Registry Contents

What's in the Registry, anyway? There's a lot to it; many entire books have been written about it. If you want a full-blown guide to the Windows XP Registry, you might look for Microsoft's Windows XP Resource Kit, or check your local bookstore for other weighty tomes. Short of that (way short) I can still do a quick overview of the Registry to give you some idea of its organization and contents.

You just learned about the five main sections of the Registry. Let's go through them one by one now, and hit on some of each section's highlights.

HKEY_LOCAL_MACHINE

As you might expect, HKEY_LOCAL_MACHINE contains information specific to your computer, settings that aren't user-specific. They include hardware settings and software information that is global for all users.

The main keys in HKEY_LOCAL_MACHINE are shown in Table 32.1.

Table 32.1. Main Keys in HKEY_LOCAL_MACHINE

HARDWARE	Contains information about the computer's hardware platform and Plug and Play devices, discovered afresh each time the system is booted. No configurable settings are located here.
SAM and SECURITY	Contain the Windows Security Account Manager databases. These keys always appear to be empty because only Windows itself is allowed to read or edit the information.
SOFTWARE	Contains system-wide software settings for applications and Windows itself. This key contains many subkeys. The Classes subkey is special and is given its own virtual view as HKEY_CLASSES_ROOT. The other entries are generally named after software manufacturers. I'll describe some of the more interesting keys in a moment.
SYSTEM	Contains a series of numbered ControlSet entries, each of which contains the settings for hardware and system services. One of them is chosen as the CurrentControlSet subkey. As you install or remove hardware, Windows rotates through the ControlSet entries, using one as the "current control set." This way, it can keep previous versions to use as a backup.

The fun bits are in the SOFTWARE keys under HKEY_LOCAL_MACHINE. Under SOFTWARE is the special Classes subkey, which I'll describe in the HKEY_CLASSES_ROOT section of this chapter. Also, there are subkeys named after software manufacturers that contain systemwide settings for these companies' various programs.

Under Microsoft, naturally, is a slew of subkeys for the software systems provided with Windows and for any add-ons you've purchased, such as Office. You'll have more than 100 subkeys in HKEY_LOCAL_MACHINE\Software\Microsoft just after installation and more when you start adding your own software.

Most of the juicy settings that control Windows itself are found in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion.

I'll discuss just one of these juicy keys. When you log in to your computer, you know that Windows can start up some programs automatically. You can actually set a program to be started up at login in any of five ways:

• A shortcut in the Startup folder of your Start menu (in \Documents and Settings\yourloginname\Start Menu\Programs\Startup)

• A shortcut in \Documents and Settings\All Users\Start Menu\Programs\Startup

• A key named Run, RunOnce, or RunOnceEx in \HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion

• A key named Run, RunOnce, or RunOnceEx in \HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion

• A run= or load= entry in WIN.INI in the Windows directory (usually \windows or \winnt. Yes, WIN.INI is still around from the Windows 3.1 days, because some older programs count on it being there.)

NOTE

To maintain compatibility with older 16-bit Windows software (and even some new software that should know better), the original Windows SYSTEM.INI and WIN.INI files still exist, and Windows XP keeps a few of their entries up-to-date with information copied from the Registry. This lets older software that really depends on the old INI file system still function. It's too bad that this old stuff is still around, but compatibility has turned out to be more important than neatness.

The Run keys are often set by software manufacturers who want their software to run automatically when you log on. Sometimes this is a good thingas when Windows uses it to start the taskbar program. But this technique is sometimes used to install annoying programs you really don't want to run. If the programs don't have configuration or preference settings that will disable the run-on-logon behavior, you can delete their value entries under these keys.

The RunOnce and RunOnceEx keys are used mostly by installation programs that need to complete their work after you restart your computer. Windows normally deletes these entries after you've logged in once and these programs have run, but they are sometimes not properly removed.

If you're plagued by unwanted or buggy programs when you log in, see "Tracking Down Errant Startup Programs" in the "Troubleshooting" section at the end of this chapter.

HKEY_CURRENT_CONFIG

HKEY_CURRENT_CONFIG is a virtual top-level key containing information Windows uses to initialize during its bootup phase, and very little else. Despite its important-sounding name, you'll find virtually nothing of interest to humans in here. The information is all set up automatically when you create Hardware Profiles.

By virtual, I mean that the keys in HKEY_CURRENT_CONFIG are really contained in other parts of the Registry, and using HKEY_CURRENT_CONFIG is just a convenient way to get at them. A curious feature of this one is that its subkeys come from several different parts of the Registry. Its System\CurrentControlSet subkey comes from one of the HKEY_LOCAL_MACHINE\SYSTEM\ControlSet### keys, and various parts of its Software subkey come from other parts of HKEY_LOCAL_MACHINE. The Registry presents the information from these various keys again under HKEY_CURRENT_CONFIG as a matter of convenience.

HKEY_CLASSES_ROOT

HKEY_CLASSES_ROOT is another of these virtual keys, provided to give programmers quick access to information from other places in the Registry. What you see under HKEY_CLASSES_ROOT are the contents of HKEY_LOCAL_MACHINE\Software\Classes, plus any additional user-specific settings stored under HKEY_CURRENT_USER\Software\Classes, whose entries add to or override the HKEY_LOCAL_MACHINE entries.

A large part of the Classes section is devoted to the associations the Explorer makes between file types (or filename extensions, like .doc) and the programs that are used to open, display, or edit them. This is the information you're editing when you change associations in the Explorer by choosing Tools, Folder Options, File Types, as discussed in Chapter 21.

These entries contain the nitty-gritty linkage information that Windows uses to locate software components based on ActiveX Controls, OLE, and the COM+ interprocess communication system. These entries are confusing, complex, and best left completely alone.

Table 32.2 gives an overview of the structure of HKEY_CLASSES_ROOT.

Table 32.2. The Structure of HKEY_CLASSES_ROOT

Entry	Description
*.* through .zip	For each listed file extension, the default value assigns a name to the file type. Each of these file type names appears later as a subkey of its own. File types that have OLE handlers have a subkey PersistentHandler, which gives a Class ID (a string of numbers like { 098f2570-b…-03f3} ). They are listed under the CLSID subkey, where the program file for the handler is named. Files that have associated programs to edit or display them may also have shell or shellx subkeys, which contain the commands Explorer uses when you attempt to open a file using a double-click. This file type/application association can also be stored under a OpenWithList key, which I'll describe under "HKEY_CURRENT_USER."
filetype	Each named file type (for example, VBScript) contains the CLSID number of the associated handler for the file type. Windows looks up this information through the CLSID subkey to find the associated program. Filetype name keys may also have shell or shellx subkeys, listing the commands used to open, edit, or print this type of file.
CLSID	Contains a subkey for each registered Active-(something) handler; the subkeys and values name the handler and point to the file containing its program code.

HKEY_USERS

HKEY_USERS contains a subkey for each authorized user of the computer and an entry named .DEFAULT. The .DEFAULT section contains just thatthe basic settings given to each new local user added to the computer. (I say local because, on a Windows 200x Server domain-based network, when a user logs in for the first time using a domain login name, his or her default Registry entries are obtained from the domain's server, not the local computer.)

The user subkeys of HKEY_USERS have long numeric names. These names are the GUID or Globally Unique User Identification numbers generated by Windows as a computer-friendly representation of the user's name. It's by these numbers that Windows tracks users, whether local or domain-based.

Nothing else is in HKEY_USERS besides these per-user subkeys. They appear as the contents of HKEY_CURRENT_USER and HKEY_CLASSES_ROOT when the associated user is logged in.

HKEY_CURRENT_USER

HKEY_CURRENT_USER contains settings, preferences, and other information specific to the currently logged-in user. This whole "section" is actually a subkey of HKEY_USERS, as discussed previously, but is provided this way as an easy way to get to the information.

The Software keys in HKEY_CURRENT_USER are similar to the Software subkeys in HKEY_LOCAL_MACHINE. They're grouped by software manufacturer, and Windows entries are stored in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion.

Windows has several ways to associate filename extensions with applications. Besides the .xxx and filetype keys under HKEY_CLASSES_ROOT, Explorer also uses HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts. This registry key holds the application associations you see when you right-click a file and see the "Open With…" choices. Have you ever noticed that Windows remembers which application you last used to open a given file type?

Take a look under this key and you'll see subkeys of the form .xxx, listing many file extensions. Under these are subkeys named OpenWithList and/or OpenWithProgids. OpenWithList has values named with the letters a, b, c, and so on, each of which has as its value the path to an application program that could be used to open the file type. The value MRUList lists the letters of the applications in the order in which they were most recently used. This is why Explorer remembers which application to offer first in the list of possible choices.