What is the registry? AND registry keys?

Sunday, March 22, 2009

The registry is nothing more then a central place to store all settings on the
computer. While a program doesn’t have to store any data in the registry, it’s
free to if it likes. It’s like the configuration files for Linux and Unix, but
rather then being stored in folders, it’s stored in hives, a folder-like
structure.
Tech Note: It should be noted, the registry is implemented by the
Configuration Manager part of the Windows Kernel. As such, it supports all
security associated with the kernel such as running within ring 0 within the
processor.
When opening the registry in RegEdit, you are presented with 5 keys, or
hives. The five keys are:
HKey_Classes_Root (HKCR)
HKey_Current_User (HKCU)
HKey_Local_Machine (HKLM)
HKey_Users (HKU)
HKey_Current_Config (HKCC)
HKEY_DYN_DATA (HKDD) (Win9x Only)
Of the five, three are actually subtrees of other keys. HKey_Users and
HKey_Local_Machine are the two “full” keys. The other keys are sub keys
of these two, or combinations of two or more keys. HKey_Users holds all
“Per User” settings in the registry. If you make a change to a program that
records to the registry, and another user is not effect by it, then it must be in
this section. You can also use this key to edit .default, the key that is used to
make the default keys for all new users. When a new user is made, .default
is copied into the new hive, using their SID to tell them apart.
HKey_Current_User is the HKey_Users key for the user running regedit. It
is a shortcut to the current users settings, so you don’t have to find out what
one of the HKey_Users you need to edit.
HKey_Current_Config is the current hardware profile listed in
HKey_Local_Machine\System\ControllSet001\Hardware Profiles. HKCC is
nothing more then a pointer to this key.
HKey_Classes_Root is a combo of
HKEY_LOCAL_MACHINE\Software\Classes and
HKEY_CURRENT_USER\Software\Classes keys. The data is a merged, so
if there’s no data listed for the current user, then the one for the local
machine is used.

0 comments

Post a Comment