Tutorials & help
Using the registry
Related book
This guide reveals registry techniques, tricks, and tips for customizing and maintaining the Windows XP registry.
Summary
- Abstract
- What's the registry ?
- The registry editor (regedit)
- An example : the Run key
- Let's try and search for something...
- Reg files
Abstract |
- Most Windows and programs parameters are saved in the registry. You can edit the registry with the registry editor (regedit). To launch it, execute (winkey+R) regedit.
- You can search for keys, values (entries) and value data with regedit (CTRL+F).
- You can directly edit the redistry with notepad-made files, saved with a .reg extension. For an example, choose Registry → Export in regedit.
|
What's the registry ?
The registry is made up of a few big hidden file containing a lot of system and program parameters.
Under Windows 9x/Me, the registry files are
USER.DAT and
SYSTEM.DAT, backed up as
USER.DA0 and
SYSTEM.DA0.
Under Windows 2k/XP, the registry is made up of more files, located in
%SYSTEMROOT%\System32\config (where %SYSTEMROOT% is your windows directory, most often
c:\winnt). The files currently making up the registry have no extension.
.SAV files are backup files.
The registry editor (regedit)
→ In the
Start menu, choose
Execute (you can also press windowskey+F).
→ Type
regedit and press
OK.
→ Doesn't is look like the Windows explorer ? ;)

To make the nomenclature simple, let's say it's like Windows explorer, where the folders are named
keys, the files
values (entries) and the content of values are
(value) data.
The main 5 keys, which you can see on the picture above, are often refered to with abbreviations :
HKCR,
HKCU,
HKLM,
HKU &
HKCC.
The values you'll most often edit are located inside
HKCU (parameters for current user) and
HKLM (parameters for the whole machine).
An example : the Run key
This is probably one of the most famous registry key. It's content is executed every time the computer starts up (so it can be used by viruses and spywares...). There are 2
Run keys (in fact one for the machine
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and one for every user, yours being
HKCU\Software\Microsoft\Windows\CurrentVersion\Run).

(about the above screenshot : I do not condone the use of MSN Messenger. My brother uses it, I don't. If you want to talk to your MSN Messenger freak friends :p, please use
Gaim. It's free, efficient and cleaner than MSN Messenger - eg, it won't launch if you don't ask it to, rather cool huh ? Thank you for your cooperation :).)
Note that the more items you have in your
Run keys, the slower your computer will launch...
The RunOnce keys are located in the same key as Run, and contain items that are run only on the next computer starting up.
Let's try and search for something...
If you browse the registry, you'll soon find out it is really, trully huge. So, when you'll be looking for a key/a value, you'll need to search for it if you don't have it's path.
To search for a key/a value, choose
Edit → Find (not sure if that's it for I have the French verion, sorry) (you can also press CTRL+F). Then you get the search box :

A search in the registry may be quite long, especially if your Windows installation is not very... "young". So, you'll save a lot of time if you are able to define your search as precisely as possible. For instance, if you are searching for a file named
my search.exe in a value data field, you'll check
only "Look in"
Data, and make sure
Keys and
Values are unchecked. If you are looking for the Run key, type "Run" in the
Find field, and check only
Keys.
Reg files
Finally, we'll learn how to edit the registry without the registry editor.
The easiest way is probably to watch and learn ;) :
→ In regedit, select a key with not many keys or no key at all inside. A good key could be the
Run key.
→ Then, in the menu, choose
Registry → Export :

Then save the file and right click on it, and choose
Open with → Notepad.
The first line is
REGEDIT4 or
Windows Registry Editor Version 5.00 (or newer ?). Then there is a key, between [], eg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] (do not use abbreviations). Then there are values, eg
"Tweak UI"="RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp", where
Tweak UI is the value name, and
RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp is the value data.

If you double-click on this file, it will add the
Tweak UI value, affected of data
RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp, in the HKLM
RUn key. Of course, it will also add all the other values and keys in the file.
You'll need to know how to use this kind of file to use our "Windows integration" tips : you'll have to copy (CTRL+C) and paste (CTRL+V) our code in notepad, sometimes edit it, save it as a reg file (to do so, enter a filename with a reg extension, eg
myfile.reg) and run it (by double-clicking it). Let's try with these examples :
→ Run this code (this will create a meaningless value) :
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Test from MPAM 3"="Hello World"
→ Then to remove the value, run the following code :
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Test from MPAM 3"=-
For more informations about reg (and inf) files, see
this site.