Some of the main topics in this chapter are
The Registry introduces the hierarchy that Windows NT Server 4.0 needs to manage such a complex system. The Registry is the central repository for the entire software and hardware configuration in Windows (well, almost all). The Registry is much more complicated than INI files ever were, but it adds significantly more power and flexibility. The Registry also makes Windows NT Server's document-centricity possible by providing a more intimate link between documents and their applications. The list of technology that the Registry enables is endless.
Figure 42.1 shows you what the Windows Registry looks like in the Registry Editor (REGEDIT, an alternative Registry Editor). In the left pane, you see all the Registry's keys. At the right, you see all the configuration data for the selected key. You call each group of configuration data in the Registry a key. Keys are very much like sections in INI files. They have names and can contain one or more bits of configuration data. Key names can be any combination of alphabetical, numeric, and symbolic characters, as well as spaces.
A Registry key can contain other keys. That's where the Registry's hierarchy comes from. You can think of it as stuffing a bunch of file folders inside another file folder. At the top of Figure 42.1, you see My Computer. This represents the computer whose Registry you're viewing (you can view more than one). Below My Computer, you see a handful of root keys. Each root key contains a number of subkeys.
An obvious analogy is the Windows file system. If you open Windows Explorer, you see all your computer's folders in the left side of the window. In the right side of the window, you see all the files contained in the selected folder. Registry keys are very much like folders in Explorer. They contain things. They can contain other keys (folders) and they can contain configuration data (files).
Relax. You'll learn more than you ever wanted to know about the Registry Editor in the next section.
TIP: I use the terms key and subkey interchangeably. In particular, when I'm referring to a child key, or key underneath the key I'm discussing, I call it a subkey.
This leads to value entries, where Windows stores the actual configuration data. Each key can contain one or more value entries. Each value entry has three parts:
NOTE: You can't have an empty value entry. If Windows or some other program has never assigned a value to a value entry, the value entry contains the null value, indicating that it's empty. This is different from assigning an empty string to a value entry, which is a string of characters that just happens to be of zero length.
| Type | Description |
| Within REGEDIT | |
| String | Text, words, phrases. The Registry always encloses strings in quotes. |
| Binary | Binary values of unlimited size represented as hexadecimal. They're similar to DWORD values except they're not limited to four bytes. |
| DWORD | 32-bit binary values in hex format (double words). The Registry displays DWORD values as an 8-digit (four-byte) hex number. |
| Within REGEDT32 | |
| REG_BINARY | Binary values of unlimited size represented as hex. They're the same as Binary values in REGEDIT. |
| REG_DWORD | 32-bit binary values in hex format. The Windows NT Server Registry displays DWORDS as hex numbers. They're the same as DWORD values in REGEDIT. |
| REG_EXPAND_SZ | Expandable strings. These are string values that contain values that Windows NT Server will replace when used by a program (%SystemRoot%). |
| REG_MULTI_SZ | Multiple strings. These are value entries that contain a number of individual strings separated by null characters (0). |
| REG_SZ | Text, words, phrases. This is the same as the String type in REGEDIT. |
NOTE: Every key contains at least one value entry, called (Default). In this book, I just call it the default value entry for a key. The default value entry is always a string value. Windows provides a default value entry for compatibility with the Windows 3.1 Registry and older 16-bit applications. In many cases, the default value entry doesn't contain anything at all. In other cases, when a program only needs to store one value, the default value entry is the only data stored in that key.
You now understand what you'll find in the Registry--keys, subkeys, value entries. You know that value entries have a name, a type, and data. But how is this all organized in the Registry?
You'll find five root keys in the Windows NT Server 4.0 Registry. HKEY_LOCAL_MA-CHINE and HKEY_USERS are real Registry keys, and the remaining three are aliases. Look at the real keys first (you'll learn about the aliases in a moment):
HKEY_LOCAL_MACHINE Contains configuration data specific to the computer, such as the hardware configuration. The information in this key applies to all users who use the computer. HKEY_USERS Contains configuration data for each user that logs on to the computer. This includes software configuration data specific to each user.
NOTE: In this chapter, I use fully qualified path names to each Registry key. Fully qualified path names include the entire path to the key I'm discussing. For example, instead of referring to the Current User key, I'll mention the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Current User key. This will help you go directly to that particular key.
HKEY_LOCAL_MACHINE contains configuration data that describes the hardware and software installed on the computer, such as device drivers, security data, and computer-specific software settings, such as uninstall information. This information is specific to the computer itself, rather than to any one user who logs on to it.
The following sections describe the contents of HKEY_LOCAL_MACHINE.
NOTE: Windows NT Server 4.0 security prevents you from removing or changing any value in Hardware, SAM, or Security. You can only change values in Software and System.
Hardware Hardware describes the actual hardware installed in a Windows NT Server 4.0 computer. It also contains information about device drivers, such as which device drivers work with which bits of hardware and the resources (IRQ and so on) that each device uses. In Windows NT Server, this subkey is dynamically rebuilt by the recognizer each time Windows NT Server starts. Here's a list of subkeys you'll find under Hardware:
Description Contains information about the hardware database built as Windows NT Server starts. DeviceMap Contains values that indicate where the Windows Registry Windows NT Server can find more driver information about a particular bit of hardware. ResourceMap Maps each device driver to the resources the device uses, including IRQ, I/O port, I/O memory addresses, DMA channels, and so on.
SAM SAM contains security information for each user and group account, as well as domains in Windows NT Server. You normally get at this information through the User Manager or User Manager for Domains. Note that this is really an alias for HKEY_LOCAL_MACHINE\Security\SAM, described next.
NOTE: Microsoft now calls the Security Account Manager the directory services database. In this chapter, I continue to use the term SAM when referring to the directory services database only because you're probably more familiar with that term.
Security Security contains the local security policy--information about user rights, password policy, group membership, and so on. Like SAM, most of the configuration data in this subkey is specific to Windows NT Server 4.0. You see this information in User Manager or User Manager for Domains. Note that you can't browse this information by using the Registry Editor.
Software Programs store settings that are specific to the computer in Software. These programs store their settings in branches that look like HKEY_LOCAL_MACHINE\Software\CompanyName\ProductName\Version, where CompanyName is the name of the company, ProductName is the name of the product, and Version is the current version number of the product. You find many Windows-specific settings in this subkey, too. Here's what you find in each subkey under Software:
Classes Associates file types to programs installed on the computer. Also contains information about COM objects, makes context menus possible, and more. Microsoft Contains settings for Microsoft programs, including Windows. The Windows NT\CurrentVersion subkey contains interesting settings for Windows NT Server. Program Groups In Windows NT Server, this subkey records whether it has converted each former program group (remember the Program Manager?) into the new Start menu folder structure. Secure Programs store settings that should only be changed by an administrator in this subkey. Windows 3.1 Status Indicates whether Windows Migration NT Server has converted the Windows 3.1 INI files and Registry to the Windows NT Server format.
NOTE: The single largest branch in the Registry is HKEY_LOCAL_MACHINE\Software\Classes. This subkey describes all the associations between documents and programs, as well as information about COM objects, and is very large. You can also get to this branch through the root key HKEY_CLASSES_ROOT.
System Windows maintains control sets, each of which determines exactly which device drivers and services Windows loads and how it configures them when Windows starts. For example, a control set provides the various parameters Windows needs when it starts, such as the computer's name on the network and the current hardware profile. A control set also controls which device drivers and file systems Windows loads and provides the parameters Windows needs to configure each driver.
In Windows NT Server 4.0, you'll find the control sets in HKEY_LOCAL_MACHINE\System. It uses multiple control sets. Here are the subkeys you'll find under System in Windows NT Server:
Clone Contains the last known control set used to start Windows NT Server 4.0. ControlSetnnn Each control set, number 000 through 003, contains the actual configuration data Windows requires when it starts. CurrentControlSet Contains the control set that Windows is currently using. Select Contains values that determine how Windows is using the control sets such as the number of the current control set, the default control set, and so on. Setup Contains settings used by the Windows NT Server 4.0 setup program.
Under each control set, you'll find two additional subkeys:
Control Contains a variety of parameters that Windows uses to start the computer. Services Determines which device drivers and services Windows will load and how it will configure them.
TIP: When Windows NT Server 4.0 starts, you can choose the control set you want to use. For example, if your computer won't start under a particular control set, you can start with a different one. Press the Spacebar when you see the Boot Loader command prompt.
HKEY_USERS contains all the user-specific configuration data for the computer. That is, Windows stores configuration data for each user that logs on to the computer in a subkey under HKEY_USERS. The following sections describe what you'll find under each subkey under HKEY_USERS.
NOTE: Wonder where in the world the HKEY_ comes from? Microsoft uses this notation to indicate that the key is a handle used by a program. In Windows, handles uniquely identify a resource.
The AppEvents Subkey AppEvents contains associations between the sounds Windows produces and events generated by Windows and other programs. You'll find two subkeys:
EventLabels Contains a subkey for each sound event. The default value entry for each subkey is the description of the event. These subkeys don't actually define the sound generated for each event, however--that's up to Schemes\Apps. Schemes\Apps Contains a subkey for each sound event, defining the sounds associated with the event. For example, an event named AppGPFault will contain additional subkeys, one for each scheme installed in Windows. Regardless of which themes you've installed, all the subkeys under Schemes contain the .Current and .Default subkeys. .Current is the current sound associated with that event. .Default is the default sound associated with that event.
Console Console defines options used for character-based applications (CHUI, pronounced chewy, stands for Character Based User Interface). This includes settings such as window size, font, color, and so on.
Control Panel Control Panel contains settings the user can change by using Control Panel, such as Display and Accessibility Options. Many of the settings in Control Panel are migrated from the Windows 3.1 WIN.INI and CONTROL.INI files. You'll find these types of settings in this key:
| Accessibility | Contains settings from the Accessibility Control Panel applet, including StickyKeys and MouseKeys. |
| Appearance | Contains all the color schemes found in Display properties. |
| Colors | Contains all the active colors used for windows, such as the background and caption bar colors. |
| Cursors | Contains all the mouse pointer schemes found in Control Panel's Mouse applet. |
| Desktop | Contains various information about the user interface, such as screen saver settings, window sizes, and the wallpaper. |
| International | Indicates the current locale. |
| Mouse | Contains mouse settings such as the double-click rate and sensitivity. |
Environment Environment contains the values of all the user's environment variables, such as TEMP and PATH. You set environment variables in both the AUTOEXEC.BAT file and the System icon in Control Panel.
Keyboard Layout Keyboard Layout defines the language used for the current keyboard layout. You change these values in the Keyboard icon in Control Panel.
Network Windows NT Server 4.0 doesn't use Network. Preview versions of Windows NT Server stored information about persistent connections in this subkey. Windows NT Server keeps the Network subkey for compatibility purposes, but it doesn't store information about persistent connections in it. Windows NT Server now stores information about persistent connections in HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Network\Persistent Connections.
Software Software is by far the most interesting subkey in this branch. It contains software settings specific to each user. Windows stores each user's desktop preferences under this subkey. As well, each program installed on the computer installs user-specific preferences in this subkey. This subkey is organized just like the similar subkey in HKEY_LOCAL_MACHINE.
Windows 3.1 Migration Status Windows 3.1 Migration Status contains values that indicate whether Windows NT Server has converted any Windows 3.1 INI files and the program groups to the Windows NT Server format. This subkey isn't present if you didn't upgrade Windows 3.1 to Windows NT Server.
NOTE: The Registry has an order of precedence. Often, Windows or other programs will store duplicate data in both HKEY_USERS and HKEY_LOCAL_MACHINE. In these cases, the configuration data stored in HKEY_USERS has precedence over the data stored in HKEY_LOCAL_MACHINE. Windows does this so that individual user preferences will override computer-specific settings.
Even though the Registry Editor shows five root keys, there really are only two: HKEY_LOCAL_MACHINE and HKEY_USERS. The remaining root keys are just aliases that refer to branches (entire portions of the Registry beginning with a particular key) within the other two root keys. In other words, aliases are a bit like shortcuts in Explorer--if you change a value in one of the aliases, that value is actually changed in either HKEY_LOCAL_MACHINE or HKEY_USERS.
NOTE: When you export the Registry to a REG file, the file contains entries found only in HKEY_LOCAL_MACHINE and HKEY_USERS. That's because it would be redundant to export the aliases.
The HKEY_CLASSES_ROOT Alias HKEY_CLASSES_ROOT is an alias for a branch in HKEY_LOCAL_MACHINE that contains the associations between file types and programs. See "Software," earlier in this chapter.
The HKEY_CURRENT_USER Alias HKEY_CURRENT_USER is an alias for a branch in HKEY_USERS that contains the configuration data for the user currently logged on. See "HKEY_USERS," earlier in this chapter.
NOTE: In most cases, I use HKEY_CURRENT_USER to refer to the contents of any of the subkeys under HKEY_USERS. For example, when I'm discussing the general contents and organization of L[yen]EY_USERS\Subkey, I'll use HKEY_CURRENT_USER and be done with it.
The HKEY_CURRENT_CONFIG Alias HKEY_CURRENT_CONFIG is an alias for HKEY_LOCAL_MACHINE\Config\Profile, where Profile is one of 0001, 0002, and so on. It contains the current hardware configuration for the computer. See the section "The HKEY_LOCAL_MACHINE Key," earlier in this chapter, for more information.
Abbreviations for Root Keys
You'll frequently see abbreviations for the root keys used in many publications (although not this one). Here are the abbreviations used for each root key:
Abbreviation Root Key HKCR HKEY_CLASSES_ROOT HKCU HKEY_CURRENT_USER HKLM HKEY_LOCAL_MACHINE HKU HKEY_USERS HKCC HKEY_CURRENT_CONFIG HKDD HKEY_DYN_DATA (in Windows 95)
Windows NT Server 4.0 uses hives. Hives are branches that start at the top of the Windows NT Server Registry hierarchy. A hive is persistent. That is, it's stored permanently on disk and isn't created dynamically. Each subkey under HKEY_LOCAL_MACHINE, except for Hardware and HKEY_USERS, is a hive. Hardware isn't a hive because Windows NT Server builds it dynamically as Windows NT Server starts. The following two sections describe both groups of hives individually.
Windows NT Server stores each hive for HKEY_LOCAL_MACHINE in its own set of binary files. You find four types of files in C:\WINNT\System32\Config. Table 42.2 describes them.
| Extension | Description |
| None | Contains a current copy of a hive |
| .alt | Contains a backup copy of a hive |
| .log | Contains a log of all changes to a hive |
| .sav | Contains a backup copy of the hive at the end of the text-mode portion of setup |
Figure 42.2 shows the relationship between the Registry's hives in the Registry Editor and the files in which they're stored in Windows NT Server Explorer.
Each hive has a corresponding hive file, SAV file, and LOG file in C:\WINNT\System32\Config.
Table 42.3 relates each hive to its binary files. HKEY_LOCAL_MACHINE\Hardware isn't in this table because Windows NT Server 4.0 rebuilds it every time Windows NT Server starts. It's dynamic. Each hive is stored in a file that doesn't have a file extension. Windows NT Server makes a backup copy of each have into a SAV file after the text mode portion of setup. Windows NT Server also logs each change to a hive in a corresponding LOG file. If anything bad happens while you're starting your computer, Windows NT Server can easily reconstruct the hive from the SAV and LOG files for each hive.
| Hive | Hive | ALT | LOG | SAV |
| SAM | Sam | Sam.log | Sam.sav | |
| Security | Security | Security.log | Security.sav | |
| Software | Software | Software.log | Software.sav | |
| System | System | System.alt | System.log | System.sav |
The System hive is special. Windows NT Server 4.0 can't reconstruct the System hive from the SAV and LOG files while starting. Thus, Windows NT Server stores each change in both System and System.alt so it can quickly copy System.alt over System if it needs to. System.alt isn't a log file like System.log; it's a duplicate copy of System.
Windows NT Server 4.0 doesn't store the HKEY_USERS hives in the same place as the HKEY_LOCAL_MACHINE hives. Each user's hive is stored in his own profile folder under C:\WINNT\PROFILES\USERNAME, where USERNAME is the logon name of the user. The file is named NTUSER.DAT. For example, C:\WINNT\PROFILES\JERRY\NTUSER.DAT contains the hive for my configuration data. Windows NT Server also logs changes to NTUSER.DAT in NTUSER.DAT.LOG.
NOTE: When a period (.) appears twice in a filename, as in NTUSER.DAT.LOG, the last portion of the name is the extension. The first period is actually part of the base filename. Thus, NTUSER.DAT.LOG is a file called NTUSER.DAT whose file extension is .LOG. Don't let this throw you when viewing a profile folder in Windows NT Server. You'll see two files that appear to be named NTUSER.DAT.
Figure 42.3 shows the relationship between the Registry's user hives in the Registry Editor and the files in which they're stored in Windows NT Explorer.
Default User is the profile that Windows NT Server 4.0 uses for all users who log on without a profile.
HKEY_USERS\.DEFAULT is an exception to this rule. This is the system default profile. When Windows NT Server 4.0 is running without any users logged on, you see the infamous Ctrl+Alt+Del logon window bouncing around the screen. The system default profile controls all aspects of this screen, including its color and wallpaper. Windows NT Server doesn't store HKEY_USERS\.DEFAULT in C:\WINNT\PROFILES and doesn't name its hive file NTUSER.DAT. Instead, Windows NT Server stores the default system profile in C:\WINNT\System32\config and names the hive file DEFAULT. Windows NT Server names the LOG and SAV files DEFAULT.LOG and DEFAULT.SAV, respectively.
NOTE: In C:\WINNT\SYSTEM32\CONFIG you'll find two interesting files named USERDIFF and USERDIFF.LOG. These are hive-type files that aren't actually loaded into the Registry. Windows NT Server uses these files to upgrade any user from a previous version of Windows NT to Windows NT 4.0 the first time they log on to the computer.
© Copyright, Macmillan Computer Publishing. All rights reserved.