's also the print provider).

  • Netservice—this class specifies network services, such as the file service or the print service.

  The network class installer defines the class of the network component to be installed by the ClassGuid value. The ClassGuid value is the Globally Unique Identifier (GUID) for the class. You can generate GUID values using the Uuidgen.exe utility. More detailed information about this utility is provided in Platform SDK supplementary documents.

  All standard network component classes and their respective ClassGuid values are listed in Table 8.3.

  Table 8.3: Network Component Classes and Their Respective ClaseGuid Values

  Network component class	ClassGuid value
  Net	{4D36E972-E325-11CE-BFC1-08002BE10318}
  NetTrans	{4D36E973-E325-11CE-BFC1-08002BE10318}
  NetClient	{4D36E974-E325-11CE-BFC1-08002BE10318}
  NetService	{4D36E975-E325-11CE-BFC1-08002BE10318}

  Class installer information is stored in the registry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class. For each class installer, this key contains a subkey named… No, it won't have the name you're expecting it to have. And it won't be something like "Net", either. Rather, it will be the ClassGuid value (Fig. 8.8). Compare this name to the ClassGuid values listed in Table 8.3.

  
  Fig. 8.8: The contents of the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\ {4D36E972-E325-11CE-BFC1-08002BE10318} registry key defines the settings of the class installer for the network adapter class

• One or more INF files
  INF files contain information that's necessary to the class installer of the network component to install this component. A detailed description of the INF file format is provided in the documents supplied with Windows Driver Development Kit (DDK).

• Optional notify object
  Network software components, such as network protocols, services, or network clients, may have notify objects that allow you to display the user interface for manual configuring of the network components. For example, the UI provides capabilities for manual control over the binding process. Notice that hardware components, such as network adapters, may also provide both UI and software control over the binding process. However, all these tasks are performed by the INF file or coinstaller, rather than by notify objects. Fig. 8.9 shows information on the notify object that provides the capability of manually configuring the NWLink protocol, Migration DLL, and its associated files.
  If the device driver isn't included with the standard Windows 2000/XP distribution package, then the device vendor should provide the support.

  
  Fig. 8.9: Information on the notify object that configures the NWLink protocol

In addition to the files listed above, the following files are needed to install network components:

• One or more device drivers. Normally, each driver contains a driver image (the SYS-file) and a driver library (DLL).

• The driver catalog file is optional, but highly desirable. We discussed catalog files in Chapter 6. Here, we'll only note that if the device vendor needs to include a device into the Hardware Compatibility List (HCL), it's necessary to test both the device and its driver in the Windows Hardware Quality Lab (WHQL). If the test results are satisfactory, WHQL includes the device into the HCL and provides the catalog file (CAT file) for the driver. The CAT file contains the digital signature.

• The optional Txtsetup.oem file. This file contains the data needed by the Windows 2000/XP Setup program to install the device driver during the earliest phases of the setup process (the text-mode setup).

Network Adapter Registration Information

Like Windows NT 4.0, Windows 2000/XP also has software registration subkeys for all of the installed network adapter cards. These keys are stored under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\Netcard# (Fig. 8.10).

Fig. 8.10: The HKEY_LOCAL_MACHINE\SOETWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\2 registry key in the Windows XP registry

Note 

Notice that network adapters are numbered beginning from 1, rather than from 0 as usual.

The HKEY_LOCAL_MACHINE root key also contains two more subkeys containing data on the network adapter:

• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum. Here, Plug and Play enumerators store the data concerning individual devices, such as device identifiers (device ID) and identifiers of compatible devices (if they exist). Fig. 8.11 provides information about the Realtek RTL8139 Family PCI Fast Ethernet NIC stored under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum. Fig. 8.12. shows how some of this information (including the device description and its type) is displayed by the Network Connections applet in Control Panel.

  
  Fig. 8.11: Information on the Realtek RTL8139 Family PCI Fast Ethernet network adapter under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum

  
  Fig. 8.12: The Network Connections applet in Control Panel displays the registry information stored under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum

• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Class\<ClassGUID>. Here, device installers store data on each individual class of devices, its respective class installer, and coinstallers (if present). For each installed driver, there's a subkey under the key, named "0000", "0001", … These subkeys contain information on individual drivers, including a description string, the path to the driver's INF file, and vendor information. Fig. 8.13 shows the contents of the registry key containing data on the driver we're discussing—the network driver for Realtek RTL8139 Family PCI Fast Ethernet adapter.

  
  Fig. 8.13: Network adapter settings in Windows XP registry

Each of the driver keys also contains a set of required subkeys: Linkage and Ndi. The typical contents of the Linkage subkey for the network adapter driver are shown in Fig. 8.14. As you can see, this subkey contains the following standard settings: Export, specifying the list of created objects; RootDevice (the setting that specifies the root device); and UpperBind (the setting that specifies protocol binding).

Fig. 8.14: Typical contents of the Linkage key for the network adapter driver

The Ndi key contains subkeys and settings that depend on the type of installed network component. If the network component has an associated service or device driver, then the Ndi key will contain a Service setting. This setting specifies the name of the appropriate service or driver (Fig. 8.15). If there are several services associated to a given network component, then the Ndi key will contain the required CoServices setting (REG_MULTI_SZ data type). This setting will list all services associated with the component, including the main service specified by the Service setting. This setting is required for all NetTrans components (transport protocols), NetClient components (network clients), and NetService components (network services). The components of the Net type (network adapters) have no such setting (Fig. 8.15). As you can see, only the RTL8139 device driver has been associated with the network adapter.

Fig. 8.15: The ..\Ndi\Service setting specifies the name of the service or driver associated with the network component

All further configuration information on Windows 2000/XP network components is stored in the registry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network. Notice the subkeys, long strings composed of characters and digits and enclosed in braces (Fig. 8.16). If you look at these keys carefully, you'll immediately notice that their names are actually the ClassGuid values listed in Table 8.3.

Fig. 8.16: The contents of the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network registry key

If you open these keys sequentially and explore their contents, you'll find everything you need to understand how network components are configured. For example, if you open the subkey named {4D36E972-E325-11CE-BFC1-08002BE10318} (if you remember, this ClassGuid value specifies network adapters), you'll notice the Connection key at the lowest level of hierarchy (Fig. 8.17). It's not difficult to see that this key specifies the LAN connection properties. First, the Name string setting specifies the "Local Area Connection" string that you see in the Network and Dial-up Connections window. Next, the string setting named PnPInstanceID is the link to the subkey under the Enum key, which contains the data concerning the network adapter. Finally, the binary setting named ShowIcon specifies if the toolbar indicator is enabled. The relationship between registry settings and Control Panel applets is illustrated by Fig. 8.18.

Fig. 8.17: Local Area Connection properties in the system registry

Fig. 8.18: Relationship between registry information and the Network and Dial-up Connections applet in Control Panel

Registration Information on the Network Components

Registration information for the network services is stored in the system registry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. This registry key contains the service registration keys for network components (including network adapters). To continue our discussion, notice that the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\ {4D36E972-E325-11CE-BFC1-08002BE10318}\0000\Ndi key contains the Service setting, which specifies the name of the respective service or driver (in our example, RTL8139). The RTL8139 subkey that describes the settings for the service associated with the Realtek RTL8139 Family PCI Fast Ethernet adapter is shown in Fig. 8.19.

Fig. 8.19: The HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RTL8139 key contains configuration data for a Realtek RTL8139 network adapter

The HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services registry key also contains subkeys that describe each network component installed in the system (Fig. 8.20).

Fig. 8.20: The HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services registry key contains subkeys for all installed network components