Exploring Regedit

With all its power, Regedit is still a simple program with a straightforward user interface. Its few menus are simple. It has a status bar that displays the name of the current key. Its window contains two panes, split by a divider that you can drag left or right to change the size of both panes. On the left is the key pane; on the right is the value pane. The key pane displays the registry's keys and subkeys, analogous to folders and subfolders. This is the registry's hierarchy. The value pane displays the settings that each key contains. Click a key in the key pane, and you see that key's values in the value pane. This is so similar to Windows Explorer that I'll stretch to say that if you know how to use one, you know how to use the other. Figure 2-1 is a snapshot of Regedit.

Figure 2-1: Regedit is much easier to use when you maximize its window, which helps you to see the full names of subkeys and each value's data in its entirety.

Regedit saves its settings every time you close it. The next time you start Regedit, the window will open to its last position and the window and panes will be the same size. The columns will also be the same size. Last, Regedit reselects the last key that you selected. At times, you'll want Regedit to forget these settings, though, particularly if you're writing a book about the registry and are doing screen captures. Chapter 9, "Scripting Registry Changes," shows you how to do just that. You create a script that automatically removes the key HKCU\Software\Microsoft\Windows\CurrentVersion\Applets\Registry. You can't just remove this key using Regedit, though, because Regedit creates this key each time you close it and will use the current settings to do so.

The following sections describe each pane in more detail, including special tips for working on each side of Regedit's window.

Regedit Got Better

Regedit in Windows XP makes several improvements over the version in Windows 2000:

• Access the features of both Regedit and Regedt32 (the second registry editor in Windows 2000) in a single editor. You no longer have to flip back and forth between both registry editors to complete most tasks.

• Search for keys, values, and data faster.

• Add the keys you use most frequently to the Favorites menu and then pop back to them just by clicking their friendly names on the menu.

• Return to the last key that you selected the next time you run Regedit.

• Export any portion of the registry to a text file that's much easier to read than anything earlier versions of either registry editor provided.

Additionally, Windows XP makes substantial improvements to the registry itself. Windows XP supports much larger registries than earlier versions of Windows; it's now limited only by the amount of disk space available. Second, the registry is faster in Windows XP than in earlier versions of Windows. Windows XP keeps related keys and values closer together in the database, preventing page faults that degenerate into disk swapping. Last, Windows XP reduces fragmentation by allocating space for large values in 16-KB chunks. All in all, the registry in Windows XP is significantly faster to query than it was in Windows 2000.

Key Pane

The key pane displays the registry's hierarchy. It is organized much like an outline, with each key's child keys, or subkeys, indented immediately below it. At the top, you see My Computer, which represents the local computer. When you connect to another computer's registry over the network, you see that computer's name at the top level of the key pane, too. Immediately under My Computer, you see each of the local registry's root keys. Following each root key are its subkeys. The term branch refers to a key and all its subkeys.

Click the plus sign (+) next to a key to expand that branch. Click the minus sign (-) next to a key to collapse that branch. Click any key to see its values in the value pane. You can use the mouse pointer to explore the registry, but using the keyboard is much more efficient when you know the keyboard shortcuts that are available. Table 2-1 describes the keyboard shortcuts that you can use. Of all the shortcuts available, the keys I use the most are Right Arrow and Left Arrow. These are quick ways to move around the registry while expanding and collapsing entire branches at the same time. The other shortcut I find most helpful is Ctrl+F, which quickly opens the Find dialog box.

Table 2-1: Keyboard Shortcuts

Key	Description
Searching
Ctrl+F	Opens the Find dialog box
F3	Repeats the last search
Browsing
Keypad +	Expands the selected branch
Keypad -	Collapses the selected branch
Keypad *	Expands all the selected branch's subkeys
Up Arrow	Selects the previous key
Down Arrow	Selects the next key
Left Arrow	Collapses the selected branch if it's not collapsed; otherwise, selects the parent key
Right Arrow	Expands the selected branch if it's not already expanded; otherwise, selects the key's first subkey
Home	Selects My Computer
End	Selects the last key that's visible in the key pane
Page Up	Moves up one page in the key pane
Page Down	Moves down one page in the key pane
Tab	Moves between the key and value panes
F6	Moves between the key and value panes
Other
Delete	Deletes the select branch or value
F1	Opens Regedit's Help
F2	Renames the selected key or value
F5	Refreshes the key and value panes
F10	Opens Regedit's menu bar
Shift+F10	Opens the shortcut menu for the selected key or value
Alt+F4	Closes Regedit

As you learned in Chapter 1, "Learning the Basics," Windows XP stores different parts of the registry in different hive files. Regedit displays all the hive files together to show a single, unified registry, though. In Regedit, you can see when a branch is its own hive because its name is capitalized. For example, all the subkeys under HKLM are hives, so their names are capitalized. You find each subkey's hive file in %SYSTEMROOT%\System32\config. Notice in Figure 2-1 that all the subkeys under HKU are capitalized, because they are also hives. You find most of those hive files in %USERPROFILE%\Ntuser.dat. When you change a value in Regedit, Windows XP updates the appropriate hive file. While you're editing, you don't really care to which hive file a particular setting belongs, though. Refer back to Chapter 1 if you need a refresher on how Windows XP stores the registry on disk.

Value Pane

The value pane displays the selected key's values. In this pane, you see three columns: Name, Type, and Data. You can change the size of each column by dragging the dividers left or right. I typically use about half the pane to display the Name and Type columns and the remainder of the pane to display the Data column. Each row contains a single value. The first value in the value pane is always (Default), which is the key's default REG_SZ value. For more information about default values, see Chapter 1, "Learning the Basics."

The Name column contains the value's name. Next to the name, you see one of the icons in Table 2-2 that indicates the value's type: string or binary. The Type column indicates the type of data in that value. Unlike earlier versions of Regedit, Windows XP's Regedit properly displays all the different data types that Windows XP supports in the registry, and you can edit them. That includes not only REG_SZ, REG_DWORD, and REG_BINARY, but also REG_EXPAND_SZ, REG_MULTI_SZ, and so on. The Data column displays the value's contents. You'll easily recognize REG_DWORD and REG_SZ values in this column, but REG_BINARY and other types of values are much more difficult to view in their entirety. To get a better glimpse of binary values, click View, Display Binary Data.

Table 2-2: Binary and String Icons

Icon	Description
	Binary values, including REG_DWORD and REG_BINARY
	String values, including REG_SZ and REG_MULTI_SZ