The registry

The Microsoft® Windows® Server 2003 family registry is a database that contains system configuration information for the Windows Server 2003 family operating system.

  • For tips about using the registry and Registry Editor, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.


Best practices

In the Windows Server 2003 family, system configuration information is centrally located in the registry. While this simplifies the administration of a computer or network, one incorrect edit to the registry can disable the operating system. The following list provides some best practices for using the registry and Registry Editor safely:

  • Before making changes to the registry, make a backup copy.

    • You can back up the registry by using a program such as Backup. After you make changes to the registry, update your Automated System Recovery (ASR) disk. For troubleshooting purposes, keep a list of the changes you make to the registry. For more information, see the "Windows Server 2003 family Registry Reference" at the Microsoft Windows Resource Kits Web site. (http://www.microsoft.com/)

  • Do not replace the Windows Server 2003 family registry with the registry of another version of the Windows or Windows NT operating systems.
  • Edit the registry carefully.

    • Incorrectly editing the registry may severely damage your system.

  • Limit the number of people who have access to the registry.

    • For example, because members of the Administrators group have full access to the registry, add only users who need such access to the Administrators group. Alternately, you can use Registry Editor to set permissions for specific keys and subtrees, or simply remove Registry Editor from the computers of users whom you do not want to alter the registry.

  • Never leave Registry Editor running unattended.
  • Do not run Registry Editor as Administrator, except when necessary.

    A malicious user who has access to Registry Editor running as Administrator can cause severe damage to the operating system and software. Only run Registry Editor as Administrator if you need to see or change keys that you cannot otherwise access.

  • Use Run as to run Registry Editor as Administrator or a different user.

    To maintain registry security when making changes to a key that requires administrative credentials, log in as a member of the Users group and run Regedit as an administrator by right-clicking the Regedit icon, clicking Run as, and choosing an account in the local Administrators group. The Regedit icon does not appear by default from the Start menu. To access the icon, open the Windows or WINNT folder on your computer.

  • Do not access HKEY_CURRENT_USER or HKEY_CLASSES_ROOT using services that impersonate more than one user.

    HKEY_CURRENT_USER and HKEY_CLASSES_ROOT are aliases for other keys in the registry. For example, HKEY_CURRENT_USER is an alias for the key in HKEY_USERS for the user who is currently logged in. If a service accesses one of these keys while running as one user, and again while running as another user, the operating system might still have the alias data cached from the first user. If this happens, an error will result because the second user will not have access rights for keys belonging to the first user.


How to...

  • Open Registry Editor
  • Change keys and values
  • Import or export registry keys
  • Load or unload registry hives
  • Maintain registry security
  • Print all or part of the registry


Open Registry Editor

Microsoft Windows graphic

To open Registry Editor

  • Click Start, click Run, type regedit, and then click OK.

Caution

  • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer. Whenever possible, use tools and programs other than Registry Editor to edit the registry.

Note

  • XOX
  • Some previous versions of Windows had two versions of Registry Editor: regedit.exe and regedt32.exe. The version of Registry Editor that ships with the Windows Server 2003 family replaces both versions from previous operating systems.

Related Topics


Concepts

This section covers:

  • Registry overview
  • Registry structure
  • Securing the registry


Registry overview

In the Microsoft® Windows® Server 2003 family, system configuration information is stored centrally in a hierarchical database called the registry. The registry replaces many of the .ini, .sys, and .com configuration files used in Windows for MS-DOS® and Microsoft LAN Manager.

For more information about managing the registry, see "Windows Server 2003 Family Registry Reference" at the Microsoft Windows Resource Kits Web site. (http://www.microsoft.com/) For information about Windows Server 2003 support, see Support resources.


Registry structure

The registry is organized in a hierarchical structure of subtrees and their keys, subkeys, and entries.

The contents of the registry for one computer may vary widely from that of another, depending on the devices, services, and programs installed on each computer.

Keys can have subkeys and subkeys can, in turn, have subkeys. While most information in the registry is stored on disk and is considered permanent, some information, stored in volatile keys, is overwritten each time the operating system starts.

Registry subtrees

Windows Server 2003 family operating systems have two registry subtrees: HKEY_LOCAL_MACHINE and HKEY_USERS. However, to make the information in the registry easier to find, the Registry Editor utilities display five subtrees, three of which are aliases of other parts of the registry. These five subtrees are listed and described in the following table.

Root key name | Description
HKEY_LOCAL_MACHINE | Contains information about the local computer system, including hardware and operating system data such as bus type, system memory, device drivers, and startup control data.
HKEY_CLASSES_ROOT | Contains information used by various OLE technologies and file-class association data. A particular key or value exists in HKEY_CLASSES_ROOT if a corresponding key or value exists in either HKEY_LOCAL_MACHINE\SOFTWARE\Classes or HKEY_CURRENT_USER\SOFTWARE\Classes. If a key or value exists in both places, the HKEY_CURRENT_USER version is the one that appears in HKEY_CLASSES_ROOT.
HKEY_CURRENT_USER | Contains the user profile for the user who is currently logged on interactively (as opposed to remotely), including environment variables, desktop settings, network connections, printers, and program preferences. This subtree is an alias of the HKEY_USERS subtree and points to HKEY_USERS\security ID of current user.
HKEY_USERS | Contains information about actively loaded user profiles and the default profile. This includes information that also appears in HKEY_CURRENT_USER. Users who are accessing a server remotely do not have profiles under this key on the server; their profiles are loaded into the registry of their own computers.
HKEY_CURRENT_CONFIG | Contains information about the hardware profile used by the local computer system at startup. This information is used to configure settings such as the device drivers to load and the display resolution to use. This subtree is part of the HKEY_LOCAL_MACHINE subtree and points to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\Current.

Each root key name begins with HKEY_ to indicate to software developers that this is a handle that a program can use. A handle is a value used to identify a resource so that a program can access it.

Notes

  • The behavior of HKEY_CLASSES_ROOT in Windows 2000 and Windows Server 2003 family operating systems is different from that of the same key in previous versions of Windows. In Windows 2000 and Windows Server 2003 family operating systems, a feature called per-user class registration provides a view of HKEY_CLASSES_ROOT that contains both user-specific class registrations and computer-specific class registration. With this feature, different users can have different sets of class registrations (including those for file associations, COM components, and MIME types). Previously, all users shared registrations, so that one user could alter registrations for other users. Per-user class registration isolates each user's registrations and allows the administrator to increase security on HKEY_LOCAL_MACHINE\Software\Classes.

Registry hives and files

The term hive describes a body of keys, subkeys, and values that is rooted at the top of the registry hierarchy. A hive is backed by a single file and a .log file that are in the systemroot\System32\Config or the systemdrive\Documents and Settings\username folders. The string systemroot is a placeholder for the directory name that contains the Windows Server 2003 family system files; the string systemdrive is a placeholder for the partition that contains the Windows Server 2003 family system files. For example, if the Windows Server 2003 family system files for a user named Annie are in a directory called Windows in the C: partition, the hive files are stored in the C:\Windows\System32\Config and C:\Documents and Settings\Annie folders. Hives may also be called registry files or registry log files.

By default, most hive files (DEFAULT, SAM, SECURITY, SOFTWARE, and SYSTEM) are stored in the systemroot\System32\Config folder. In the Windows Server 2003 family of operating systems, the location of user profile information for each user of a computer, including the Ntuser.dat and Ntuser.dat.log, may depend on whether the installation of the operating system was a fresh installation or whether it was installed as an upgrade from Windows NT or Windows 2000. In fresh installations, the Ntuser.dat and Ntuser.dat.log files are stored in the systemdrive\Documents and Settings\username folder. In installations that are upgrades from Windows NT or Windows 2000, the Ntuser.dat and Ntuser.dat.log files are stored in the systemroot\Profiles\username folder.

Each hive in the Windows Server 2003 family registry is associated with a set of standard files. The following table shows the standard hives and files for a computer running an operating system in the Windows Server 2003 family.

Registry hive | File names
HKEY_LOCAL_MACHINE\SAM | Sam and Sam.log
HKEY_LOCAL_MACHINE\SECURITY | Security and Security.log
HKEY_LOCAL_MACHINE\SOFTWARE | Software and Software.log
HKEY_LOCAL_MACHINE\SYSTEM | System and System.log
HKEY_CURRENT_CONFIG | System and System.log
HKEY_CURRENT_USER | Ntuser.dat and Ntuser.dat.log
HKEY_USERS\.DEFAULT | Default and Default.log

Entries in the registry keys

Each registry key or subkey can contain data called entries. Some entries store information that is specific to each user, while others store information that applies to all users of a computer. An entry has three parts: the name of the value, the data type of the value, and the value itself. The three parts of entries always appear in the following order.

Structure of entry

Data types describe the format of the data. Data types from 0 through 0x7FFFFFFF are reserved for definition by the system. Programs are encouraged to use these data types, but data types from 0x80000000 through 0xFFFFFFFF are also reserved for use by programs.

The following table lists the data types currently defined and used by the system.

Data type | Description
REG_BINARY | Raw binary data. Most hardware component information is stored as binary data and is displayed in Registry Editor in hexadecimal format.
REG_DWORD | Data represented by a number that is 4 bytes long. Many parameters for device drivers and services are this type and are displayed in Registry Editor in binary, hexadecimal, or decimal format.
REG_EXPAND_SZ | A variable-length data string. This data type includes variables that are resolved when a program or service uses the data.
REG_MULTI_SZ | A multiple string. Values that contain lists or multiple values in a form that people can read are usually this type. Entries are separated by spaces, commas, or other marks.
REG_SZ | A fixed-length text string.
REG_FULL_RESOURCE_DESCRIPTOR | A series of nested arrays designed to store a resource list for a hardware component or driver.

For more information about managing the registry, see "Windows Server 2003 Family Registry Reference" at the Microsoft Windows Resource Kits Web site.


Securing the registry

The Registry contains sensitive data about the computer and its applications and files. A malicious user can use the registry to cause severe damage to the computer. It is important that you maintain a high level of registry security.

The registry is given a high level of security by default. Administrators are given full access to the entire registry, while other users generally have full access to the keys related to their own user accounts (which include HKEY_CURRENT_USER) and read-only access to the keys related to the computer and its software. Users have no access to the keys related to other users' accounts. Users with the appropriate permissions for a given key can make changes to the permissions for that key and for any keys it contains.

For help securing the registry, see Maintain registry security. For help using permissions, see Access control.


Use Registry Editor

  • Registry Editor (Regedit.exe)