Some of the main topics in this chapter are
Knowledge is power. Windows' reliance on the Registry and the Registry's volatility is precisely why you need to educate yourself about this little understood part of Windows. If I've learned anything over the last year, it's that you can't avoid the Registry. No way. For example, many of the solutions you find in Microsoft's Knowledge Base require that you change the Registry.
This chapter gets you off and running with the information you need to work safely with the Registry. This chapter introduces you to basic information about backing up the Registry. It also shows you how to make a plan so that you can safely make any change you want and easily recover if something terrible goes wrong like the Registry database becoming corrupted.
Windows NT 4.0 doesn't neatly store the contents of the Registry in two files, as Windows 95 does. NT stores them in files that represent hives, each of which represents a portion of the Registry that starts at the very top of the hierarchy.
Windows NT stores hives that are specific to the computer on which you installed it in C:\WINNT\SYSTEM32\CONFIG (see Figure 41.1). Windows NT stores each hive in a file without an extension. Thus, a hive called Sam is stored in a file called SAM. Each hive has two other types of files associated with it: SAV and LOG. A hive's SAV file (such as SAM.SAV) is a backup copy of the hive that Windows NT creates when it successfully starts. A hive's LOG file (such as SAM.LOG) records each and every change that Windows NT makes to that hive.
Windows NT 4.0 stores user-specific configuration in a different location. NT stores each user's configuration data in a profile folder under C:\WINNT\PROFILES\USERNAME, where USERNAME is the logon name of the user. Windows NT calls the file NTUSER.DAT. For example, C:\WINNT\PROFILES\JERRY\NTUSER.DAT contains the hive for my configuration data.
The number and names of files you see in C:\WINNT\SYSTEM32\CONFIG might be slightly different.
Also notice that Windows NT creates folders called Administrator, All Users, and Default User in C:\WINNT\PROFILES. Administrator is for you know who: the big guy. All Users contains settings that every user inherits, whereas Default User contains settings that apply to users who log on to Windows NT without a profile.
Windows NT 4.0 backs up the Registry each time it successfully starts. It copies each hive into a SAV file. Then it logs each change to that hive in the corresponding LOG file. If anything bad happens while you're starting Windows NT, it can easily reconstruct the hive from its SAV and LOG files for each hive.
NOTE: Windows NT 4.0 handles the System hive differently from the other hives. NT can't reconstruct that hive from the SAV and LOG files while starting. Thus, Windows NT stores each change in both SYSTEM and SYSTEM.ALT so that it can quickly copy SYSTEM.ALT over SYSTEM if it needs to.
You can't just copy the Registry's files elsewhere because NT protects the hives. You can't export and import the Registry, either, because Windows NT's Registry Editor can't replace keys that are open by the system or another program.
Update the Repair Information FrequentlyThe Repair Disk Utility that comes with Windows NT 4.0 updates the repair information stored on your hard drive in C:\WINNT\REPAIR. It also creates a repair disk that you can use to restore your Windows NT configuration in the event of catastrophic failure (that is, it "doesn't work"). Note that this utility only makes it possible to recover a bootable system if something terrible happens to your configuration. Microsoft recommends that you don't rely on this tool as a means of backing up your configuration or your system.
To run the Repair Disk Utility, choose Run from the Start menu, type RDISK, and click OK. Then click one of the buttons described here
Update Repair Info Update Repair Info This button updates the repair information stored in C:\WINNT\REPAIR and, optionally, creates a new repair disk from that information. Create Repair Disk This option creates a new repair disk from the information currently stored in C:\WINNT\REPAIR.
Because Windows NT is very persnickety about security, you can't just copy the Registry files around all willy-nilly (you'll get a sharing violation). You have to boot into another operating system, such as MS-DOS, before you can copy those files. This works only if you're using FAT partitions, however, not NTFS partitions.
Start your computer by using an MS-DOS formatted system disk. Then copy all the files you find in C:\WINNT\SYSTEM32\CONFIG to a backup folder that you create, such as C:\WINNT\REGISTRY. Alternatively, you can use a batch file to copy the files. Remember that the Xcopy command with the /H and /R switches copies system and hidden files to the destination while overwriting read-only files. Line two of the following example copies all the profiles to the backup folder by using the /S switch to copy all subfolders, too. Here's what it looks like:
xcopy %WinDir%\System32\Config\*.* %WinDir%\Registry\*.* /H /R xcopy %WinDir%\Profiles\*.* %WinDir%\Registry\Profiles\*.* /S /H /R
Windows NT 4.0 comes with a tape backup utility that you can use as part of your regular backup strategy (see Figure 41.2). NT Setup installs it by default. Choose Programs, Administrative Tools (Common), Backup from the Start menu to run it.
Backup doesn't support all the popular tape drives on the market, so you might need to use the Windows NT backup software provided with your tape drive. If the tape drive you installed didn't come with an NT driver, contact the manufacturer for updated software.
Backup backs up your Registry only when you tell it to. Make sure that you select Backup Local Registry in the Backup Information dialog box. Likewise, make sure that you select Restore Local Registry in the Restore Information dialog box to restore an archived copy of the Registry from tape.
TIP: You can schedule backups by using the AT command.
Backup is a bit archaic. If the manufacturer of your tape drive provides backup software, you're better off using that software.
REGBACK is a utility that Microsoft provides as part of the Windows NT 4.0 Resource kit. You use it to back up individual Registry hives to a file or all open Registry hives to a folder. When you install the Windows NT Resource Kit, the setup program copies REGBACK.EXE to the installation folder. It doesn't add a shortcut to the Start menu. You can run this program from a Command prompt, however, or choose Run from the Start menu, type the REGBACK command line, and press Enter.
REGBACK has three different command lines:
Windows NT 4.0 prevents you from copying hives while NT is running. You do have a few alternatives with which to work, however, which are discussed in the following sections:
You can't copy your backup files over Windows NT 4.0's hives. You'll get a sharing violation if you try. You have to start in another operating system, such as MS-DOS or Windows 95, before you can restore those files. You can't use this method, however, if you're using NTFS.
Start your computer by using an MS-DOS formatted system floppy disk. Then copy all the files you backed up earlier into C:\WINNT\System32. You can also use the following batch file to restore your backup copies of these files. Remember that Xcopy with /H and /R copies hidden and system files while overwriting read-only files. Line two of the following example restores all the profile folders by using the /S switch to copy all subfolders. Here's what it looks like:
xcopy %WinDir%\Registry\*.* %WinDir%\System32\Config\*.* /H /R xcopy %WinDir%\Registry\Profiles\*.* %WinDir%\Profiles\*.* /S /H /R
Earlier in this chapter, you learned how to use Windows NT 4.0's tape backup utility to back up the Registry. You have to explicitly tell NT's backup utility to restore the Registry; make sure that you select Restore Local Registry in the Restore Information dialog box. Here's how to restore the Registry from a tape with NT 4.0's tape backup utility:
2. Select the tape and the files on the tape that you want to restore. (You must select at least one file to be able to restore the Registry.)
3. Choose Operations, Restore and then select Restore Local Registry. Click OK.
REGREST is a utility that Microsoft provides as part of the Windows NT 4.0 Resource kit. You use it to restore Registry hives that you backed up using REGBACK, as you learned earlier in this chapter. When you install the Windows NT Resource Kit, the setup program copies REGREST.EXE to the installation folder. It doesn't add a shortcut to the Start menu. You can run this program from a Command prompt, however, or choose Run from the Start menu, type the REGREST command line, and press Enter.
REGREST has three different command lines. The following list describes each:
This section is for those who didn't make a backup copy of the Registry. You know who you are. If all seems lost, you can try borrowing a key from another computer that is working or from another installation of Windows NT on the same computer. That is, if you know for sure which key in your Registry is damaged, you can replace that key with the same key from another computer.
Of course, there are a few cautions. You can't use a key that contains information so specific to the other computer that it has no place in your computer. HKEY_LOCAL_MACHINE\System is probably a poor candidate. However, if HKEY_LOCAL_MACHINE\Software\Classes is busted on your computer, and you're completely without a backup, you might consider borrowing that key from another computer. Just follow these steps:
2. Save that key, all its subkeys, and its value entries to a hive.
3. Open REGEDT32 on your computer.
4. Restore the hive file you created in Step 2 into the key you're replacing.
5. Close REGEDT32 and restart your computer.
NOTE: This is risky business. Before restoring the borrowed key, go ahead and make a backup copy by using one of the techniques you learned earlier in this chapter.
It's one thing to know how a parachute works; it's another thing to actually jump out of a plane. You need to know how the Registry works; but, whenever possible, you should steer clear of making changes to the Registry. In many cases, you can use a safe alternative to make the change you want.
The sections that follow describe some of the more useful alternatives that are a part of Windows. You can also use a variety of freeware and shareware programs to safely change the Registry.
Almost two-thirds of the data in the Registry is for file extensions, file associations, and so on. You can change all this Registry data by using Windows Explorer. Choose View, Options from Explorer's main menu, and click the File Types tab. You see a dialog box similar to Figure 41.3, which you can use to change the file types defined on your computer.
Windows comes with a Policy Editor (see Figure 41.4) that administrators can use to change most of the settings that interest them.
You won't see all the file associations in this list; many are flagged to be hidden to the user.
Don't reconfigure your hardware by using the Registry. You can change any useful settings by using Control Panel. You can change your network configuration by using the Network icon, for example.
If you find an interesting Registry hack that you want to try, look for a REG or INF (setup information) file that will make all the changes for you--safely. Likewise, if you're instructing someone on how to do something in the Registry, give them a REG or INF file that does it for them automatically.
See "Working with REG and INF Files" to learn how to create REG and INF files, p. 779
Windows NT Diagnostics displays numerous Registry settings in a format that's easy to understand. From the Start menu, choose Programs, Administrative Tools (Common), Windows NT Diagnostics, and you'll see a dialog box similar to Figure 41.5.
As you can see, Windows NT Diagnostics displays a lot of information, spread across several tabs:
| Tab | Description |
| Version | Information about the version of Windows NT, the serial number, and person to whom it's registered. |
| System | Information about the computer's BIOS and CPU. |
| Display | Information about the computer's video adapter, including its BIOS, resolution, scan rate, memory, chip type, and device drivers. |
| Drives | A list of the drives installed on your computer. |
| Memory | Information about the physical memory installed on your computer and the size of page file. Also contains a variety of performance information. |
| Services | Information about each program, service, or device running on your computer. |
| Resources | Information about each device installed on your computer, including its IRQ, I/O address, DMA channel, and memory range. |
| Environment | A list of each environment variable defined on your computer. |
| Network | A list that describes your access rights, workgroup, and any other machines logged on to your computer. |
You can create your own policies, too.
Fig. 41.5 You can use Windows NT Diagnostics to view and print many of your settings, but you can't use it to change settings.
Here's the part of the chapter in which you learn how to make any change you want to the Registry without risking anything--well, almost. You can safely experiment with the Registry. I've written three books on the Registry and, throughout all my endless tinkering, have only made one change that I couldn't safely recover from (I deserve an OSHA safety award or something). You can make sure that your experience with the Registry is just as good by making a plan before you strike out and start making changes. Here's a basic plan, which you can change to suit your own needs:
TIP: You wouldn't think that the Registry is in peril when you install a new program because you don't change any Registry settings yourself. Regardless, experience suggests that you should back up the Registry before you install programs with which you're unfamiliar so that you can easily recover from a wayward Setup program's faux pas.
Your Job and the RegistryThe Registry is a vital part of the network administrator's job. It's a core technology that you'll use regularly for a variety of purposes, including:
© Copyright, Macmillan Computer Publishing. All rights reserved.