Windows 95 Registry F.A.Q.

Registry Architecture

1 What exactly is the Windows 95 Registry?

2 Recovering Registry Data

3 Configuration Backup

4 The Registry Editor (REGEDIT.EXE)

5 The six Hkey_ handles

Hkey_Local_Machine
Hkey_Current_Config
Hkey_Dyn_Data
Hkey_Classes_Root
Hkey_Users
Hkey_Current_User

6 SubKeys of the six Hkey Handles

-></A></TD>
</TR>
</TABLE>

<H3><FONT FACE=

1 What exactly is the Windows 95 Registry?

The Registry is a central database that is created by Windows 95 during installation. The entries in that database consist of the hardware, software, users, and preferences data for a single PC, or any PC on a network. Whenever the user makes changes to the Control Panel settings, File Associations, System Policies, or installed software, the changes are reflected in the Registry.

These Registry settings can be viewed with the Registry Editor (REGEDIT.EXE), which is installed into the Windows\System folder when Windows 95 is installed from CD-ROM. The floppy disk version of Windows 95 will NOT install this editor.

By default, REGEDIT.EXE will NOT appear on any of the system's menus, or the Start button. So, you will have to add your own shortcut, or you can click on the START button, select RUN, and in the OPEN: command line type REGEDIT and press ENTER. If the Registry Editor is installed on your system, it will appear on your Desktop, ready to use.

The Registry replaces the dreaded .INI files from Windows 3.1, and because the information is presented in hierarchical form, the Registry supports nested folders, which .INI files do not support. One of the many benefits of this is that in a network environment, users can log onto any PC in the network, just as it were the very same PC on their desk! In addition, several users can store configuration data on a single machine.

POWERTIP!

You can add the Registry Editor to your system
by using the right mouse button to drag the
file REGEDIT.EXE from Explorer to the Desktop.

Registry Editor displays the contents of the Registry in six subtrees called Keys. Keys can contain data strings, as well as SubKeys. Each of these six Keys begins with Hkey_ which indicates that it can be used by a program to access resources.

When you first look at the Registry Editor, this structure looks extremely complicated. Think of the Registry Editor as another type of Windows Explorer, only this explorer ventures into the uncharted waters of your systems' configuration!

2 Recovering Registry Data

In Windows 95, data is written to the Registry only when a flush occurs � that is, when something happens after changed data has aged more than a few seconds or when an application intentionally flushes the data to the hard disk.

Each time Windows 95 successfully starts, the operating system backs up the Registry by copying the current SYSTEM.DAT and USER.DAT files to SYSTEM.DA0 and USER.DA0, respectively. If Windows 95 fails to start, the backed-up Registry from the last successful startup can be copied over the current Registry. This method recovers the last successful settings after a system failure.

If the Registry should ever become damaged, it can be salvaged WITHOUT reinstalling Windows 95. All you have to do is look for a hidden system file called SYSTEM.1ST in the root directory of the drive that hosts Windows 95. This file is a copy of the Registry that was created when Windows 95 setup was first deemed successful.

All you have to do is change the file attributes of the file by locating it in the Windows 95 Explorer, and right clicking on it. Choose properties, and then, the General Properties dialog appears. Change the file attributes from READ-ONLY and HIDDEN to ARCHIVE and copy it to the Windows 95 subdirectory.

Then, rename the file from SYSTEM.1ST to SYSTEM.DAT, copying over the corrupt file, and replacing it with workable system profiles.

POWERTIP!

You can also maintain back-ups of the Registry
with the Configuration Backup utility included
on diskette with the Windows 95 Resource Kit.

To put it another way:

-----------------------
To restore the Registry
-----------------------

1 Click the Start button, and then click Shut Down.

2 Click Restart The Computer In MS-DOS Mode, then click Yes.

3 Change to your Windows directory. For example, if your Windows directory is C:\Windows, you would type the following:

cd C:\Windows

4 Type the following commands, pressing ENTER after each one. (Note that SYSTEM.DA0 and USER.DA0 contain the number zero.)

attrib -h -r -s system.dat

attrib -h -r -s system.da0

copy system.da0 system.dat

attrib -h -r -s user.dat

attrib -h -r -s user.da0

copy user.da0 user.dat

5 Restart your computer.

Following this procedure will restore your registry to its state when you last successfully started your computer.

Additionally, there is a file on your hard disk named SYSTEM.1ST that was created when Windows 95 was first successfully installed. You could also change the file attributes of this file from read-only and hidden to archive to copy the file to SYSTEM.DAT

3 Configuration Backup

It is sheer suicide to attempt to edit the Windows 95 Registry without backing up the necessary files before you begin. There is a little life-saver of a utility that comes with the Resource Kit called Configuration Backup (cfgback.exe). It not only lets the user backup the Registry data, but also allows the complete backup, restoration, and storage of up to NINE SEPARATE system configurations!

Besides, what I really recommend before you attempt to edit the Registry, is to first back up your present configuration, and name it something meaningful, so it can be recognized in the event that it needs to be restored at some point in the future.

Later, if a mistake is made in editing the Registry, or if your latest changes have achived some rather undesireable and disasterous effects, all you have to do is open up the Configuration Backup and select RESTORE. After you reboot your machine, the restored configuration returns your system to the settings BEFORE the disaster took place.

The end result here is that the regular use of this utility will minimize the danger involved in editing the Registry, and can always return you to an earlier configuration of your own choosing.

POWERTIP!

You can save up to NINE separate backups with
the Configuration Backup utility, and any one
of them can restored after a disaster occurs.

-></A></TD>
</TR>
</TABLE>

<H3><B><FONT FACE=

4 The Registry Editor (REGEDIT.EXE)

The Registry Editor is a powerful tool that configures and edits your Windows 95 system settings. Registry Editor can be used to view or modify a Registry on a local computer or on another computer over a network. Both the administrator's computer and the remote computer require the Microsoft Remote Registry service to allow remote Registry access.

When you run the Registry Editor, it displays its' data in two panes. On the left side, you have the six Keys, which are shown as folders in "My Computer." Each key can have a set of values. Each value entry is comprised of three parts: the name of the key, its' data type, and the value itself.

The Registry Editor stores this information in .REG files, which are essentially text files containing the data in a specific format. If there is a small plus sign next to a key, then, it will have further data below called a SubKey. These are more commonly known as nested folders, which simply means that folders can themselves contain other folders.

The value entries in the right pane are associated with the selected key in the left pane. A value entry has three parts: the data type of the value (which appears as an icon), the name of the value, and the value itself. A value entry must limit itself to 64k or less, while the size of the actual total Registry is dependant on available hard disk space.

Data types can either be Binary numerical data or readable text. Most of the hardware information is stored as binary data, and can be displayed as either binary or hexadecimal information.

Right-click anywhere in the Registry Editor, and you can create a NEW Key (or subkey), string value, binary value, or DWORD value.

5 The six Hkey_ handles

Hkey_Local_Machine

Contains computer specific information about the type of hardware, software, and other preferences on a given PC. This information is used for all users who log onto this computer.

Hkey_Current_Config

This Key points to a branch of the Key Hkey_Local_Machine \Config that contains information about the current hardware configuration.

Hkey_Dyn_Data

This Key points to a branch of Hkey_Local_Machine that contains various bits of information regarding the System's Plug and Play configuration. This information is DYNAMIC, meaning that it may change as devices are added to or removed from the computer.

Hkey_Classes_Root

This Key points to a branch of Hkey_Local_Machine that describes certain software settings. This Key contains essential information about OLE and drag and drop operations, shortcuts, and core aspects of the Windows 95 GUI.

Hkey_Users

This Key contains information about the users that log onto the computer. Both generic and user-specific information is used, and each user who uses the system has their own Subkey.

Hkey_Current_User

This Key points to a branch of Hkey_Users for the user who is currently logged onto the system.

6 SubKeys of the six Hkey Handles

Hkey_Local_Machine may contain the following Subkeys

SubKey   Description
------   --------------------------------------------------
Config   A collection of configurations for the local                           computer

Enum     Info. on the system's installed hardware devices

Hardware Info. on the ports and modems used with                                        HyperTerminal

Network  Info. Created when a user logs on to a networked PC

Security Info. on network security and remote administration

Software Info. about software and it's configuration on                                 system

System   The database that controls system start-up, device
         driver loading, Windows 95 services, and OS behavior
-------  ----------------------------------------------------

Hkey_Local_Machine\Config

The Hkey_Local_Machine\Config subtree contains information about alternate hardware configurations for the computer. For example, it can contain information about multiple configurations to be used when the computer is connected to a network, when it is undocked from a docking station, and so on. Each alternate configuration is assigned a unique identifier, and this configuration ID has a subkey under the Config key. Each configuration appears in the list of hardware profiles in the System option in Control Panel.

When Windows 95 checks the hardware configuration at system startup, one of three things occurs:

In most situations, the configuration ID is mapped to a unique configuration and Windows 95 selects the appropriate one automatically, and the settings for the related Config subkey are used for system configuration.
If the user is starting the computer for the first time with new hardware components, Windows 95 creates a new configuration for the new configuration ID, and a new Config subkey is added to the Registry.
If the configuration ID is mapped to more than one configuration (for example, because Windows 95 cannot distinguish between two configurations), the user is prompted to choose which configuration to use.

Hkey_Local_Machine\Enum

Windows 95 bus enumerators are responsible for building the hardware tree. This includes assigning an identification code to each device on its bus and retrieving the device's configuration information, either directly from the device or from the Registry. For more information about the hardware tree and bus enumerators, see Introduction to System Configuration, and Windows 95 Architecture.

Bus enumeration information is stored in the Hkey_Local_Machine\Enum subtree. For all types of devices, subkeys contain information such as device type, assigned drive letter, hardware ID, and device manufacturer, plus driver-related information for network components.

The following table shows which devices are enumerated in typical subkeys.

------  --------------------------------------
Subkey  Device enumeration
------  ---------------------------------------
ESDI    Fixed disk devices
FLOP    Floppy disk devices
ISAPNP  Plug and Play devices on an ISA bus
Monitor Monitor devices
Network Network protocol, server, and bindings
Root    Legacy devices
------- ---------------------------------------

Hkey_Local_Machine\Hardware

Information about serial ports and modems used with the HyperTerminal program.

Hkey_Local_Machine\Network

Network information created when a user logs on to a networked computer, including the user name, primary network provider, whether the logon was validated by a server, and information about the system policies processor.

Hkey_Local_Machine\Security

Information about the network security provider and remote administration capabilities.

Hkey_Local_Machine\Software

The Hkey_Local_Machine\Software subtree contains configuration information about all installed software that can write information in the Registry. The entries in this key apply for anyone using this particular computer, and include definitions for file associations and OLE information. The software subkey contains, for example, the information you add when registering an application to use a specific filename extension and information added during installation of Windows-based applications.

The Hkey_Local_Machine\Software subtree contains several subkeys, including the Classes subkey, plus description subkeys for all installed software that can write to the Registry, as described in the following sections.

Specific Key Information:- (1)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Contains a list of all programmes currently installed on you machine and can be used to remove unmovable entries from the uninstall section of the Add/Remove Control Panel. Please note that is is safer to use Tweakui to achive this same end. (Markd@)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

These are the programs that have been set up to run whenever the computer reboots. Same as the start menu but they start booting first but may finish after if they take a long time to open.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

These programs run only on the first boot of the day such as doing a virus scan.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce

Do the same thing but only special set up programs etc. For example if you install the MS service pack for win95 you need to replace many of the basic windows files. Since these files are in use you cannot just copy and replace. The installation routine copies the files to a temp directory, adds runservices keys to the registry, tells you to reboot, and on the reboot copies the files from the temporary directory to the windows directory at the very start of the boot process and finally erases the runservices entries.

This is why you should always reboot after each installation. What a second install or you might do is erase the temp files or the runservices entries which results in a failure of the installation.

Hkey_Local_Machine\System

The data in Hkey_Local_Machine\System is organized into control sets that contain a complete set of parameters for device drivers and services that can be loaded with Windows 95. All data that controls startup is described in the CurrentControlSet subtree under Hkey_Local_Machine\System. This control set has two parts:

The Control key contains information used to control system startup, including the computer's network name and the subsystems to start.

The Services key contains information to control the loading and configuration of drivers, file systems, and so on. The data in the Services key also controls how these services call each other.

[3-6-2] Hkey_Current_Config may contain the following Subkeys