Uncovering New Settings in the Registry

Some sources warn you that the Windows NT Registry is a dangerous force that you don't want to reckon with. Still others tell you that using the Registry to fix bugs and tweak your system's performance is OK. Microsoft seems to support both camps, but I agree with the people who promote using the Registry to your benefit. You need to explore and understand the Registry, which is the core of NT's configuration. When you start to explore the Registry with a little caution, you find that configuring NT is simple and relatively safe.

The NT Registry includes many entries that let you fix bugs in the operating system, improve NT's performance, and even customize your system to fit your needs. Once you begin to find your way around the Registry, you'll want to learn all the neat little tricks you can use. Although companies such as Microsoft and various books and magazines have documented many of the most common Registry tips and tricks, you can still find a few lesser-known fixes that are helpful in your day-to-day work. This article helps you uncover a few of these gems.

Enabling Full SAM Database Synchronization Every Time NT Starts
By default, when an NT Backup Domain Controller (BDC) starts, it doesn't attempt to synchronize the Security Accounts Manager (SAM) database with the Primary Domain Controller (PDC) until the interval (usually 5 minutes) you designate between the domain controllers expires. Even then, the BDC performs only a partial synchronization by default. You can add the value Update (data type REG_SZ) to the following Registry key to guarantee that a full synchronization occurs every time an NT 4.0 domain controller boots: HKEY_LOCAL_MACHINE\SYSTEM\Current Control Set\Services\Netlogon\Parameters. You can supply two settings, Yes and No, to this Update. A setting of Yes enables the full synchronization option, and a setting of No disables this option. NT bases its domain database synchronization process on a pull approach (i.e., the BDCs send the replication trigger to the PDC), so you need to use this value only on BDCs. You need to understand that if you perform a full synchronization on machines with very large domain databases, you could tie up the network link. This situation is especially the case across slow WAN links.

This setting is one of several that govern the automatic synchronization of the NT 4.0 SAM databases among the various domain controllers on a network. You can override these settings by either adding or adjusting entries in the same Registry key you add Update to. These entries can assist you in optimizing the domain database traffic over your network.

Solving Directory Replication Problems
If you work with NT 4.0's directory replication a lot, you might be familiar with the error message, The data is invalid. You might see this error message when you make a lot of directory and file changes. When this type of error occurs, the Registry entries associated with these changes can become corrupt. The best approach to preventing this corruption is to use the Services applet in the Control Panel to stop the Directory Replicator service on all participating computers. Next, you need to use a Registry editor on one of the participating computers to access the following Registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Replicator. Delete the Parameters, Exports, and Imports subkeys, and restart the Directory Replicator service on all the machines to solve the most likely problem­corrupted Registry entries.

Most problems associated with directory replication revolve around directories either not copying correctly or not copying at all. In NT 4.0, the import machine must read a new key in the export machine's Registry. By default, neither the Replicator Group nor the Replication User Account has permission to access this Registry key. To solve this corruption problem, use the Regedt32 Registry editor, and navigate to the following Registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg.

After you select this Registry key, go to the Security menu in Regedt32 and select Permissions. Grant Read Access to either the Replicator Group or to the Replication User Account. One of these users or groups needs to have access to this key to completely solve this problem.