Editing the Windows NT Registry

Sooner or later, every Windows NT administrator edits the Registry. Perhaps you want to fix a problem, improve performance, or enhance security. In many cases, the fix to your problem comes with dire warnings about the consequences of invalid changes. You wonder which is the lesser of two evils--­living with the problem, or applying the fix and possibly introducing an error into the Registry. Editing the Registry is not as risky as you might think, if you take certain precautions.

In this article, I discuss how to find and safely modify Registry settings and how to add new entries to the Registry.

What Is the Registry?
The NT Registry is a hierarchical database that stores configuration information for the OS and installed applications. The Registry's intended purpose was to reduce the number of .ini files the OS used to keep configuration details for applications. Some applications had multiple .ini files, often in several directories. A drawback of the Registry is that transferring program settings, preferences, and customization values from one computer to another is now harder than it used to be.

Registry subtrees. The Registry has a hierarchical tree structure, and the Registry's main components are known as subtrees. Each of these subtrees has a name that begins with HKEY_ (handle to a key, which is a reference that NT's developers unnecessarily left in the Registry's user interface). If you use the Windows 95 Registry editor (i.e., regedit.exe--­which also comes with NT 4.0 and later) to open the Registry, the subtrees appear as items in a hierarchical structure, as Screen 1, page 190, shows. If you use the NT Registry editor (i.e., regedt32.exe), each subtree appears in its own window, as Screen 2, page 190, shows. When you look for a Registry entry, you need to know which subtree it is in. Regedt32 looks in only the current subtree.

HKEY_CLASSES_ROOT contains data about file associations. The application-setup programs register the file extensions for each application. (For example, when you click a filename with a .doc extension, Word or WordPad starts automatically.) This subtree also contains information about component object model (COM) objects and provides backward compatibility with the Windows 3.1 Object Linking and Embedding (OLE) and Dynamic Data Exchange (DDE) functionality. This subtree is an alias or pointer for the HKEY_LOCAL_MACHINE\SOFTWARE\Classes Registry key. Use NT Explorer to edit this subtree's values. NT Explorer is more user-friendly than the Registry, and you're less likely to make errors. Open NT Explorer, and select View, Options. Then, edit the file associations from the File Types tab.

HKEY_CURRENT_USER contains information about the system's configuration for the current user. These settings include color scheme, mouse sensitivity, custom program groups, and preferences for the display of dates, times, and currency values. You might need to edit this subtree occasionally.

HKEY_LOCAL_MACHINE contains information that is specific to the computer, regardless of who is logged on. Examples of the information this subtree stores include the IP address, the interrupt the network card uses, the version of NT currently running, and common program groups. You often need to edit this subtree.

HKEY_USERS contains information about the settings for all the users who log on to a computer, including settings for the default user. HKEY_CURRENT_USER contains a pointer to the entry in HKEY_USERS for the user who is currently logged on. HKEY_USERS identifies users by security ID (SID) rather than by username. You typically don't edit values in this subtree. If you need to edit user settings, use HKEY_CURRENT_USER.

HKEY_CURRENT_CONFIG is a new subtree in NT 4.0. It provides support for hardware profiles (also a new feature in NT 4.0) and compatibility with the Win95 Registry. Win95 applications that use this subtree can also run on NT 4.0. This subtree is yet another pointer. HKEY_CURRENT_CONFIG points to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\Current Registry key.

The regedit Registry editor displays a subtree called HKEY_DYN_DATA. This Win95 subtree contains dynamic data stored and updated in RAM for fast access If you try to open this subtree in NT, you'll receive an error message.

Registry keys and values. Within each subtree are the Registry keys. The Registry keys can, in turn, contain subkeys. At the lowest level, the subkeys contain values. A value has three components: the name of the value, the type of value, and the actual assigned value.

The NT Registry supports several types of values. REG_DWORD is a numeric value, which regedt32 shows in hexadecimal (hex) notation. Regedit shows the hex value followed by the decimal equivalent in parentheses. REG_SZ is a text string. REG_EXPAND _SZ is a string that contains variables (e.g., %systemroot%). When you access the Registry key, the corresponding value (e.g., c:\winnt) replaces the variable. REG_ MULTI_SZ is a string value that can contain multiple entries. The Win98 Registry doesn't require or support entries with variables, or multiple-valued entries, so regedit doesn't support the REG_EXPAND_SZ or REG_MULTI_SZ value type. You must use regedt32 to examine or edit a Registry entry that contains a variable, or a multiple-string Registry entry.