Home Computer Security
Jump to navigation
02 November
Windows registry
In computing, the Windows registry is a database which stores settings and options for the operating system for Microsoft Windows 32-bit versions. It contains information and settings for all the hardware, software, users, and preferences of the PC. Whenever a user makes changes to "Control Panel" settings, or file associations, system policies, or installed software, the changes are reflected and stored in the registry.
On Windows 9x computers, an older installation can have a very large registry that slows down the computer's startup and can make the computer unstable. This has led to frequent criticisms that the registry leads to instability. However, these problems do not usually occur on the Windows NT family of systems, including Windows XP
The Registry is split into a number of logical sections. These are generally known by the names of the definitions used to access them in the Windows API, which all begin "HKEY" (an abbreviation for "Handle to a Key"), and are often abbreviated to a 4 letter short name.
HKEY_CLASSES_ROOT (HKCR) stores information about registered applications, including associations from file extensions and OLE object class ids to the applications used to handle these items.
HKEY_CURRENT_USER (HKCU) stores settings that are specific to the currently logged in user.
HKEY_LOCAL_MACHINE (HKLM) stores settings that are general for all users on the computer.
HKEY_USERS contains subkeys corresponding to the HKEY_CURRENT_USER keys for each user registered on the machine.
HKEY_CURRENT_CONFIG contains information gathered at runtime; information stored in this key is not permanently stored on disk, but rather regenerated at boot time.
(Note that on Windows XP, all keys other than HKEY_USERS and HKLM are mirrors of other keys. For example, HKCR is a compilation of HKCU\Classes and HKLM\Classes, and HKCU mirrors the current user's subkey of HKEY_USERS.)
Each of these keys is divided into subkeys, which may contain further subkeys, and so on. Any key may contain values, which are either strings, "DWords" (numbers between 0 and roughly 4 thousand million), lists of strings, or binary data. Each key has a default value, which is in effect a value with the same name as the key. Registry keys and values are specified with a syntax similar to Windows' filenames, using backslashes to indicate levels of hierarchy. E.g. HKLM\Software\Microsoft\Windows refers to the subkey "Windows" of the subkey "Microsoft" of the subkey "Software" of the HKEY_LOCAL_MACHINE key.
The HKLM and HKCU nodes have a similar structure to each other; applications typically look up their settings by first checking for them in "HKCU\Software\Vendor's name\Application's name\Version\Setting name", and if the setting is not found looking instead in the same location under the HKLM key. When writing settings back, the reverse approach is used -- HKLM is written first, but if that cannot be written to (which is usually the case if the logged in user is not an administrator), the setting is stored in HKCU instead
posted at 05:52:31 on 11/02/05
by
admin -
Category:
Ww
Comments
Add Comments