List of Figures | Unicode Explained

Chapter 1: Windows Server 2003 Registry Overview

Figure 1.1: Windows Server 2003 system components that use the registry
Figure 1.2: The uninstall utility deletes registry settings that correspond to the application to be uninstalled
Figure 1.3: The Advanced tab of the System Properties window
Figure 1.4: The User Profiles window
Figure 1.5: The Hardware tab of the System Properties window
Figure 1.6: The Hardware Profiles window
Figure 1.7: Hierarchical structure of the registry
Figure 1.8: The Performance Options window
Figure 1.9: Setting the registry size limitation for Windows 2000
Figure 1.10: In Windows XP and Windows Server 2003, there is no option for setting the registry size limitation
Figure 1.11: Windows XP and Windows Server 2003 automatically detect new hardware
Figure 1.12: The newly detected device is successfully installed and configured
Figure 1.13: Hardware Wizard enables you to view the list of installed devices and troubleshoot the devices that are not working properly
Figure 1.14: Hardware Wizard provides a list of device classes. Select Show All Devices if you don't see the hardware category that you require
Figure 1.15: The Windows NT/2000-style list of supported devices

Chapter 2: Registry Backup and Recovery

Figure 2.1: The basic steps of a typical disaster recovery plan
Figure 2.2: The Shadow Copies tab of the disk properties window
Figure 2.3: The Backup or Restore Wizard window
Figure 2.4: The Welcome tab of the Backup Utility window
Figure 2.5: The ASR preparation wizard prompts you to specify the backup-media type and select the backup media or file name
Figure 2.6: The Backup Progress window
Figure 2.7: As the final step of the ASR backup procedure, the wizard prompts you to provide a blank formatted diskette to store the recovery information
Figure 2.8: The Backup Progress window informs you about completion of the backup operation and allows you to view the report
Figure 2.9: To backup the System State Data, set the Only back up the System State data in the second dialog displayed by the Backup Wizard
Figure 2.10: Set the System State checkbox to include the System State data in the backup
Figure 2.11: The Backup Job Information window
Figure 2.12: The Advanced Backup Options window
Figure 2.13: The Restore and Manage Media tab of the Backup window
Figure 2.14: The Welcome to Setup screen, prompting the user to select between installing Windows Server 2003 anew, repairing a damaged Windows Server 2003 installation, or exiting Setup
Figure 2.15: The Export Registry File dialog. The whole process of exporting the registry file is very similar to the process of saving files
Figure 2.16: Importing the registry file

Chapter 3: Using Registry Editor

Figure 3.1: The Registry Editor window
Figure 3.2: The Export Registry File window
Figure 3.3: By default, REG files are associated with the Regedit.exe application
Figure 3.4: Registry Editor prompts you to confirm that you really want to add the contents of the exported REG file to the registry
Figure 3.5: Loading a registry hive
Figure 3.6: The newly loaded copy of the SYSTEM hive (SYS_COPY) now appears as a nested subkey under HKEY_LOCAL_MACHINE root key
Figure 3.7: The Select Computer window now provides extended browsing and searching functionality
Figure 3.8: The New command allows you to add new keys, string, binary, DWORD, multi-string, and expandable string values
Figure 3.9: The Find dialog
Figure 3.10: The Edit Binary Value window
Figure 3.11: The Edit String window
Figure 3.12: The Edit DWORD Value window
Figure 3.13: The Edit Multi-String window
Figure 3.14: The Resource Lists window
Figure 3.15: The Resources window
Figure 3.16: The system prompts you to confirm your intention to delete a registry key or value entry
Figure 3.17: The Binary Data window
Figure 3.18: The new version of Regedit utility contains a Favorites menu
Figure 3.19: The Add to Favorites dialog
Figure 3.20: The Permissions for <Keyname> window allows you to specify registry-key permissions
Figure 3.21: The Permissions tab in the Advanced Security Settings for <Keyname> window
Figure 3.22: The Permission Entry window
Figure 3.23: The Owner tab of the Advanced Security Settings for <Keyname> window
Figure 3.24: The Auditing tab of the Advanced Security Settings for <Keyname> window
Figure 3.25: The Auditing Entry for <Keyname> window

Chapter 4: Customizing the System with the Registry

Figure 4.1: The View tab of the Folder Options Window
Figure 4.2: The Advanced tab of the System Properties window
Figure 4.3: A dialog prompting the user to create an error report and send it to Microsoft
Figure 4.4: The Error Reporting window (Windows Server 2003)
Figure 4.5: The Choose Programs window
Figure 4.6: Notification on the unplanned system shutdown
Figure 4.7: Redirecting error reports using Group Policy
Figure 4.8: Settings specified using Group Policy are saved in the registry
Figure 4.9: The contents of the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting registry key
Figure 4.10: The Startup and Recovery window
Figure 4.11: To specify the custom logo displayed at login time, edit the Wallpaper value under HKEY_USERS\.DEFAULT\Control Panel\Desktop
Figure 4.12: Using MMC for specifying a custom login message (Windows Server 2003 domain controller)
Figure 4.13: To enable automatic logon, the Interactive logon: Do not require CTRL+ALT+DEL local security setting must be disabled
Figure 4.14: The Shutdown Event Tracker prompts you to specify the reason for shutdown or restart
Figure 4.15: The restart and shutdown reasons collected by Shutdown Event Tracker are recorded in the System event log
Figure 4.16: Disabling the Shutdown Event Tracker on Windows Server 2003
Figure 4.17: Configuring Shutdown Event Tracker on a domain or Organizational Unit
Figure 4.18: Windows XP and Windows Server 2003 provide you with the capability of moving the My Documents folder
Figure 4.19: Windows XP and Windows Server 2003 provide a rich set of options for configuring the AutoPlay function

Chapter 5: How the Registry Stores Hardware Information

Figure 5.1: The Unsafe Removal of Device window
Figure 5.2: To remove a hardware device safely, it is necessary to notify the OS that a device is going to be unplugged using the Safe Removal application, which can be found in the notification area
Figure 5.3: Plug and Play architecture in Windows 2000, Windows XP, and Windows Server 2003
Figure 5.4: The device tree displayed by the Device Manager is supported by the Plug and Play Manager
Figure 5.5: Viewing devices by connection
Figure 5.6: The Environment Variables window
Figure 5.7: PnP device states
Figure 5.8: Device Installation scheme
Figure 5.9: The Driver tab of the device properties window now allows you to perform driver rollback
Figure 5.10: The driver can't be rolled back, since there are no driver files backed up for the device
Figure 5.11: The Hardware Profiles window
Figure 5.12: Hardware profiles are stored in the system registry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles
Figure 5.13: The Power Schemes tab of the Power Options Properties window
Figure 5.14: The Hibernate tab of the Power Options Properties window
Figure 5.15: When you enable hibernation support, the Shut Down Windows window will display a new option - Hibernate, allowing you to put the system to hibernation manually
Figure 5.16: The Advanced tab of the Power Options Properties window
Figure 5.17: The taskbar indicator provides quick access to the Power Options applet
Figure 5.18: The UPS tab of the Power Options Properties window

Chapter 6: Registry and the System Boot Process

Figure 6.1: Logical Prefetcher settings in the registry
Figure 6.2: The advanced startup menu options in Windows 2000/XP/.NET Server are specified by the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot registry key
Figure 6.3: The HKEY_LOCAL_MACHINE\SYSTEM\Select registry key
Figure 6.4: The animated screen displaying the OS logo indicates that the kernel is initializing
Figure 6.5: The Hardware tab of the System Properties window
Figure 6.6: The Driver Signing Options dialog
Figure 6.7: Any time an attempt is made to install a system file or driver that isn't digitally signed, Windows 2000/XP and Windows Server 2003 operating systems display a warning
Figure 6.8: For the moment of this writing, Microsoft had no certification program for Bluetooth devices
Figure 6.9: The HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Driver Signing registry key
Figure 6.10: The initial dialog of the File Signature Verification program
Figure 6.11: The Logging tab of the Advanced File Signature Verification Settings window
Figure 6.12: The Signature Verification Results window
Figure 6.13: Typical "blue screen of death" in Windows NT 4.0

Chapter 7: Software Settings in the Registry

Figure 7.1: The HKEY_LOCAL_MACHINE\HARDWARE registry key
Figure 7.2: The System Information utility allows you to view hardware information in user-friendly format
Figure 7.3: The HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter registry key
Figure 7.4: The HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\VIDEO registry key
Figure 7.5: The contents of the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Video\{56652C39-3E1C-4A83-AD68-1CF58F0EDEE9}\0000 registry key
Figure 7.6: The contents of the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Video\{56652C39-3E1C-4A83-AD68-1CF58F0EDEE9}\Video registry key
Figure 7.7: The contents of the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nv registry key
Figure 7.8: An example of the contents of the DeviceN nested key for the device driver subkey under HKEY_LOCAL_MACHINE\SYSTEM\ControlSetnnn\Services
Figure 7.9: Registry settings that specify the video mode
Figure 7.10: The RESOURCEMAP key in Windows XP/Windows Server 2003
Figure 7.11: Typical contents of the HKEY_LOCAL_MACHINE\SOFTWARE key
Figure 7.12: An example of application registration information under HKEY_LOCAL_MACHINE\Software registry key
Figure 7.13: The HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion registry key
Figure 7.14: The contents of the HKEY_LOCAL_MACHINE\SYSTEM\Select registry key
Figure 7.15: The contents of the BackupRestore nested key
Figure 7.16: The hivelist subkey
Figure 7.17: The HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum key structure
Figure 7.18: An example of the contents of the HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\PointerClass registry key in Windows XP
Figure 7.19: The Services key contains the key corresponding to the link provided under DEVICEMAP registry key
Figure 7.20: The contents of a typical HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles key
Figure 7.21: The contents of the IDConfigDB subkey
Figure 7.22: The HKEY_CURRENT_CONFIG and HKEY_LOCAL_MACHINE\System\CurrentControlSet\Hardware Profiles\Current registry keys
Figure 7.23: The HKEY_USERS key structure

Chapter 8: Network Settings in the Registry

Figure 8.1: The Network Connections window
Figure 8.2: The Local Area Connection Properties window
Figure 8.3: The network adapter properties window
Figure 8.4: The taskbar indicator displays the local area connection status
Figure 8.5: The Network Connection Wizard is capable of establishing various connections
Figure 8.6: Enabling Internet Connection Firewall
Figure 8.7: The contents of the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318} registry key defines the settings of the class installer for the network adapter class
Figure 8.8: Information on the notify object that configures the NWLink protocol
Figure 8.9: The HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\2 registry key in the registry
Figure 8.10: Information on the Realtek RTL8139 Family PCI Fast Ethernet network adapter under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum
Figure 8.11: Network adapter settings in Windows Server 2003 registry
Figure 8.12: Typical contents of the Linkage key for the network adapter driver
Figure 8.13: The ..\Ndi\Service setting specifies the name of the service or driver associated with the network component
Figure 8.14: The contents of the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network registry key
Figure 8.15: Local Area Connection properties in the system registry
Figure 8.16: Relationship between registry information and the Network Connections applet in Control Panel
Figure 8.17: The HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RTL8139 key contains configuration data for a Realtek RTL8139 network adapter
Figure 8.18: The HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services registry key contains subkeys for all installed network components
Figure 8.19: The Routing and Remote Access MMC snap-in
Figure 8.20: The Routing and Remote Access Server Setup Wizard enables the user to select the required configuration options
Figure 8.21: The Routing and Remote Access MMC snap-in provides a set of options for configuring the Routing and Remote Access Service
Figure 8.22: The Remote tab of the System Properties window
Figure 8.23: The Remote Desktop Connection window
Figure 8.24: The Display configuration tab of the new Remote Desktop client
Figure 8.25: The Remote Assistance Settings window
Figure 8.26: Group Policy controls for Remote Assistance
Figure 8.27: Example illustrating Group Policy configuration for Remote Assistance
Figure 8.28: The HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters registry key
Figure 8.29: Configuring a RDP-Tcp connection
Figure 8.30: The General tab of the RDP-Tcp Properties window
Figure 8.31: The Logon Settings tab of the RDP-Tcp Properties window
Figure 8.32: The Sessions tab of the RDP-Tcp Properties window
Figure 8.33: The PortNumber value entry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TerminalServer\WinStations\RDP-Tcp\PortNumber
Figure 8.34: The Sessions tab of the user account properties window
Figure 8.35: The Remote control tab of the user account properties window
Figure 8.36: The W32Time service settings in the system registry
Figure 8.37: The HKEY_USERS\.DEFAULT\Software\Microsoft\WindowsNT\CurrentVersion\Network\Persistent Connections registry key

Chapter 9: Protecting the Registry

Figure 9.1: Creating a new Software Restriction Policy
Figure 9.2: Newly created Software Restriction Policies
Figure 9.3: The Enforcement Properties window
Figure 9.4: The Designated File Types Properties window
Figure 9.5: The Trusted Publishers Properties window
Figure 9.6: The completed software restriction policy, which lists the policy type and basic information
Figure 9.7: The New Path Rule window
Figure 9.8: The New Hash Rule window
Figure 9.9: Error message displayed to the user when attempting to run restricted software
Figure 9.10: Windows Server 2003 built-in local security groups (the screenshot is taken on the domain controller)
Figure 9.11: Adding the Security Configuration and Analysis standalone snap-in
Figure 9.12: Opening the Security Configuration Database
Figure 9.13: The Open database dialog
Figure 9.14: Configuring registry permission settings within the Computer Settings portion of the Group Policy
Figure 9.15: Restricting access to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib registry key
Figure 9.16: Configuring the Access Control List for HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg
Figure 9.17: The Machine value of the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths registry key
Figure 9.18: When an attempt to copy the registry of the running Windows NT/2000, Windows XP, or Windows Server 2003 operating system is made, the system displays an error message
Figure 9.19: The list of user groups allowed to reboot the system (Windows Server 2003 domain controller)
Figure 9.20: Weak passwords are cracked by LC4 within a matter of minutes
Figure 9.21: The default settings of the account policies in Windows Server 2003
Figure 9.22: Setting EveryoneIncludesAnonymous registry value via Local Security Policy
Figure 9.23: Disabling the local Administrator account

Chapter 10: Managing the User Environment

Figure 10.1: The HKEY_USERS registry key
Figure 10.2: Using a secondary logon
Figure 10.3: The contents of the HEKY_USERS registry key after invoking a secondary logon
Figure 10.4: The Run As functionality depends on the Secondary Logon service
Figure 10.5: Typical contents of the user profile folder
Figure 10.6: The settings defining the working environment for the currently logged on user are stored under HKEY_CURRENT_USER
Figure 10.7: Setting permissions for the modified default user hive
Figure 10.8: The User Profiles window
Figure 10.9: The Copy To window
Figure 10.10: Creating a test user account
Figure 10.11: Configuring a user profile for roaming
Figure 10.12: User Profile Policies have their own node in Group Policy Editor
Figure 10.13: The list of user profiles is stored in the registry under the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList key
Figure 10.14: In addition to Logon/Logoff, Windows 2000/XP and products of the Windows Server 2003 family provide Startup/Shutdown scripts

Chapter 11: Active Directory Settings in the Registry

Figure 11.1: The contents of the %SystemRoot%\ntds folder on a given domain controller
Figure 11.2: During an attempt to copy the AD database of the running Windows 2000 or Windows Server 2003 domain controller, the system displays this error message
Figure 11.3: Restoring Active Directory as part of the System State data restore process
Figure 11.4: GPOs are multifunction AD objects composed of multiple "nodes", each providing a different control over computers or users.
Figure 11.5: The GUID is listed as the "Unique name" for a specific GPO on the General tab or the GPO properties window.
Figure 11.6: The Group Policy tab of the GPO properties window
Figure 11.7: The example directory structure for one of the GPOs stored in the SYSVOL folder
Figure 11.8: Viewing Group Policy Containers using the Active Directory Users and Computers MMC snap-in
Figure 11.9: RSoP Wizard prompts you to select a mode
Figure 11.10: The User Selection window displayed by RSoP Wizard
Figure 11.11: RSoP query results
Figure 11.12: The Precedence tab displays the order of policy application
Figure 11.13: The Group Policy Object Editor focused on the Default Domain Policy
Figure 11.14: Policy items in Windows 2000, Windows XP or Windows Server 2003 can have one of three states: Not Configured, Enabled, or Disabled
Figure 11.15: Publishing several applications using the Group Policy Editor MMC snap-in
Figure 11.16: The Deploy Software dialog prompts you to choose whether you are going to publish or assign the selected application
Figure 11.17: Published applications are available to the user via the Add/Remove Programs applet in Control Panel
Figure 11.18: When you publish or assign an application within specific GPO, a Class Store is created
Figure 11.19: Discovering your Windows Installer version number

Chapter 12: Troubleshooting Common Problems

Figure 12.1: Before installing a new device that isn't listed in the HCL, create an additional hardware profile.
Figure 12.2: Although the Device Manager states This device is working properly, a newly installed device will cause problems. Disable it in the current hardware profile
Figure 12.3: Recreating the missing ASR floppy disk
Figure 12.4: The Processes tab of the Windows Task Manager window
Figure 12.5: This process didn't respond within the default time-out, preventing Windows from shutting down
Figure 12.6: Configuring the system to clear virtual memory pagefile using Group Policy Object Editor
Figure 12.7: Enabling the Verbose vs normal status messages policy in the domain environment
Figure 12.8: Disabling the Run and RunOnce registry keys using Group Policy Object Editor
Figure 12.9: The Exclude Files tab of the Options window of the built-in Backup utility
Figure 12.10: The contents of the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BackupRestore\AsrKeysNotToRestore registry key (new in Windows XP and Windows Server 2003)
Figure 12.11: The Quota tab of the NTFS drive Properties window

Chapter 13: Advanced Troubleshooting Topics

Figure 13.1: Editing the Start menu and taskbar policies using Group Policy Editor
Figure 13.2: The Setting tab of the Force classic Start Menu Properties window
Figure 13.3: The effect of applying the Force classic Start Menu policy
Figure 13.4: The HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer registry key reflects the effect of applying the Force classic Start Menu policy
Figure 13.5: The Taskbar tab of the Taskbar and Start Menu Properties dialog
Figure 13.6: An example of Notification Area balloon tips
Figure 13.7: The General tab of the Customize Start Menu window
Figure 13.8: Stopping the system Beep driver
Figure 13.9: Disabling system beep by means of editing the registry
Figure 13.10: Configuring System Restore using Group Policy Editor
Figure 13.11: Options for encrypting the Offline Files database
Figure 13.12: Disabling EFS for a standalone Windows XP or Windows Server 2003 computer through a local security policy setting
Figure 13.13: The Local Policy | Security Options section of security templates
Figure 13.14: In Windows XP and Windows Server 2003, the Uninstall button is disabled when you select TC/IP protocol in the Local Area Connection Properties window
Figure 13.15: The Event Properties window displaying the error message on the service startup failure because of logon failure
Figure 13.16: Restoring the right for the user account to log on as service
Figure 13.17: The Log on as service Properties dialog
Figure 13.18: The Log On tab of the service properties window
Figure 13.19: The General tab of the service properties window
Figure 13.20: Configuring the service to start up with the Local System account
Figure 13.21: The Alerter service depends on the Workstation service
Figure 13.22: The dependencies list for RPC service is quite long
Figure 13.23: The ObjectName value under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ServiceName

Chapter 14: Third-Party Registry Utilities

Figure 14.1: Tweak UI for Windows XP
Figure 14.2: The Colors subcategory of the Explorer category in TweakUI
Figure 14.3: The RegMaid utility main window
Figure 14.4: Regmon at work
Figure 14.5: RegSafe is a powerful registry editor with extended functionality
Figure 14.6: RegSafe prompts the user to confirm the deletion of registry entries
Figure 14.7: Great! It has an Undo function
Figure 14.8: Welcome screen of the ERD Commander 2002 Setup program
Figure 14.9: The Password Protection screen of the ERD Commander 2002 Boot CD-ROM Wizard
Figure 14.10: ERD Commander 2002 Boot CD-ROM Wizard extracts files needed to build the bootable CD image
Figure 14.11: The Additional Files dialog of the ERD Commander 2002 Boot CD-ROM Wizard
Figure 14.12: The final interactive step of the Boot CD-ROM Wizard
Figure 14.13: ERD Commander 2002 loads a stripped version of Windows XP
Figure 14.14: ERD Commander 2002 prompts to specify the installation that you wish to repair
Figure 14.15: ERD Commander provides a comprehensive set of tools for repairing damaged installations of all Windows NT-based systems
Figure 14.16: ERD Commander 2002 provides Registry Editor with the same user interface and the same capabilities and the Windows NT/2000/XP Regedit.exe tool
Figure 14.17: Locksmith Wizard tool included with ERD Commander 2002 provides the easiest way of changing the password for any user account
Figure 14.18: Shutdown Stopper runs in the Windows Notification Tray
Figure 14.19: The Setup tab of the Shutdown Stopper window

Chapter 15: Registry Programming

Figure 15.1: Windows XP and Windows Server 2003 include the latest version of Windows Script Host - version 5.6.0
Figure 15.2: The dialog prompting the user to confirm creating of a new registry setting
Figure 15.3: Displaying the contents of the newly created registry entry
Figure 15.4: The dialog prompting the user to confirm deletion of the newly created registry setting(s)
Figure 15.5: You can use Registry Editor to check modifications introduced to the registry at each step of the script
Figure 15.6: Prompt for the user to lock Start menu
Figure 15.7: Prompt for the user to unlock Start menu
Figure 15.8: Dialog box prompting the user to specify whether System Restore must be enabled or disabled
Figure 15.9: Dialog box prompting the user to specify the drive on which the specified action must be taken
Figure 15.10: The message box informing the user of the result of the operation
Figure 15.11: Use the System Restore Ul to check if System Restore is actually turned off for the drive you have specified when running the script
Figure 15.12: Dialog prompting the user to create a restore point
Figure 15.13: The dialog prompting the user to provide a description for the restore point to be created
Figure 15.14: The System Restore window displaying automatically created restore points
Figure 15.15: The Group Policy Object Editor window
Figure 15.16: The Logon Properties window