Tutorials & help

Using the registry

Summary

• Abstract
• What's the registry ?
• The registry editor (regedit)
• An example : the Run key
• Let's try and search for something...
• Reg files

Abstract

Most Windows and programs parameters are saved in the registry. You can edit the registry with the registry editor (regedit). To launch it, execute (winkey+R) regedit. You can search for keys, values (entries) and value data with regedit (CTRL+F). You can directly edit the redistry with notepad-made files, saved with a .reg extension. For an example, choose Registry → Export in regedit.

What's the registry ?

The registry is made up of a few big hidden file containing a lot of system and program parameters.
Under Windows 9x/Me, the registry files are USER.DAT and SYSTEM.DAT, backed up as USER.DA0 and SYSTEM.DA0.
Under Windows 2k/XP, the registry is made up of more files, located in %SYSTEMROOT%\System32\config (where %SYSTEMROOT% is your windows directory, most often c:\winnt). The files currently making up the registry have no extension. .SAV files are backup files.

The registry editor (regedit)

→ In the Start menu, choose Execute (you can also press windowskey+F).
→ Type regedit and press OK.
→ Doesn't is look like the Windows explorer ? ;)


To make the nomenclature simple, let's say it's like Windows explorer, where the folders are named keys, the files values (entries) and the content of values are (value) data.
The main 5 keys, which you can see on the picture above, are often refered to with abbreviations : HKCR, HKCU, HKLM, HKU & HKCC.
The values you'll most often edit are located inside HKCU (parameters for current user) and HKLM (parameters for the whole machine).

An example : the Run key

This is probably one of the most famous registry key. It's content is executed every time the computer starts up (so it can be used by viruses and spywares...). There are 2 Run keys (in fact one for the machine HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and one for every user, yours being HKCU\Software\Microsoft\Windows\CurrentVersion\Run).


(about the above screenshot : I do not condone the use of MSN Messenger. My brother uses it, I don't. If you want to talk to your MSN Messenger freak friends :p, please use Gaim. It's free, efficient and cleaner than MSN Messenger - eg, it won't launch if you don't ask it to, rather cool huh ? Thank you for your cooperation :).)
Note that the more items you have in your Run keys, the slower your computer will launch...
The RunOnce keys are located in the same key as Run, and contain items that are run only on the next computer starting up.

Let's try and search for something...

If you browse the registry, you'll soon find out it is really, trully huge. So, when you'll be looking for a key/a value, you'll need to search for it if you don't have it's path.
To search for a key/a value, choose Edit → Find (not sure if that's it for I have the French verion, sorry) (you can also press CTRL+F). Then you get the search box :


A search in the registry may be quite long, especially if your Windows installation is not very... "young". So, you'll save a lot of time if you are able to define your search as precisely as possible. For instance, if you are searching for a file named my search.exe in a value data field, you'll check only "Look in" Data, and make sure Keys and Values are unchecked. If you are looking for the Run key, type "Run" in the Find field, and check only Keys.

Reg files

Finally, we'll learn how to edit the registry without the registry editor.
The easiest way is probably to watch and learn ;) :
→ In regedit, select a key with not many keys or no key at all inside. A good key could be the Run key.
→ Then, in the menu, choose Registry → Export :


Then save the file and right click on it, and choose Open with → Notepad.
The first line is REGEDIT4 or Windows Registry Editor Version 5.00 (or newer ?). Then there is a key, between [], eg [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] (do not use abbreviations). Then there are values, eg "Tweak UI"="RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp", where Tweak UI is the value name, and RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp is the value data.


If you double-click on this file, it will add the Tweak UI value, affected of data RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp, in the HKLM RUn key. Of course, it will also add all the other values and keys in the file.
You'll need to know how to use this kind of file to use our "Windows integration" tips : you'll have to copy (CTRL+C) and paste (CTRL+V) our code in notepad, sometimes edit it, save it as a reg file (to do so, enter a filename with a reg extension, eg myfile.reg) and run it (by double-clicking it). Let's try with these examples :
→ Run this code (this will create a meaningless value) :

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Test from MPAM 3"="Hello World"

→ Then to remove the value, run the following code :

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Test from MPAM 3"=-

For more informations about reg (and inf) files, see this site.