Mastering Windows XP Registry Peter Hipson Associate Publisher: Joel Fugazzotto Acquisitions and Developmental Editor: Ellen L. Dendy Editor: Anamary Ehlen Production Editor: Elizabeth Campbell Technical Editor: Donald Fuller Electronic Publishing Specialist: Maureen Forys, Happenstance Type-O-Rama Proofreaders: Nanette Duffy, Emily Hsuan, Laurie O'Connell, Yariv Rabinovitch, Nancy Riddiough Book Designer: Maureen Forys, Happenstance Type-O-Rama Indexer: Ted Laux Cover Designer: Design Site Cover Illustrator: Sergie Loobkoff Copyright © 2002 SYBEX Inc., 1151 Marina Village Parkway, Alameda, CA 94501. World rights reserved. The author(s) created reusable code in this publication expressly for reuse by readers. Sybex grants readers limited permission to reuse the code found in this publication or its accompanying CD-ROM so long as the author is attributed in any application containing the reusable code and the code itself is never distributed, posted online by electronic transmission, sold, or commercially exploited as a stand-alone product. Aside from this specific exception concerning reusable code, no part of this publication may be stored in a retrieval system, transmitted, or reproduced in any way, including but not limited to photocopy, photograph, magnetic, or other record, without the prior agreement and written permission of the publisher. First edition copyright © 2000 SYBEX Inc. Library of Congress Card Number: 2002100057 ISBN: 0-7821-2987-0 SYBEX and the SYBEX logo are either registered trademarks or trademarks of SYBEX Inc. in the United States and/or other countries. Mastering is a trademark of SYBEX Inc. Screen reproductions produced with FullShot 99. FullShot 99 © 1991-1999 Inbit Incorporated. All rights reserved.FullShot is a trademark of Inbit Incorporated. TRADEMARKS: SYBEX has attempted throughout this book to distinguish proprietary trademarks from descriptive terms by following the capitalization style used by the manufacturer. The author and publisher have made their best efforts to prepare this book, and the content is based upon final release software whenever possible. Portions of the manuscript may be based upon pre-release versions supplied by software manufacturer(s). The author and the publisher make no representation or warranties of any kind with regard to the completeness or accuracy of the contents herein and accept no liability of any kind including but not limited to performance, merchantability, fitness for any particular purpose, or any losses or damages of any kind caused or alleged to be caused directly or indirectly from this book. This book is dedicated to my students at FPC. Perhaps the hardest part of their education is putting up with me. I expect a lot, and they give it. Acknowledgments An acknowledgments section is always hard to write; there are just so many people who have helped. An author's greatest fear is forgetting someone, so I always start off by saying thanks to everyone. If I didn't list you, please don't hate me! Thanks go to Ellen Dendy, of course, who served as acquisitions and developmental editor for this book. Ellen Dendy also helped greatly by providing critical direction whenever needed. (Of course, if you don't like this book, the blame falls on me and only me!) Thanks to the Sybex editorial staff, especially Anamary. Thanks also to Elizabeth Campbell, production editor, for her skillful work and management; to Maureen Forys, electronic publishing specialist, for her expert and speedy layout skills; and to Nanette Duffy, Emily Hsuan, Laurie O'Connell, Yariv Rabinovitch, and Nancy Riddiough, proofreaders, for their proficient proofreading of the pages. Don Fuller served well as our technical editor. It was Don's job to make sure that I told no lies, made no mistakes. Jerold Schulman (JSI, Inc.) maintains the web page at http://www.jsiinc.com/reghack.htm. He provided a lot of expert hints for this book. If you need assistance with your Windows XP installation, check out Jerold's web pages for his tips, tricks, and registry hacks. Special thanks to Laura Belt at Adler & Robin Books. Laura is the person who makes this a business and not a hobby. Thanks to Barry and Marcia Press for their input on the book's contents. Barry asked for a number of things to be covered, and I've covered as many as I could. Thanks to the ExpertZone (and my team members who put up with my slow responses), and everyone at Microsoft who helped, too. Of course, I would be remiss if I didn't thank my family, especially my wife, Nang, who has supported me through thick and thin, and the folks at CMC and MCH who made sure that I survived the experience. This book is dedicated to my students at FPC. Perhaps the hardest part of their education is putting up with me. I expect a lot, and give it. Introduction The registry has evoked emotions from terror to mystery. Few Windows XP users consider the registry their friend. After all, think of it: The registry is the heart and soul of the Windows XP operating system. The registry is everything-it is the brain of the operating system. Damage the registry, and Windows XP quickly develops brain damage and needs major surgery. This is it-the only book on the Windows XP registry that you will need. Now, I won't kid you; there are a few other books on the Windows registry. Every current version of Windows uses a similar registry structure, but we do find that there are sufficient differences between them make it difficult for one book to cover everything well. Will you need another book or tool besides this book? Maybe not. But I do recommend that you get Microsoft's Windows XP Resource Kit, too; it has a lot of good utilities that you will find invaluable. The Windows XP Resource Kit also has a lot of good non-registry stuff. This book covers the Windows XP registry from A to Z. I've covered the standard stuff, from things that most of us should know to things that are not documented at all and are probably only known by a very few first-rate system administrators. Who Is This Book For? This book is valuable to all Windows XP users. Even users of Windows NT 4 and 2000 and Windows 95/98/Me may find good information in this book, though it is primarily oriented toward Windows XP. This book is intended for: • General users who use Windows XP at their desks and are responsible for their own computer(s). Typically, these users don't have responsibility for other users' computers, though they may help their friends out from time to time. • System administrators who are responsible for an organization's computers (and perhaps thousands of Windows XP installations). Administrators will be presented with virtually every conceivable problem over a given period of time. Whatever can go wrong will; Murphy's Law is applied double to system administrators. • Help desk staff who support users, even if they don't usually administer the system. Help desk staff roam throughout the organization, providing help and assistance as needed. All help desk people are going to find this book very useful. If you are a user who wants to get the most out of your Windows XP installation (either Home Edition, Professional, or one of the upcoming .NET Server versions), this book is a very good starting point. Think of it this way: If you are a system administrator, this book is one of the tools that you will need to manage and administer your Windows XP network. Manning the help desk? If so, having this book close at hand can save you lots of time and effort. Overview of the Contents This book is made up of four major sections. Part I: Registry Basics In Part I, "Registry Basics," I discuss ways to avoid problems, do backups, and restore the registry, and I cover some of the tools that are used with the registry. The first chapter, "What Is a Registry—and Why?," introduces the registry. You'll learn about the registry's major sections, called hives. This chapter also tells you about the registry's history. Tip The fastest way to access the registry is to use RegEdit.exe, which comes with Windows XP. To access RegEdit.exe, simply click the Start button, then click Run. Type RegEdit in the dialog box and press Enter. The RegEdit window will appear. Chapter 2 is called "Readme.1st: Preventing Disaster!" It jumps right into one of the most important topics in this book: how to avoid getting into trouble. Most Windows XP disasters are registry related, and they are also preventable. Registry problems often arise because we don't have a good backup of the registry, and something comes along and damages it. Once damaged, the registry can be very difficult to recover. Chapter 3, "Anatomy of the Registry: The Blood, Gore, and Guts," is an in-depth analysis of what's in the registry. Each major hive is covered in detail. We'll discuss the way the hives relate to each other, along with how Windows XP manages users in the registry. Tools, tools, and more tools. Chapter 4, "Registry Tools and Tips: Getting the Work Done," takes a close look at the registry tools that are included with Windows XP. The Registry Editor is covered, as well as the Backup utility and the registry software that is included in the Windows XP Resource Kit. In Chapter 5 , "Policies: Good for One, Good for All," you learn all about policies in Windows XP. Policies affect specific computers, users, and groups. Part II: Advanced Registry Stuff In this second part of the book, I cover OLE (Object Linking and Embedding), some history of the win.ini and system.ini files, how to remove excess baggage from the registry, registry programming interfaces, and the Performance Monitor entries. Getting into the advanced stuff, we jump right into the issues of OLE, associations, and such. Chapter 6 is called "Associations, Linkages, and OLE: How Confusing Can This Get?" It tries to clear the often muddy water that swirls around the OLE registry components. A major part of the registry is OLE related, with Windows XP using OLE to manage much of the user interface. Even though the System.ini and Win.ini files have not been used for some time, we still have them. Chapter 7 is called "Why, Oh Why, Are There System.ini and Win.ini Files?" Here we delve into why these two files are still found under Windows and what makes them necessary. If you want to get rid of that memo from your boss telling you that your project is due, you toss it into the trash can. Something in the registry that is not needed can be more difficult to get rid of. Chapter 8, "Getting Rid of the Unwanted," introduces the problem of registry clutter and describes some very useful tools to clean up this excess. By following the advice in Chapter 9, "Recovering from Disaster, or Making the Best of a Bad Situation," you can make sure that disaster doesn't strike. However, sometimes disaster just happens. Recovery, whether from backups or from manually cleaning the registry, is vital. My name's Peter, and I'm a programmer. Ah, there, I said it, and I feel much better. I felt even better after writing Chapter 10, "Programming and the Registry: A Developer's Paradise?" This is where the programming interface to the registry is unveiled. Examples in C/C++ and a lot of information about Microsoft's MFC registry interface come to light in this chapter. The Windows XP Performance Monitor allows analysis of the system's performance and the development of performance-enhancement strategies. In Chapter 11, "The Performance Monitor Meets the Registry," you begin to understand how the Windows XP Performance Monitor interacts with the registry and how you can add performance-monitoring technologies to your own applications. Part III: Windows and Office Registry Entries In Part III, I discuss the UI (user interface), networking, and internal Windows XP entries. What we see as users is all stored in the registry. Chapter 12, "The Windows XP User Interface: Changing How It Looks," delves into the various registry entries that control the look and feel of Windows XP. This chapter covers both the graphical Desktop and the Windows command windows. Under the hood of Windows XP are entries in the registry for both networking and other internal Windows XP components. Chapter 13, "Networking and Registry System Entries," digs into these less visible entries in the registry and explains them to you. Chapter 14, "Microsoft Office Entries," covers changes that Microsoft Office has made to the registry. Sometimes Microsoft Office components are installed and then removed. Sadly, not all registry entries for these products are removed. How do you get them out of there? Also, how do you create a configuration so those new users of Microsoft Office will get a predefined configuration? Care to program the registry using Visual Basic for Applications? (It's easy, really.) Check this chapter for the answers to these questions. Part IV: The Registry Interface Part IV is a reference to many of the registry entries, arranged by hive. Program associations, OLE associations, and file-type management are all part of HKEY_CLASSES_ROOT. Chapter 15, "Introduction to HKEY_CLASSES_ROOT," covers this hive's contents. User information that is stored in HKEY_USERS and used in HKEY_CURRENT_USER is the subject of Chapter 16, "Introduction to HKEY_CURRENT_USER and HKEY_USERS." Windows XP keeps only the currently logged-on user and the .DEFAULT user in HKEY_USERS; other users are saved in HKEY_LOCAL_MACHINE's SAM (Security Accounts Manager) sections. HKEY_LOCAL_MACHINE is the hive that controls the system itself. This topic is so large that three chapters are dedicated to it. Chapter 17, "Introduction to HKEY_LOCAL_MACHINE," covers the major parts of HKEY_LOCAL_MACHINE. Information about installed software is found in Chapter 18, "Introduction to HKEY_LOCAL_ MACHINE\Software." Virtually every installed application or component is found in HKEY_LOCAL_MACHINE\Software. The system configuration is covered in Chapter 19, "Introduction to HKEY_LOCAL_MACHINE\System and HKEY_CURRENT_CONFIG." System entries are critical to the health and welfare of Windows XP. Typesetting Conventions This book is typeset so that it is readable. Otherwise the pages would all be blank. OK, seriously. This book uses various conventions to present information. Notes, Tips, and Warnings, shown below, appear throughout the text in order to call attention to special details. N ote This is a Note. Notes contain additional comments and information related to the discussion. Tip This is a Tip. Tips highlight important information that you need to know when working with the registry. Warning This is a Warning. Warnings call attention to trouble spots and things to watch out for. Speaking of which, have you backed up your registry lately? This book also takes advantage of different font styles. Bold font in the text indicates something that the user types. A monospaced font is used for registry objects, program strings, entries, commands, and URLs. To Contact the Author If you so desire, you may contact me, the author, via e-mail. My e-mail address is phipson@acm.org . Please do not attempt to telephone, even if you find my phone number; my schedule really doesn't allow for answering the phone! Sybex Technical Support If you have questions or comments about this book or other Sybex books, you can contact Sybex directly. The following contact information for Sybex is listed in order of preference from the most preferred method to contact Sybex (e-mail) to the least preferred method (snail mail). For the Fastest Reply E-mail us or visit the Sybex website! You can contact Sybex through the Web by visiting http://www.sybex.com and clicking Support. You may find the answer you're looking for on this site in the FAQ file, so check there too. When you reach the support page, click Support@sybex.com to send Sybex an e-mail. You can also e-mail Sybex directly at Support@sybex.com. It's important that you include all the following information to expedite a reply: Name The complete title of the book in question. ISBN number The ISBN that appears on the back cover of the book. This number appears at the bottom right corner on the back cover and looks like this: 0-7821-2987-0 Printing The printing of the book. You can find this near the front of the book at the bottom of the copyright page. You should see a line of numbers as in the following: 10 9 8 7 6 5 4 3 2 The lowest number in this line of numbers is the printing. The example here indicates that the book is from the second printing. The ISBN number and printing are very important for technical support, because they indicate the edition and reprint you have in your hands. Many changes occur between printings and editions. Don't forget to include this information! Page number or filename Include the page number where you have a problem. PC details Include the following information: • Name of your PC (the manufacturer) • Operating system being used • The software you have installed that relates to the book (indicate the exact version number) • Whether your machine has any unique characteristics Sybex technical support will try to answer your question quickly and accurately. Other Ways to Reach Sybex The slowest way to contact Sybex is through the mail. If you do not have access to the Internet or a telephone, write Sybex a note and send it to the following address: SYBEX Inc. Attention: Technical Support 1151 Marina Village Parkway Alameda, CA 94501 Part I: Registry Basics Chapter List Chapter 1: What Is a Registry and Why? Chapter 2: Readme.1st: Preventing Disaster! Chapter 3: Anatomy of the Registry–The Blood, Gore, and Guts Chapter 4: Registry Tools and Tips–Getting the Work Done Chapter 5: Policies–Good for One, Good for All Part Overview In this section, you will learn how to: • Understand the development and organization of the registry • Prevent registry disasters before they strike • Interpret the anatomy and configuration of the registry • Use registry tools and other resources • Apply policies to individuals and groups Chapter 1: What Is a Registry and Why? Overview Some users of Windows know exactly what the registry is a system designed to cause users and administrators to lose their hair. I know this is true because I can no longer feel the wind ruffling through my hair. Oh, I feel the wind; I just don't feel the hair. The registry is a simple, hierarchical database of information that Windows operating systems (and some applications) use to define the configuration of the system. Originally, in the early, simple days of Windows (16-bit Windows versions especially), the same information that is now stored in the registry was stored in text files. Though these text files were simple, their organization made access to the information they contained too slow to keep up with increasingly speedy technology. Many applications use the registry the same way, though some applications are now moving to separate storage locations for their data—a technique that allows the applications to easily back up and restore their configuration data. The Registry: Past and Present The development of the registry, like Windows, has been evolutionary. The registry was preceded by a pair of flat-text files, called win.ini and system.ini. While the performance with these files left something to be desired, they formed the basis for today's registry. In fact, these two files live on today in Windows XP, though they are virtually unchanged from Windows NT version 4. The first registry to appear in Windows was created to solve a number of problems: poor performance (retrieving information from the original flat-text .ini files was cumbersome), size limitations (the .ini files could be only so large), and maintenance problems (the .ini files were organizationally impaired!). Today, the Windows XP system .ini files contain only a few entries used by a few applications. (Most are legacy 16-bit applications, though a few new programs are also placing some items in the win.ini file, too!) These system .ini files are of no importance to us, and we may safely ignore them. For Windows XP, it's the registry that is most important to the system, because it contains the heart and soul of Windows XP. Without the registry, Windows XP would be nothing more than a collection of programs, unable to perform even the basic tasks that we expect from an operating system. Every bit of configuration information that Windows XP has is crammed into the registry. Information about the system's hardware, preferences, security, and users— everything that can be set is set in there. However, times are a-changing. Microsoft now realizes that if every application stores application-specific information in the system registry, then the system registry can grow to an enormous size. That isn't quite what Microsoft had in mind when they created the registry structure. Microsoft's policy now states that applications may (and should) use standalone .ini files as needed. Some advantages to using application-specific .ini files include these: • Individual applications sometimes need to be restored from backup. With an application-specific .ini file, it is not necessary to back up and restore the entire registry to reinstall any single application. (This eliminates the attendant problem of restoring one part of the registry only to lose another part during the restoration!) • The system registry has a practical limited size. Granted, the size is large, but some applications have lately been adding substantial content to the registry without regard to the fact (sad as it is) that the registry is a shared resource that everyone, including the system, must use! Once the registry gets too large, some registry operations may take an excessive amount of time. N ote Microsoft limits the size of any object that is stored in a registry data key to 1MB. This limit is basically only meaningful for REG_BINARY objects, because strings and such are unlikely to become this large. If you must store more than 1MB in a registry object, then store the information in a file and store a pointer to the file in the registry. Without this limitation, the registry could easily grow to be the largest file on your system. For Windows before Windows XP Windows 2000 and earlier versions set restrictions on registry size. If you approach your registry limit, you'll get a message stating that you are low on registry quota. This indicates that the registry has grown too large for the current size allocation. Unless you change it, the registry size is set to 25 percent of the paged pool size; for most computers, the paged pool size is approximately equal to the amount of installed RAM, up to a maximum of 192MB. The registry can be set to 80 percent of the paged pool size (80 percent of 192MB is just under 154MB, though good sense says to round down to 150MB). Earlier versions of Windows adjust the registry size based on the currently installed RAM. Several registry entries affect registry size, though most users will find that the defaults are acceptable for their use. To create a very large registry, ensure that the amount of RAM installed is sufficient and set the RegistrySizeLimit and PagedPoolSize entries. Organization The registry is organized into five major sections. These sections are called hives, which are analogous to root directories on your hard drive. Each hive, by definition, has its own storage location (a file) and log file. If necessary, a given hive can be restored without affecting the other hives in the registry. Inside a hive you find both keys (and subkeys, analogous to directories and subdirectories on your hard disk) and values. The term value (or data value, as it is sometimes called) refers to the information, or data, assigned to a key, making the key analogous to a file on your hard drive as well. A key or subkey may have zero, one, or more value entries, a default value, and from zero to many subkeys. Each value entry has a name, data type, and a value: • The entry's name is stored as a Unicode character string. • The entry's type is stored as an integer index. The type is returned to the querying application, which must then map this type to the type that the application knows. • The entry's value is stored as necessary to allow efficient retrieval of the data when needed. Both the Windows XP operating system and applications store data in the Windows XP registry. This is both good and bad. It is good because the registry makes an efficient, common storage location. Here's the bad part: as I mentioned earlier, as more and more applications and systems store information in the registry, it grows larger, and larger, and larger. It is most unusual for the registry to get smaller—I'm unaware of any application that does a really complete job of cleaning up all of its own registry entries when the application is uninstalled. Many applications leave tons of stuff in the registry when they are uninstalled, and not many applications clean up unused entries as a routine process. The end result is that the registry will grow, like Jack's magic beanstalk, as time goes on. N ote From time to time in this book I'll refer to hives, keys, subkeys, and values using the generic term object. When the term object is used, assume that the item could be any valid item in the registry! Hives and Their Aliases There are five main, or top level, hives in the Windows XP registry, and accepted abbreviations _for each: • HKEY_CLASSES_ROOT, a.k.a. HKCR • HKEY_CURRENT_USER, a.k.a. HKCU • HKEY_LOCAL_MACHINE, a.k.a. HKLM • HKEY_USERS, a.k.a. HKU • HKEY_CURRENT_CONFIG, a.k.a. HKCC N ote The Windows 98 and Windows Me (Millennium Edition) HKEY_DYN_DATA hive, which has no abbreviation, does not exist in Windows XP, though Microsoft had [...]... and do store data in the registry, and that data needn't be one of the established registry data types How the Registry Is Used How does Windows XP use the registry? When is the registry first opened and used? What Is Windows XP? Windows XP comes in a number of versions, including a Home version and a Professional version Windows XP Home is configured for home users Windows XP Professional, which is... flexible database Registry information comes from a number of sources: • • • From installing Windows XP From booting Windows XP From applications, systems, and user interaction Every component of Windows XP uses the registry, without exception A set of APIs allows both Windows XP and other applications to access registry information easily and quickly Windows XP starts to use the registry at the very... book, Windows XP also comes in a number of server versions named Windows XP NET Microsoft has planned several server product offerings, including Windows XP NET Server and Windows XP NET Advanced Server We don't expect that there will be major changes in NET's use of the registry The registry is a tree-based hierarchical system that offers quick access to data stored in almost any format Actually, the registry. .. installation of Windows XP is installed into That won't create a second copy of Windows XP 3 The Windows XP Setup program will configure the Boot Manager (creating new entries in the boot menu) so that you are able to choose which copy of Windows XP you want to boot Customizing the Boot Menu Once you install a second copy of Windows XP, your boot menu will list both copies of Windows XP This can be... disk(0)rdisk(0)partition(1)\WINXP [operating systems] signature Disk(0)rdisk(0)partition(1)\WINXP="Microsoft Windows XP Server" /fastdetect multi(0)disk(0)rdisk(0)partition(1)\WINXPBU= "Windows NT Server" multi(0)disk(0)rdisk(0)partition(1)\WINXPBU= "Windows NT Server" /basevideo /sos You can modify anything in the quoted strings I suggest calling your backup installation of Windows XP just that— "Windows XP B/U." For... example: multi(0)disk(0)rdisk(0)partition(1)\WINXPBU= "Windows XP Server Registry B/U" multi(0)disk(0)rdisk(0)partition(1)\WINXPBU= "Windows XP Server Registry B/U [VGA mode]" /basevideo /sos Don't forget to use the Control Panel's System applet to change the default boot to the version of Windows XP that normally will be booted by default After Windows XP is (re)installed, the latest installation is... restore your registry from a backup you have created: 1 Boot to another operating system: Windows XP/ NT, DOS, or Windows 95/98/Me for FAT; use Windows XP/ NT for NTFS 2 Save the current registry to a safe location just in case the registry is not the problem after all 3 Copy your saved registry (from wherever it was stored) to the correct registry location 4 Boot the problematic version of Windows XP and... current registry while Windows XP is using the registry Period Therefore, to restore the registry using either copy or xcopy, it is necessary to shut down Windows XP and start another operating system, such as DOS, Windows 95/98/Me, or a second copy of Windows XP Which operating system you use depends on which file system is being used on the computer If the file system is FAT, you should start DOS or Windows. .. access the registry files on an NTFS drive, you must install a second copy of Windows XP Tip Actually, everyone should have at least two installations of Windows XP: the working copy and an emergency installation to use if the working copy of Windows XP is unable to boot Windows XP supports multiple boot configurations quite effectively To create a multiple boot installation of Windows XP, simply follow... about the initial setup of Windows XP All of these files are critical when restoring the registry or system using the Setup program's repair function Using RegEdit to Back Up the Registry Using the Windows Registry Editor, you can make an additional copy of the registry and restore it by double-clicking a single icon The Windows Registry Editor, RegEdit, is included with Windows XP Note New! RegEdt32 and . loaded. Remember, Windows XP supports multiboot configurations. It is trivial to create a Windows XP installation that can boot Windows NT, Windows XP, and Windows 95 or Windows 98. The boot. ignore them. For Windows XP, it's the registry that is most important to the system, because it contains the heart and soul of Windows XP. Without the registry, Windows XP would be nothing. used? What Is Windows XP? Windows XP comes in a number of versions, including a Home version and a Professional version. Windows XP Home is configured for home users. Windows XP Professional,