Windows: Registry Tutorial

By Xah Lee. Date: . Last updated: .

The registry is a database that stores lots software configuration data, many are used by Microsoft Windows operating system itself.

WARNING: some mistakes in editing registry can make part of your Windows not work properly. Be careful.

Launching Registry Editor

❖ Window+r, then type regedit

or Start PowerShell, then paste this: C:\Windows\regedit.exe

Windows 10 regedit 2021-02-04
Windows 10 regedit 2021-02-04

Backup

Before you do anything, do a backup. In Registry Editor, use the menu [File ▸ Export] to make a backup. Save the backup as registry_backup.reg. As of 2021-06-08, on my machine, it takes 20 seconds and the saved file size is 380 megabytes.

Data Structure

Registry data are key and value pairs. The key is like folders. Key can contain other keys.

At the root level, there are the following keys.

NameAbbreviation
HKEY_CLASSES_ROOTHKCR
HKEY_CURRENT_USERHKCU
HKEY_LOCAL_MACHINEHKLM
HKEY_USERSHKU
HKEY_CURRENT_CONFIG

Each of the above is called a hive.

A “value” has several possible types. Here is a list of possible types:

Possible Types for Registry Value
Type NameExplanation
REG_NONENo type
REG_SZstring
REG_EXPAND_SZexpandable string. Values between % char are expanded as Environment Variables
REG_BINARYBinary data
REG_DWORD/REG_DWORD_LITTLE_ENDIANA integer, ranging from 0 to 2^32-1, with byte order being little-endian.
REG_DWORD_BIG_ENDIANA integer, ranging from 0 to 2^32-1, with byte order being big-endian
REG_LINKsymbolic link (char set in UNICODE)
REG_MULTI_SZA is a array of strings
REG_RESOURCE_LISTResource list
REG_FULL_RESOURCE_DESCRIPTORResource descriptor
REG_RESOURCE_REQUIREMENTS_LISTResource Requirements List
REG_QWORD/REG_QWORD_LITTLE_ENDIANA QWORD value, a 64-bit integer (either big- or little-endian, or unspecified) (Introduced in Windows 2000)

Using PowerShell to View/Edit Registry

PowerShell: Windows Registry