Software | Microsoft Windows Registry Guide, Second Edition

Software

The key HKCU\Software contains per-user program settings. Windows stores much of its own configuration in this key, too. Microsoft standardized this key's organization, which makes finding settings easier because you generally know where in the registry to look for a program's settings. Applications store their settings in HKCU\Software\Vendor\Program\Version\. Vendor is the name of the program's publisher, Program is the name of the program, and Version is the program's version number. Often, Version is simply CurrentVersion. Figure C-4 shows an example of a program that stores its settings in this key.

$figure c-4 techsmith snagit stores its settings in hkcu\software\techsmith\snagit\5.$

Figure C-4 TechSmith SnagIt stores its settings in HKCU\Software\TechSmith\SnagIt\5.

By far, the most interesting subkey is Microsoft because it contains most of the Windows per-user settings. This subkey is discussed in detail in “Software\Microsoft\Windows\CurrentVersion,” later in this appendix. Other interesting subkeys are Classes and Policies, which I describe in the following sections.

Classes

The key HKCU\Software\Classes contains per-user file associations and class registrations. It's really a link to HKU\SID_Classes, which you learned about in Chapter 1, “Learning the Basics.” File associations in HKCU have precedence over file associations in HKLM. Per-user file associations began with Microsoft Windows 2000, and they enable users to install applications without affecting the file associations of other users who share the same computer. They also enable users' file associations to follow them when roaming user profiles are enabled. The contents of this key are the same as HKCR, so see Appendix A, “File Associations,” for more information.

Microsoft\Command Processor

Command-prompt windows support file and folder name completion, as well as a few other features. You can configure these features using Tweak UI, as described in Chapter 5, “Mapping Tweak UI,” or you can hack them directly in the registry. These are settings that I apply to just about every computer I use, so I keep them handy in a script. The following list describes the settings in the subkey Command Processor, which configure the command-prompt window:

AutoRun.
This \CONSOLE value, which has no default, contains a list of commands that run automatically when you start a command-prompt window.
CompletionChar.
This REG_DWORD value specifies the ASCII character code of the key to use for file name completion. You can set this value to 0x00, 0x01 through 0x1F, 0x20, or 0x40. The Tab key is 0x09 and is the default.

DefaultColor.

This REG_DWORD value specifies the default background and foreground color for a command prompt window. The first hexadecimal digit specifies the background color, and the second digit specifies the foreground color. Valid values range from 0x00 through 0xFE; the default is 0.The digits correspond to the colors shown in Table C-2.

Table C-2 Values for DefaultColor
Value	Color
0	Black
1	Blue
2	Green
3	Aqua
4	Red
5	Purple
6	Yellow
7	White
8	Gray
9	Light Blue
A	Light Green
B	Light Aqua
C	Light Red
D	Light Purple
E	Light Yellow
F	Bright White

DelayedExpansion.
This REG_DWORD value specifies whether the command prompt delays environment variable expansion. If the value is 0x01, the command prompt interprets the exclamation point (!) as an environment variable that expands only when used. The default is 0x00.
EnableExtensions.
This REG_DWORD value determines whether command-processor extensions are enabled or not. Setting this value to 0x00 disables extensions. You need to disable extensions only when they interfere with a script language with which they aren't compatible. The default value is 0x01.
PathCompletionChar.
This REG_DWORD value specifies the ASCII character code of the key to use for path completion. Set this value to 0x00, 0x01 through 0x1F, 0x20, or 0x40. The Tab key is 0x09. You can use the same key that you use for file name completion, which expands both.

Microsoft\Internet Connection Wizard

The key HKCU\Software\Microsoft\Internet Connection Wizard contains a single value that indicates whether users have run the wizard. Unlike earlier versions of Windows, the wizard doesn't run automatically when users first open Internet Explorer, so this value is only interesting for inventorying. If the REG_BINARY value Completed is 0x0000, the user has not run the wizard. If the value is 0x0001, the user has run the wizard.

Microsoft\Internet Explorer

The key HKCU\Software\Microsoft\Internet Explorer contains per-user settings for Internet Explorer. Many subkeys in Internet Explorer are difficult to understand or uninteresting. Many of the changes that Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1 make to HKCU are in this branch, though. There are settings in this key that are very useful to customize:

Download.
By default, this subkey contains a single REG_SZ value called CheckExeSignatures. If this value is Yes, Internet Explorer checks programs you download for valid signatures. This value is new for Windows XP Service Pack 2.
Help_Menu_URLs.
This subkey is used to redirect Internet Explorer's online support feature to an intranet location, instead of Microsoft's Web site. To do that, add the \CONSOLE value Online_Support to this subkey, and then set its value to the URL of your Internet Explorer support page. After customizing this setting, when users click Help, Online Support, Internet Explorer opens your support page. As far as I can discover, this is the only choice that you can redirect.
IntelliForms.
This subkey contains the REG_DWORD value AskUser that indicates whether Internet Explorer should ask users whether they want to use the AutoComplete feature. You can set this value to 0x00 to prevent the prompt, but in a business environment where you're more likely to disable this feature, you should disable it using Group Policy.
Main.
This subkey contains many settings for Internet Explorer. For example, you can configure whether Internet Explorer shows its status bar and toolbar.
Settings.
This subkey contains five values that specify the colors used in Internet Explorer: Anchor Color, Anchor Color Visited, Background Color, Text Color, and Use Anchor Color Hover. Each is a \CONSOLE value in the format R,G,B, where you specify each color component—red, green, and blue—using decimal numbers 0 through 255.
Toolbar.
This subkey contains information about the Internet Explorer toolbars. The REG_DWORD value Locked indicates whether the toolbars are locked. The \CONSOLE value LinksFolderName contains the name of the annoying Links folder, which you can rename if you like so that it better matches the contents of your Favorites folder. You can also create the \CONSOLE value BackBitmap to customize the bitmap that you see on the toolbar.
TypedURLs.
This subkey contains a list of the URLs that users type in the address bar. You can quickly clear this history list by removing this subkey.

The subkey Internet Explorer contains two other subkeys that enable some pretty cool customizations. The first subkey is MenuExt. This subkey enables you to extend Internet Explorer's menus with your own scripts. The second subkey is SearchURL, which makes searching the Internet a snap. You add custom search URLs to this subkey, and then search the Internet by typing one of their names in the address bar. It's a real timesaver and one of my all-time favorite customizations, which I also describe in Chapter 4, “Hacking the Registry.”

Microsoft\Internet Explorer\MenuExt

Right-click a Web page, and Internet Explorer displays a shortcut menu. You can customize this shortcut menu by adding commands to it that you link to scripts in an HTML file. For example, you can add a command to the shortcut menu that opens the current Web page in a new window or highlights the selected text on it.

Internet Explorer looks for extensions in HKCU\Software\Microsoft\Internet Explorer\MenuExt. Add this key if it doesn't exist, and then add a subkey for each command that you want to add. Then set that subkey's default value to the path and name of the HTML file containing the script that carries out the command. For example, to add the command Magnify to the shortcut menu that runs the script in the HTML file C:\Windows\Web\Magnify.htm, add the subkey Magnify and set its default value to C:\Windows\Web\Magnify.htm. When you choose this command on Internet Explorer's shortcut menu, it executes the script that the file contains. Then you need to create Magnify.htm. Listing C-1 is Magnify.htm. The property external.menuArguments contains the window object in which you executed the command. Because you have access to the window object, you can do almost anything in that window, such as reformatting its contents, and so on.

Listing C-1 Magnify.htm

<HTML>  <SCRIPT LANGUAGE="JavaScript" defer>  var objWin = external.menuArguments;  var objDoc = objWin.document;  var objSel = objDoc.selection;  var objRange = objSel.createRange();  objRange.execCommand( "FontSize", 0, "+2" );  </SCRIPT>  </HTML>

You can choose the shortcut menus to which Internet Explorer adds your command. In the subkey you created for the extension, add the REG_DWORD value Contexts, and apply the bit masks shown in Table C-3 to it. For example, to limit the previous example so that Internet Explorer displays it only for text selections, add the REG_DWORD value Contexts to Magnify, and set it to 0x10.

Table C-3 Internet Explorer Menu Extensions
Bit Mask	Menu
0x01	Default
0x02	Image
0x04	Control
0x08	Table
0x10	Text Selection
0x11	Anchor
0x12	Unknown

Microsoft\Internet Explorer\SearchURL

Search URLs are a convenient way to use different Internet search engines. For example, you might have a search URL called shop that searches eBay. As shown in Figure C-5, type shop casino chip (yes, I collect them) in the address bar to automatically search eBay for all items that contain the words casino and chip.

figure c-5 customizing the key searchurl is the ultimate shortcut for searching the internet.

Figure C-5 Customizing the key SearchURL is the ultimate shortcut for searching the Internet.

HKCU\Software\Microsoft\Internet Explorer\SearchURL is where you create search URLs. If you don't see this subkey, create it. Then add a subkey for each search prefix you want to use. To use the example I just gave you, create the subkey shop. Set the default value of the prefix's subkey to the URL of the search engine. Use %s as a placeholder for the search string. Internet Explorer replaces the %s with any text you type to the right of the prefix. In my example, set it to http://search.ebay.com/search/search.dll?MfcISAPICommand=GetResult&ht=1&SortProperty=MetaEndSort& query=%s.

Add the \CONSOLE values shown in Table C-4 to the prefix key you created. These values describe what to substitute for special characters in your search string, including a space, percent sign (%), ampersand (&), and plus sign (+). These characters have special meaning when submitting forms to Web sites, so you must substitute a plus sign for a space, for example, or %26 for an ampersand. Thus, the browser translates the string casino & chip to casino+%26+chip.

Finding the URL to use is easy. Open the search engine that you want to add to Internet Explorer's search URLs, and then search for something. When the browser displays the results, copy the URL from the address bar to the default value of the search URL you're creating, replacing your search word with a %s. For example, after searching eBay for sample, the resulting URL is http://search.ebay.com/search/search.dll?MfcISAPICommand=GetResult&ht=1&SortProperty=MetaEndSort&query=sample. Replace sample with %s to get http://search.ebay.com/search/search.dll?MfcISAPICommand=GetResult&ht=1&SortProperty= MetaEndSort&query=%s.

Table C-4 Values in SearchURLs
Name	Data
<space>	+
%	%25
&	%26
+	%2B

Microsoft\MessengerService

The key HKCU\Software\Microsoft\MessengerService contains the settings for Windows Messenger:

AlwaysOnTop.
This REG_BINARY value is 0x01 when you've configured Windows Messenger to appear on top of other windows; otherwise, it's 0x00.
DSBkgndMode.
The first time users close Windows Messenger, this REG_BINARY value displays a prompt that tells them it's running in the background. Setting this REG_BINARY value to 0x01 disables that prompt.
FirstTimeUser.
This REG_BINARY value is 0x01 for first-time users, and it's 0x00 for old-timers. That's the best explanation I've got.
FtReceiveFolder.
This REG_BINARY value contains the folder into which Windows Messenger downloads files it receives. The default value is the My Received Files folder in the user's My Documents folder.
PassportBallon.
This REG_BINARY value indicates the number of times that Windows Messenger has displayed its prompt to sign up for a Passport. To prevent it from prompting to create a Passport, set this value to 0x0a. (Remember to reverse the bits because this is a REG_BINARY value.)
PassportWizard.
This REG_BINARY value indicates whether the user has run .NET Passport Wizard. If this value is 0x01, the user has run the wizard.
Server.
This value specifies the server to which Windows Messenger connects. messenger.hotmail.com;64.4.13.143:1863 is the default value.
StatusBar.
This REG_BINARY value indicates whether to display the status bar. If this value is 0x01, you see the status bar.
TabsShowHide.
This REG_BINARY value indicates which tabs to show or hide.
Toolbar.
This REG_BINARY value is 0x01 if Windows Messenger displays its toolbar; otherwise, it's 0x00.
WindowMax.
This REG_BINARY value is 0x01 when the Windows Messenger window is maximized; otherwise, it's 0x00.
WindowRect.
This REG_BINARY value indicates the coordinates of the normal Windows Messenger window.

Microsoft\Office

This is where Office 2003 Editions stores its per-user settings. In reality, most IT professionals will use the tools outlined in Chapter 17, “Deploying Office 2003 Settings,” instead of customizing these settings for deployment. However, a brief tour of these settings is useful, and a handful of settings are important enough to explain a bit more about them here.

First I'll describe what's in HKCU\Software\Microsoft\Office. At the top of this key, you'll see one subkey for each version of Office that's installed on the computer. For example, you'll see the subkeys 11.0, 10.0, and 9.0. Version 11.0 is Office 2003 Editions. Note that installing Office 2003 Editions creates the keys 8.0, 9.0, 10.0, and 11.0, even though you don't have Office XP or an earlier version of Office on the computer. You'll also see a subkey for the different programs in Office at the top of Office. Although user settings are in HKCU\Software\Microsoft\Office\ version, information about add-ins is in HKCU\Software\Microsoft\Office\ program, and all Office applications share this information.

The subkey 11.0 contains the majority of the Office 2003 Editions settings, whereas the remaining subkeys contain only a handful of settings. For example, in the key 10.0, you see subkeys for each application—Excel, FrontPage, Outlook, Word, and so on. You also see the subkey Common, which contains settings that are common to all the programs in Office 2003 Editions. Some of these settings are important to know about for two reasons. First, the more you understand about them, the more successful you'll be at customizing Office 2003 Editions. Second, you can deploy some Office 2003 Editions settings only as registry values in Custom Installation Wizard. Simply put, the only way to customize a REG_BINARY value in Custom Installation Wizard is by using the Add/Remove Registry Entries screen. You can't customize these settings on the Change Office User Settings screen. Here's a description of these and other important settings:

First-run settings.
The first time a user starts one of the Office 2003 Editions programs, Office 2003 Editions goes through its first-run process to configure the computer for the user. It prompts the user for his or her name and initials, for example, and it customizes settings in HKCU\Software\Microsoft\Office. A handful of values prevent the first-run process from starting a second time. These values are in HKCU\Software\Microsoft\Office\10.0. The value UserData in the subkey Common is 0x01 after the first-run process. You'll find this value in each program's subkey, too. A second, related setting is FirstRun. This value indicates whether the first-run process is complete or not. You find this value in different subkeys of HKCU\Software\Microsoft\Office\version:
- HKCU\Software\Microsoft\Office\10.0\Common\General
- HKCU\Software\Microsoft\Office\10.0\Excel\Options
- HKCU\Software\Microsoft\Office\10.0\Outlook\Setup
- HKCU\Software\Microsoft\Office\10.0\PowerPoint\First Run
- HKCU\Software\Microsoft\Office\10.0\Word\Options
Toolbar settings.
Office 2003 Editions stores most programs' toolbar settings in REG_BINARY values. This means that you can't customize them using the Change Office User Settings screen in Custom Installation Wizard. You can capture those toolbar settings using Profile Wizard, as described in Chapter 17, but what if you don't want to deploy an OPS file? The solution is to customize the toolbars and then export HKCU\Software\Microsoft\Office\10.0\Common\Toolbars to a REG file. Import that REG file into your transform using the Add/Remove Registry Entries screen of Custom Installation Wizard. Office 2003 Editions maintains a number of other REG_BINARY values that you can deploy the same way. If you don't find a setting in the Change Office User Settings screen, track down the setting using the techniques you learn about in Chapter 10, “Finding Registry Settings.” The setting is likely a REG_BINARY value.

Microsoft\Search Assistant

The key HKCU\Software\Microsoft\Search Assistant contains the configuration for the Windows Explorer and Internet Explorer Search Assistant. The \CONSOLE value Actor contains the file name of the character that the assistant uses. The REG_DWORD value UseAdvancedSearchAlways is 0x01 if you've configured the assistant to always display its advanced search features. You don't see the REG_DWORD value SocialUI unless you've turned off the animated character. If this value is 0x01, you'll see the animated character. If this value is 0x00, you won't. Most folks don't like the new search interface, and they can restore it to a user interface more similar to the one in Windows 2000 by setting SocialUI to 0x00 and UseAdvancedSearchAlways to 0x01. I admit that I like the little dog, so I usually leave SocialUI set to 0x01 but use the advanced search features.

Search Assistant's history list is in the subkey ACMru. This subkey contains a variety of subkeys, depending on the types of things for which you've searched. For example, if you search for files and folders, you'll see the subkey 5603, and that subkey contains a list of the different search strings. If you search the Internet using Search Assistant, you'll see the subkey 5001. You can remove each subkey individually to clear a specific type of query's history list, or you can remove the key ACMru to clear all of Search Assistant's history lists. Table C-5 contains a list of the subkeys that I've found in ACMru.

Table C-5 History Lists in Search Assistant
Subkey	Description
5001	Internet
5603	Files and folders
5604	Pictures, music, and video
5647	Printers, computers, and people

Microsoft\VBA\Trusted

The key HKCU\Software\Microsoft\VBA\Trusted is an important subkey if you're deploying Office 2003 Editions. This is where Office 2003 Editions stores its list of trusted sources. When users open a document that contains signed code, enable those macros, and then add the source to the list of trusted sources, Office 2003 Editions stores those certificates in this key. The reason this key is important is that most businesses should lock the list of trusted sources so that users can't add to it, and then set the security level to high. This prevents users from accidentally running malicious code.

The problem with this scenario is that only Office 2003 Editions provides a tool (the Custom Installation Wizard) to customize this list. With earlier versions of Office, no tool is available to distribute trusted sources. Users can't run legitimate macros that they require to do their jobs. The solution is to distribute the list of trusted sources along with earlier versions of Office by using the registry. So here's my solution:

Create a document that contains code and then sign the code using a certificate you want to deploy. Repeat this for each certificate.
Install Office on a lab computer, and set the security levels to high.
Open each document containing a certificate you want to deploy. Enable the document's macros and then add the source to the list of trusted sources. Figure C-6 shows you an example.

Figure C-6 High security in combination with code signing protects your business from viruses.
Export the key HKCU\Software\Microsoft\VBA\Trusted to a REG file, and include this REG file in your deployment. Chapter 17, “Deploying Office 2003 Settings,” describes how to deploy registry settings with Office.

Policies

Windows stores policies in the key HKCU\Software\Policies, the preferred branch for registry-based policies. These are per-user policies, so they are in the HKCU branch of the registry. Restricted users don't have permission to change the Policies subkey, which prevents them from circumventing policies by editing the registry. Windows supports hundreds of policies that enable IT professionals to control users' experiences, lock down the desktop, and so on. Chapter 7, “Using Registry-Based Policy,” shows you how to customize policies by building custom administrative templates.

Very often, using policies is the best and most interesting way to customize Windows. For example, many customizations you learn about in Chapter 4, “Hacking the Registry,” rely on policy settings in the registry to change behaviors. Some of the most interesting policies you learn about in Chapter 4 change how the Start menu and taskbar look and feel. Still other policies enable you to obliterate annoying behavior. Ever wanted to prevent Windows Messenger from running? You can set a policy in this subkey that does that.

Although editing the registry directly is one way to customize these policies, there are better ways. The first way is to use Group Policy Editor to edit the local Group Policy Object (GPO). This provides a user interface for the policies, limiting your settings to valid choices. Chapter 7 describes how to create a local GPO. In short, type gpedit.msc in the Run dialog box, and then edit the policies under Computer Configuration and User Configuration in Administrative Templates. The second way is to write scripts that change policies. I use scripts when I want to repeat the same setting many times, such as when I'm configuring my user profile on multiple computers or when I reinstall Windows on computers repeatedly. Chapter 11, “Scripting Registry Changes,” shows you how to write scripts to edit the registry. Personally, my favorite method is writing INF files.