Microsoft Windows Registry Tutorial

,

This is a brief tutorial for technical savvy people on Windows's Registry. This tutorial is based on Windows Vista with Service Pack 2.

First, read Wikipedia: Windows Registry.

The registry is a database that stores settings and options.

Note: The registry is not for casual user to mess with, even a backup copy of registry cannot easily restore the state before you screwed things up . I assume you are a programer or sys admin background.

Launching Registry Editor

To look at registry, launch the Registry Editor. Type 【❖ Win+r】 to launch the run dialog, then type “regedit”.

Windows Vista Regedit
The Registry Editor in Windows Vista.

Backup

Before you do anything, do a backup. In Registry Editor, click on the Computer to highlight it, then pull menu 〖File ▸ Export〗. Give it a name like registry_20091025.reg, so you know the date it is backed up. This might take a minute or two. On my machine, the saved file size is 458 megabytes.

Data Structure

Registry data are called key and value pairs. The “key” is like folders. Key can contain other keys. The “value” is like files. A key can contain many other keys and values.

Windows Registry Environment
The “Environment” is a key. It contains several values.

At the root level, there are the following keys. (Note: the “Computer” shown in Registry Edit root is not a key.)

NameAbbreviation
HKEY_CLASSES_ROOTHKCR
HKEY_CURRENT_USERHKCU
HKEY_LOCAL_MACHINEHKLM
HKEY_USERSHKU
HKEY_CURRENT_CONFIG

Each of the above is called a “hive”.

A “value” has several possible types. Here is a list of possible types:

Possible Types for Registry Value
Type NameExplanation
REG_NONENo type
REG_SZstring
REG_EXPAND_SZexpandable string. Values between % char are expanded as environment variables
REG_BINARYBinary data
REG_DWORD/REG_DWORD_LITTLE_ENDIANA integer, ranging from 0 to 2^32-1, with byte order being little-endian.
REG_DWORD_BIG_ENDIANA integer, ranging from 0 to 2^32-1, with byte order being big-endian
REG_LINKsymbolic link (char set in UNICODE)
REG_MULTI_SZA is a array of strings
REG_RESOURCE_LISTResource list
REG_FULL_RESOURCE_DESCRIPTORResource descriptor
REG_RESOURCE_REQUIREMENTS_LISTResource Requirements List
REG_QWORD/REG_QWORD_LITTLE_ENDIANA QWORD value, a 64-bit integer (either big- or little-endian, or unspecified) (Introduced in Windows 2000)

References

blog comments powered by Disqus