Examining the Regedit User Interface

This section can be used as a brief reference when working with Regedit. It provides a description of all the functions of the registry editor. The following sections contain instructions and tips on using Regedit, as well as directions on modifying the registry.

The Regedit window contains four main regions (Fig. 3.1):

Fig. 3.1: Regedit window

• The menu bar. The menu bar contains the following menu items: Registry, Edit, View, Favorites (a new menu item introduced with Windows 2000), and Help.

• Left pane. The left pane displays the registry hierarchy organized in the keys and subkeys.

• Right pane. The right pane displays value entries contained within a selected registry key. Each value entry is identified by its name, displayed in the Name column; data type, displayed in the Type column (a small icon to the left of the name helps to identify the data type); and the value, which is displayed in the Data column.

• Status bar. The status bar indicates the path to the selected registry entry. It's helpful when you need to view the full path to the registry key containing the selected registry entry.

When you start Regedit, the Registry Editor window displays only the top-level registry keys below the My Computer icon. These are the root keys described in Chapter 1.

If you click [+] to the left of the folder, this will expand the respective registry key displaying its subkey hierarchical structure. This operation expands the key tree to the next nesting level and resembles similar methods of opening folders in Explorer.

If the subkeys contain other nested keys, they'll also have the [+] sign to the left of the folder. The subkeys, in turn, can also be expanded to view the next level of registry hierarchy. This method of organizing the registry information is known as nesting. Any number of nesting levels is allowed. This hierarchical organization is the main difference between the registry and the initialization files. It provides a significant advantage over the methods of storing the initialization information used in Windows 3.x.

When you reach the lowest level of nesting, the [−] sign will appear to the left of the folder icon. This means that the key can't be expanded further, and you can only go up the hierarchical tree.

If neither the [+] nor [−] icons are present, this means that the key doesn't contain any subkeys.

Table 3.1 provides a list of keyboard shortcuts used for viewing and navigating the Registry using Regedit.

Table 3.1: Keyboard Shortcuts Used in Regedit.exe

Key	Description
<+>	Expands the selected registry key by one level to show its subkeys
<−>	Collapses the selected registry key by one level
<↑>	Moves you up to the next key
<↓>	Moves you down to the next key
<→>	Expands the selected key by one level to show subkeys; if there are no subkeys, moves you down to the next key
<←>	Collapses the selected key if it was open; otherwise, moves you up to the next key
<Tab>	Moves you to the next pane of the Registry Editor window

Registry value entries are displayed in the right pane of the Registry Editor window. Each value entry contains three parts: name, data type, and value data.

Like any parameter, each registry value entry has a name. Many value entries provided by Microsoft use a "Default" name (as you'll see later when you begin intense work with Regedit). All the names of the value entries are displayed in the Name column in the right pane of the Registry Editor window. These names are assigned to the value entries by the software and hardware developers.

Data types that describe the registry value entries are displayed in the Type column.

Definitions of all the registry data types defined and used in Windows NT/2000 are provided in Chapter 1.

For convenience sake, the Regedit.exe utility uses special icons displayed to the left of the value names. These icons allow the user to quickly distinguish between binary and text data. A brief description of the icons displayed in the Regedit window is provided in Table 3.2.

Table 3.2: Icons Used for Designating Registry Data Types in Regedit.exe

Data type	Description
	Designates binary data (including REG_BINARY and REG_DWORD)
	Designates text data and readable characters. For example: "On The Microsoft Network" (string data types, such as REG_EXPAND_SZ, REG_MULTI_SZ, and REG_SZ)

The Data column contains text or binary data that correspond to the value of the selected registry entry. You can edit, create, or delete this data to optimize software functionality or troubleshoot problems.

A brief description of the Regedit menu items is shown below.

The File Menu Commands

The File menu contains the following commands:

• Import

• Export

• Load Hive

• Unload Hive

• Connect Network Registry

• Disconnect Network Registry

• Print

• Exit

The Import command allows you to import previously exported registry files in ASCII or REG format.

The Export command exports either the whole registry, or only a part of it, as a REG file or an ASCII file.

To export the registry branch, proceed as follows:

1. Select the registry branch you wish to export, then select the Export command from the File menu.

2. The Export Registry File window (Fig. 3.2) will open. Enter the file name into the File name field. By default, this file will get the REG filename extension. If you need to save the exported file in another format, select the option you need from the Save as type list below the File name field. Despite all the apparent similarity of the Regedit versions supplied with Windows 9x, Windows NT 4.0/Windows 2000, and Windows XP, these are different versions of the same application. The Regedit version included with Windows XP allows you to save exported registry files in various formats, including both the Windows 2000/XP format (use the Registration files (*.reg) option for this purpose), and the registry file format used by Windows 9x/NT 4. (Use the Win9x/NT 4 Registration files (*.reg) option for this purpose). Furthermore, now you can save the exported registry file as a hive (select the Registry Hive Files option) and in text format (use the Text Files (*.txt) option)

   
   Fig. 3.2: The Export Registry File dialog

3. If you need to export only the branch that you have previously selected, set the Selected branch radio button in the Export range option group. However, if you frequently modify the system registry, exporting the whole registry would be better. Exported registry files will provide you with additional options if you need to troubleshoot a damaged system.

4. Click the Save button.

You can view the saved file using any text editor to make sure that everything was saved correctly. Exported registry files contain unformatted ASCII text.

Be very careful when working with exported registry files, especially when you export registry files for experimental purposes. For example, experienced administrators can solve problems by editing the exported registry file, and then importing this file back into the system. However, before you start introducing changes, take all the necessary precautions:

1. Create a backup copy of the exported registry file that you need to edit. If you make an error during the editing session, you can correct the problem by importing the backup copy of the REG file.

2. If you're going to experiment with the various operating systems' registries (including Windows 95/98/ME, Windows NT 4.0/Windows 2000, and Windows XP), store the exported registry files for each operating system in folders dedicated specifically to this. This will help you avoid problems caused by importing incompatible registry files.

3. By default, REG files are associated with the Regedit application (Fig. 3.3). The Regedit application merges these files into the registry (Merge is the operation performed by default). In Windows XP, when you double-click such files, Regedit.exe will start and prompt you to confirm if you really want to add the contents of an exported file into the registry (Fig. 3.4). Be very careful at this step, to avoid accidentally importing incompatible or incorrect registry settings.

   
   Fig. 3.3: By default, REG files are associated with the Regedit application

   
   Fig. 3.4: Registry Editor prompts you to confirm if you really want to add the contents of the exported REG file into the registry

The Load Hive and Unload Hive commands are new to Regedit exe. We saw above that they represent the same functionality that was provided by the similarly named command present in Regedt.32. These commands allow you to load registry files previously exported from the registry and saved in the registry hive format, or unload registry hives, respectively. Note that these commands are only applicable to the HKEY_USERS and HKEY_LOCAL_MACHINE keys. Therefore, these commands will be available only if one of these registry keys is selected. In all other cases the commands will be grayed and unavailable. The hive that you have loaded into the registry becomes one of the subkeys under the root keys mentioned above.

To load a registry hive, proceed as follows:

1. Select the HKEY_USERS or HKEY_LOCAL_MACHINE registry key to activate the appropriate menu command.

2. Select the Load Hive command from the File menu The Load Hive window will open, allowing you to select the previously exported registry hive. Select the required hive file and click Open.

3. Enter the name that will be used for newly loaded hive (Fig. 3.5). This name will be used for the new subkey that will appear in the registry after you load the hive (Fig. 3.6). Now you will be able to edit the loaded registry hive to provide the required modifications.

   
   Fig. 3.5: Loading a registry hive

   
   Fig. 3.6: The newly loaded copy of the SYSTEM hive now appears as a nested subkey under HKEY_LOCAL_MACHINE root key

   Note 

   To be able to accomplish this procedure, you need to log on to the local system as Administrator or a user belonging to the Administrators group. If your computer participates in a network, network security policy will also influence your ability to perform this operation.

4. Having accomplished the editing of the loaded registry hive, you can unload it by selecting it and then choosing the Unload Hive command from the file menu You need to save any changes to the hive that you're going to unload, in order to restore them later.

The Connect Network Registry command allows you to edit the registry of a remote computer This command will be available only if the computer running Regedit is participating in a network that contains Windows NT/2000 or Novell NetWare servers. To connect to a remote registry, you need to specify the name of the computer where the remote registry is contained (Fig. 3.7). Notice that the set of options available for browsing and searching the network is significantly extended in comparison to the functionality provided by the Registry Editor version supplied with Windows NT/2000, where, actually, only the Browse option was available.

Fig. 3.7: The Select Computer window now provides extended browsing and searching functionality

Note 

To be able to accomplish this procedure, you need to log on to the local system as Administrator or a user belonging to the Administrators group. If your computer participates in a network, network security policy will also influence your ability to perform this operation.

To disconnect the remote registry, use the Disconnect Network Registry command. If you're not currently participating in a network, this command will be unavailable.

You can use the Print command from the File menu to print the whole registry, or only a part it. The capability of printing a selected branch of the registry is a convenient alternative.

Use the Exit command to close the Regedit window and terminate the registry editing session.

The Edit Menu Commands

The Edit menu contains commands that allow you to find and modify registry entries:

• Modify

• Modify Binary Data

• New

• Permissions

• Delete

• Rename

• Copy Key Name

• Find

• Find Next

The Modify command is used for editing data contained in the registry entries. This option will be available only if you select one of the entries displayed in the right pane of the Registry Editor window. Modify Binary Data allows you to edit any data (including other data types) in the binary editor window. As with the previous command, this one will also become available only after you select one of the registry values listed in the right pane of the registry editor window.

The New command allows you to add new keys and value entries. Note that in comparison to the Regedit version supplied with Windows NT/2000, which allowed you to add only string data, binary data, and DWORD data, the Windows XP version of Regedit.exe provides an extended set of options. It allows you also to add multi-string and expandable string data (Fig. 3.8). These options become available after selecting the New option. The same options will be available in the right-click menu.

Fig. 3.8: The New command allows you to add new keys, string, binary, DWORD, multi-string, and expandable string values

Other options of the Edit menu, such as Rename and Delete, allow you to delete and rename the value entry. You can also delete the value entry by selecting it and clicking the <Del> key. To rename the value entry, right-click it, select the Rename command, and enter the new name.

Note 

Deletion of registry keys and value entries using the Regedit utility is irreversible. Regedit has no Undo command. Because of this, you should be very careful when deleting keys and value entries. Windows will display a warning message prompting you to confirm your intention to delete the registry entry. After you confirm it, it will be impossible to cancel the operation.

The Copy Key Name command allows you to copy the selected key name to the clipboard. Later, you can paste the copied key name using the Paste command present in any text editor. If you remember, the registry is a hierarchical database, and the path to the registry entry you need may be very long and difficult to memorize. Because of this, many users appreciate this feature. The Copy Key Name command is easy to use in combination with other commands such as Find and Find Next; you may use it for various purposes, including registry editing and inserting key names into the text.

Commands such as Find/Find Next are used for searching registry keys and value entries. When you select the Find command from the Edit menu, the Find dialog opens, where you can describe the key, value entry, or its data (Fig. 3.9). You can search for keys, value entries or data in any combination. The values to search for can be both text and numeric.

Fig. 3.9: The Find dialog

To find the registry entry you need, enter the value to be searched into the Find what field. You can also restrict the search range by selecting one of the following options listed in the Look at group:

• Keys. The function will only search for registry keys. Both root and nested keys will be found.

• Values. The function will only search for value names that are displayed in the right pane of the Registry Editor window (in the Name column).

• Data. The function will only search for data.

The Find dialog contains the Match whole string only option. When this option is set, Registry Editor will only find whole strings, excluding partial hits from the search range.

For example, if you've installed a number of applications with names including the "Paint" string (for example, Microsoft Paint, PaintShop Pro, etc.), Regedit will find them all. However, if you only need to find entries related to Microsoft Paint, then use the Match whole string only option. If you need to find all the entries that contain the "Paint" string, clear the checkbox if it's set. This feature is useful if you don't remember the exact spelling of the string you're searching for, and need to find all possible variations.

Using the Match whole string only option increases the time required to perform the search. This can be significant if the registry is large.

To start the search procedure, fill in all the required fields in the Find dialog and click the Find Next button.

When Regedit finds the matching item, it will highlight it, thus helping to determine the key or subkey where the matching item resides. If Regedit finds the data or value names, it will open the associated registry keys in the left pane and highlight the value name. However, it still may be difficult to determine the registry path to the item just found. Because of this, you should use the status bar, since it displays the path to the highlighted registry entry, including all parent keys and the name of the computer (as you know, the computer name won't necessarily be the name of the local system).

You've finally found the registry entry. But is it the entry you really need? If it is, you may edit this item and finish the search procedure; otherwise, ignore the result and continue searching. To find the next match, press <F3> or select the Find Next command from the Edit menu.

Note 

When searching the registry, remember that the names of the keys and value entries may not be unique. The same name may be encountered many times. Because of this, the more information you provide for the search function, the more correct your result will be. For example, the "inbox" string is encountered about 10 times.

Finally, the Permissions command allowing you to manage registry key permissions and audit the actions related to the registry keys deserves special mention. Once again, it is necessary to emphasize the fact that in Windows NT/2000 this functionality was available only in Regedt32.exe, where there was the Security menu command. In Windows XP, this functionality was integrated into a single version of the registry editor—the Regedit.exe utility. Registry key permissions can be assigned independently from the file system type on the system partition.

Modifying Keys and Value Entries

Now, since we have provided a brief overview of the Edit menu commands, let us proceed with a more detailed discussion of their use for adding, modifying, or deleting registry keys and value entries, and setting registry key permissions.

Adding New Keys

To add a new key to any registry hive, select the New | Key commands from the Edit menu. The procedure is straightforward and very similar to that of creating new folders in Windows Explorer. The new key will be created without prompting the user to provide a name, but you'll be able to rename the new key after it has been created.

Adding New Value Entries

To add new registry value entries, select the New command from the Edit menu, then select the appropriate command, depending on the data type of the value entry to be created Using Windows XP version of Regedit.exe, you can create string value types (REG_SZ, REG_MULTI_SZ, and REG_EXPAND_SZ) and binary values (REG_DWORD or REG_BINARY). The new value entry will be created without prompting the user to provide a name, but you'll be able to rename and edit the value after it has been created.

Using the Binary Editor

When you select the binary value (REG_BINARY data type) and then select the Modify command from the Edit menu, Regedit exe starts the Edit Binary Value window (Fig. 3.10). Notice that you can use the binary editor to edit a value of any type by selecting the Modify Binary Data command. Enter the data into the Value data field of the Edit Binary Value window.

Fig. 3.10: The Edit Binary Value window

Editing String Values

Select the REG_SZ value in the right pane of the Registry Editor window, then select the Modify command from the Edit menu to start the String Editor. The Edit String window (Fig. 3.11) allows you to edit string values.

Fig. 3.11: The Edit String window

Editing DWORD Values

When you double-click a REG_DWORD registry value entry or highlight an entry of this type and select the Modify command from the Edit menu, the DWORD editor starts (Fig. 3.12). By default, all REG_DWORD data are displayed in hex format. However, you can also display data using decimal format by selecting the appropriate radio button from the Base group at the bottom of the window.

Fig. 3.12: The Edit DWORD Value window

Editing Multi-String Values

The Edit Multi-String window (Fig. 3.13) opens when you double-click the multi-string value or select a multi-string value and then choose the Modify command from the Edit menu. This window allows you to edit multi-string values.

Fig. 3.13: The Edit Multi-String window

Viewing Resource Lists

As was already mentioned in Chapter 1, the system registry stores all information on the hardware installed on the computer. The registry even has special data types for this purpose, namely, REG_RESOURCE_LIST, REG_FULL_RESOURCE_DESCRIPTOR, and REG_RESOURCE_REQUIREMENTS_LIST. These data types are only used in the HKEY_LOCAL_MACHINE\HARDWARE registry key. The value entries of these types are viewed in the Resource Lists (Fig. 3.14) and Resources windows (Fig. 3.15).

Fig. 3.14: The Resource Lists window

Fig. 3.15: The Resources window

Deleting Registry Keys and Value Entries

To delete a registry key or value entry, select the object you're going to delete and then select the Delete command from the Edit menu. The system will prompt you to confirm your intention to delete the selected key or value entry (Fig. 3.16).

Fig. 3.16: The system prompts you to confirm your intention to delete a registry key or value entry

Note 

Don't forget to backup the registry hives where you'll be deleting keys or value entries. Registry editors don't provide the capability of undoing this operation; after you confirm the deletion, you'll have no other means of restoring the information except by using backup copies. Furthermore, Regedt32 will prompt you to confirm deletion only if you set the Confirm On Delete option from the Options menu. As shown in Fig. 3.14, the warning message displayed by the system doesn't specify the name of the key you're going to delete. Before proceeding further, check the name of the selected key and make sure you know what you're doing.

If you delete something from the HKEY_LOCAL_MACHINE\System\CurrentControlSet, you can restore this key using the Last Known Good configuration (see Chapter 6).

The View Menu Commands

The View menu contains commands that allow you to select the method of displaying the registry. It contains the following commands:

• Status Bar

• Split

• Display Binary Data

• Refresh

The Status Bar command from the View menu allows the user to hide the status bar. The status bar is useful because it helps you navigate the registry. For this reason, I recommend that users (at least beginners) don't hide it.

The Split option moves the mouse cursor to the divider separating the left and right panes of the Registry Editor window. All you have to do is to move the mouse right or left to find a new position for the divider. After that, the only thing you need to do is to click the left (or right) mouse button.

Tip 

Resizing the Registry Editor window is similar to resizing Explorer or My Computer windows. You just need to move the mouse cursor to the divider, wait until it changes to a double arrow, click the left mouse button and drag the divider left or right. When you're done, release the mouse button.

The Display Binary Data command from the View menu, which was introduced with Windows XP, becomes available only after you select one of the value entries listed in the right pane of the Registry Editor window. It allows you to view the selected data item using one of the three formats: Byte, Word, or Dword. Notice that it doesn't allow you to edit the data (if you need to, select the value entry and choose the Modify Binary Data from the Edit menu).

Fig. 3.17: The Binary Data window

Another option of the View menu is the Refresh command. Note that when you enter changes into the registry, not all of them will be immediately displayed in the Registry Editor window. To refresh the Registry Editor window, select the Refresh command or press <F5>.

Note 

Normally, most configuration changes introduced into your Windows NT 4.0 system (including the changes to the system registry) come into force only after rebooting the system. Windows 2000 and Windows XP provide full-featured Plug and Play support. Windows 2000/XP requires fewer reboots than previous versions of Windows NT. However, there are certain modifications that can come into force only after rebooting the system.

The Favorites Menu

As was already mentioned, the version of Regedit included with Windows 2000/XP closely resembles a similar application supplied with Windows 95/98 and Windows NT 4.0. However, this version of the registry editor provides many new features. One of the most useful functions introduced in Windows 2000/XP is the Favorites menu, which is now present almost everywhere The Regedit.exe utility is no exception (Fig. 3.18).

Fig. 3.18: The new version of Regedit utility contains a Favorites menu

Anyone who frequently searches and edits the registry will like this convenient feature. Using the Favorites menu, you can create a list of the registry keys you edit most frequently and thus avoid a time-consuming search procedure.

To add a registry key to the Favorites list, proceed as follows:

1. Select the registry key you want to add to the Favorites list.

2. From the Favorites menu, select the Add to Favorites command.

3. The Add to Favorites window will open (Fig. 3.19). You can accept the key name proposed by default, or enter a new name into the Favorite name field. Click OK to add the key to the Favorites list.

Fig. 3.19: The Add to Favorites dialog

Now you'll be able to navigate to this key by selecting its name from the Favorites list. If you need to delete the key from the Favorites list, select the Remove Favorite command from the Favorites menu. Select the key you need to delete from this list and click OK.