Exploring the Registry with Registry Editor

[Previous] [Next]

Windows 2000 provides two programs for reading and changing the registry. Both are called Registry Editor, and neither appears on your Start menu. The executable files are Regedit.exe and Regedt32.exe, and you can run either by opening the Start menu, choosing Run, and typing the name of the executable.

Regedt32.exe is the newer and more advanced of the two. It includes a read-only option and a Security menu, both of which Regedit.exe lack, and it's a little easier to use. Regedit.exe has two advantages over Regedt32.exe, however. Its search feature is slightly more versatile, and it provides a safer way to back up selected portions of the registry. Because of these advantages, it's important to be aware of both editors.

For the remainder of this chapter, we use the name Registry Editor to refer only to Regedt32.exe. We'll refer to the other editor by its executable name, Regedit.exe.

Figure 30-1 shows Registry Editor's opening screen. In this image, Registry Editor is running in read-only mode, but you'll notice that neither the title bar nor a status bar (the program has no status bar) informs you of that fact. To determine whether you're in read-only mode, open the Options menu. If a check mark appears beside the Read-Only Mode command, you're in read-only mode. And unless you're about to make an intentional change to your registry, you should always use read-only mode.

Figure 30-1. Registry Editor lets you examine your registry's five predefined keys in separate document windows.

Predefined Keys (Subtrees)

Registry Editor presents the contents of your registry in five separate document windows, each of which displays the contents of a predefined key. (Predefined keys are also sometimes called subtrees; the two terms are synonymous for describing subdivisions of the registry.) You can minimize, restore, and maximize these windows individually, and you can use commands on the Window menu to cascade or tile all the unminimized windows. The five predefined keys and the kinds of information they record are outlined in Table 30-1.

Table 30-1. Registry Editor's Predefined Keys

Key	Description
HKEY_CLASSES_ROOT	Contains information about file types and their associated applications
HKEY_CURRENT_CONFIG	Contains information about the current hardware profile
HKEY_CURRENT_USER	Contains the profile of the user who is currently logged on
HKEY_LOCAL_MACHINE	Contains information about the local computer (regardless of who is logged on)
HKEY_USERS	Contains the profiles of all users who log on at this computer

The five predefined keys include some redundancy. The entire HKEY_CURRENT_USER, for example, also appears as a subkey of HKEY_USERS, and the entire HKEY_CLASSES_ROOT appears as a subkey of the HKEY_LOCAL_MACHINE subkey known as HKEY_LOCAL_MACHINE\Software\Classes. The redundancy is simply a convenience for you; it makes it easier to get to certain remote corners of the registry—the registry, while large, does not store the redundancies internally.

Keys and Value Entries

Figure 30-2 shows HKEY_LOCAL_MACHINE in a maximized window. As you can see, Registry Editor displays information in two panes. (If you don't see two panes, open the View menu and choose Tree And Data.) On the left is an outline structure, each heading of which is called a key. On the right are value entries. The value entries in the right pane pertain to the key that's currently selected in the left pane. For example, the System key shown in Figure 30-2 has six values: Component Information, Configuration Data, Identifier, SystemBiosDate, SystemBiosVersion, and VideoBiosDate.

Figure 30-2. Each key can have one or more value entries or none at all.

NOTE

---

The particular keys and value entries on your system might vary from those shown here depending on your system's hardware, other installed software, and whether you upgraded to Windows 2000 over another operating system or installed it on a clean machine.

A key can have one value entry, multiple value entries, or none. And a key can contain other keys. The System key shown in Figure 30-2, for example, contains four keys: CentralProcessor, FloatingPointProcessor, MultifunctionAdapter, and ScsiAdapter. Keys contained within other keys are sometimes called subkeys. Keys without value entries are often used as placeholders for future entries or as containers for subkeys that do have their own value entries.

The outline that appears in the left pane looks like any other outline in Windows, but, alas, it doesn't function like any other. An item with a plus sign indicates the key contains subkeys, but to open the key and reveal its subkeys, you must double-click the key. A single-click on the plus sign won't get the job done.

Values and Data Types

Value entries have three components separated by colons, like this:

SystemBiosDate: REG_SZ: 03/11/99

The first component is the name of the value entry, the second is the entry's data type, and the third is its value. The six data types used by Registry Editor are described in Table 30-2.

Table 30-2. Registry Data Types

Data Type	Description
REG_BINARY	A string of digits in hexadecimal (not binary!) notation. Digits appear in pairs, separated by spaces. Each pair represents one byte.
REG_DWORD	A string of 1 to 8 hexadecimal digits, preceded by 0x. No spaces appear within REG_DWORD data.
REG_SZ	A string of characters.
REG_EXPAND_SZ	A string of characters that can include a replaceable variable, such as systemroot.
REG_MULTI_SZ	One or more strings of characters.
REG_FULL_RESOURCE_DESCRIPTOR	A resource list for hardware components or drivers. You can't add or edit data of this type.

When you edit the registry, it is critical that you enter data in the expected data type and observe Registry Editor's formatting conventions (the spaces between digit pairs in the binary type, for example).