The System Registry Structure

[Previous] [Next]

The registry is a limited, shared system resource. With it come some rules of etiquette (or convention) as well as some rules that are strictly enforced by the system. Before we go on, I want to briefly cover the structure of the registry in more detail.

As I mentioned earlier, the system registry is laid out in a hierarchy consisting of keys and values. Keys can contain an arbitrary number of keys (or subkeys) and values. Subkeys are equal citizens and can contain an arbitrary number of subkeys and values of their own. Key names must be unique among their siblings and cannot contain a backslash. Figure 5-1 shows the registry's structure.

The registry has a logical structure and a physical structure. Programmers usually concern themselves only with the logical structure. Logically, the registry contains a number of root keys similar to how drive A: and drive C: are considered root directories. A registry's root keys identify the tops of registry trees.

Physically, however, the registry is maintained in multiple files, called hives, on the user's hard drive. Programmers need only to think about the path to a key in the registry. Internally, the operating system determines which hive contains this key, and the system accesses the proper file.

Figure 5-1. The Windows 2000 registry structure viewed with RegEdit.exe

The registry for Windows 2000 provides five predefined root keys and a predefined performance data key (HKEY_PERFORMANCE_DATA), which are shown in Table 5-1. The HKEY_LOCAL_MACHINE and HKEY_USERS keys are root keys under which all subkeys in the registry exist. This logical division of the registry under HKEY_LOCAL_MACHINE and HKEY_USERS refines the registry's purpose by addressing two distinct needs: the storage of machine-specific configuration information, and the storage of user-specific configuration information. The next three predefined registry keys are virtual bookmarks for sections of the hierarchy falling under the HKEY_LOCAL_MACHINE and HKEY_USERS keys. For example, the subkeys found under HKEY_LOCAL_MACHINE\Software\Classes can also be accessed under the system-defined key HKEY_CLASSES_ROOT.

Table 5-1. The predefined system registry keys for Windows 2000

Predefined Key Name	Description
HKEY_LOCAL_MACHINE	The set of registry data that applies to the local machine, regardless of which user is logged on.
HKEY_USERS	The set of registry data that applies to specific users. HKEY_USERS includes trees for the default user and any currently loaded user profiles.
HKEY_CURRENT_USER	A system-defined bookmark or alias for a subtree under HKEY_USERS that dynamically points to the registry information for the user associated with the calling thread. There are special rules about the calling thread's user that affect services using impersonation. For more information, see Chapter 11.
HKEY_CLASSES_ROOT	A system-defined bookmark or alias for HKEY_LOCAL_MACHINE\Software\Classes. This tree houses configuration information for registered COM components and shell-related associations in the system.
HKEY_CURRENT_CONFIG	A system-defined bookmark or alias referring to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Hardware Profiles\Current. This tree of the registry houses hardware configuration information.
HKEY_PERFORMANCE_DATA	This predefined key refers to realtime performance data supplied by the system, services, and applications. It is not backed by physical values within the registry. Rather, the registry functions provide a uniform method to dynamically retrieve system performance data.

Like subkey names, values under a single subkey must all have unique names with the exception of the default value, which is unnamed. All values, including the default value, are optional. That is to say, a key can contain one value, many values, or no values at all.

NOTE

---

Like the filenames of system components, key names, subkey names, and value names are not typically localized for international versions of Windows. Naturally, however, any human-readable data stored in values commonly uses local translations.

Each value has data associated with it. A value's data is formatted as one of the system-defined data types, shown in Table 5-2. I will describe the uses and ramifications of some of these data types later in this chapter.

Table 5-2. Registry value data types

Registry Value Data Types	Description
REG_BINARY	A stream of bytes.
REG_DWORD	A 32-bit number.
REG_DWORD_LITTLE_ENDIAN	A 32-bit number in little-endian format. All Windows systems store numbers in little-endian format.
REG_DWORD_BIG_ENDIAN	A 32-bit number in big-endian format. Some non-Windows systems, such as some hardware that runs UNIX and a variety of Motorola CPUs, use big-endian format to store integers.
REG_QWORD	A 64-bit number.
REG_QWORD_LITTLE_ENDIAN	A 64-bit number in little-endian format. This is equivalent to REG_QWORD.
REG_EXPAND_SZ	A zero-terminated string that contains unexpanded references to environment variables in the format "%VARIABLE_NAME%". This type is often used to store file paths, because variables such as "%SystemRoot%" allow your path to stay correct even when the user adjusts the paths for his system. (I'll discuss how to use values of this type later in "Storing Data in the System Registry.")
REG_LINK	A Unicode symbolic link used by the system. Your application or server code should neither query nor store values of type REG_LINK.
REG_MULTI_SZ	A series of zero-terminated strings, with two zero characters following the final string in the series.
REG_NONE	No defined value type. It is functionally the same as REG_BINARY.
REG_RESOURCE_LIST	A device-driver resource list. Not used in user-mode applications.
REG_SZ	A zero-terminated string.

Microsoft defines conventions that programmers should use when accessing the registry. However, the operating system is unable to enforce these conventions. For example, a common mistake developers make is to place machine-specific settings under the user-specific part of the registry, or vice versa.