Windows registry information for advanced users

• Article
• 04/06/2022
• 12 minutes to read

Was this page helpful?

Do you have additional feedback?

Your feedback will be sent to Microsoft – if you select the Submit button, your feedback will be used to improve Microsoft products and services. Privacy Policy.

Thanks.

In this article

This article describes the Windows registry and provides information on how to modify and back it up.

Applies to: Windows 10 – all editions, Windows Server 2012 R2
Original KB number: 256986

Description of the registry

Microsoft Computer Dictionary, 5th Edition, defines the registry as follows:

Central hierarchical database used in Windows 98, Windows CE, Windows NT and Windows 2000 used to store the information needed to configure the system for one or more users, applications and hardware devices.

The registry contains information that Windows continues to reference throughout the operation, such as profiles for each user, the applications installed on the computer and the types of documents that each can create, property sheet settings for folders and the application icons, the existing hardware in the system and the ports in use.

The registry replaces most of the text-based .ini files used in Windows 3.x and MS-DOS configuration files, such as Autoexec.bat and Config.sys. Although the registry is common to several Windows operating systems, there are some differences between them. A registry hive is a group of keys, subkeys, and values ​​in the registry with a set of supporting files that contain backups of their data. The support files for all hives except HKEY_CURRENT_USER are located in the % SystemRoot% \ System32 \ Config folder in Windows NT 4.0, Windows 2000, Windows XP, Windows Server 2003, and Windows Vista. The support files for HKEY_CURRENT_USER are located in the % SystemRoot% \ Profiles \ Username folder. The file extensions in these folders indicate the type of data they contain. Also, the lack of an extension can sometimes indicate the type of data they contain.

Registry hive
Support file

HKEY_LOCAL_MACHINE \ SAM
Sam, Sam.log, Sam.sav

HKEY_LOCAL_MACHINE \ Security
Security, Security.log, Security.sav

HKEY_LOCAL_MACHINE \ Software
Software, Software.log, Software.sav

HKEY_LOCAL_MACHINE \ System
System, System.alt, System.log, System.sav

HKEY_CURRENT_CONFIG
System, System.alt, System.log, System.sav, Ntuser.dat, Ntuser.dat.log

HKEY_USERS \ DEFAULT
Default, Default.log, Default.sav

In Windows 98, the registry files are named User.dat and System.dat. In Windows Millennium Edition, the registry files are named Classes.dat, User.dat, and System.dat.

Note

The security features in Windows allow an administrator to control access to registry keys.

The following table lists the default keys used by the system. The maximum size of a key name is 255 characters.

Default folder / key
Description

HKEY_CURRENT_USER
Contains the root of the configuration information for the currently logged on user. Folders, screen colors, and User Control Panel settings are stored here. This information is associated with the user’s profile. This key is sometimes abbreviated as HKCU.

HKEY_USERS
Contains all user profiles actively loaded on the computer. HKEY_CURRENT_USER is a subkey of HKEY_USERS. HKEY_USERS is sometimes abbreviated as HKU.

HKEY_LOCAL_MACHINE
Contains computer-specific configuration information (for any user). This key is sometimes abbreviated as HKLM.

HKEY_CLASSES_ROOT
HKEY_LOCAL_MACHINE \ Software subkey. The information stored here ensures that the correct program opens when you open a file using Windows Explorer. This key is sometimes abbreviated as HKCR. Starting with Windows 2000, this information is stored in the HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER keys. The HKEY_LOCAL_MACHINE \ Software \ Classes key contains default settings that can be applied to all users on the local computer. The HKEY_CURRENT_USER \ Software \ Classes key contains settings that override the default settings and apply only to the interactive user. The HKEY_CLASSES_ROOT key provides a registry view that merges information from these two sources. HKEY_CLASSES_ROOT also provides this merged view for programs designed for earlier versions of Windows. To change the settings for the interactive user, you need to make changes in HKEY_CURRENT_USER \ Software \ Classes instead of HKEY_CLASSES_ROOT. To change the default settings, you need to make changes in HKEY_LOCAL_MACHINE \ Software \ Classes . If you write keys to a key in HKEY_CLASSES_ROOT, the system stores the information in HKEY_LOCAL_MACHINE \ Software \ Classes . If you write values ​​to a key in HKEY_CLASSES_ROOT and the key already exists in HKEY_CURRENT_USER \ Software \ Classes , the information will be stored on the system instead of in HKEY_LOCAL_MACHINE \ Software \ Classes .

HKEY_CURRENT_CONFIG
Contains information about the hardware profile used by the local computer at system startup.

Note

The registry in 64-bit versions of Windows XP, Windows Server 2003 and Windows Vista is divided into 32-bit and 64-bit keys. Many of the 32-bit keys have the same names as their 64-bit counterparts and vice versa. The default 64-bit version of Registry Editor included in 64-bit versions of Windows XP, Windows Server 2003, and Windows Vista displays 32-bit keys in the HKEY_LOCAL_MACHINE \ Software \ WOW6432Node node.
For more information on how to view the registry in 64-bit versions of Windows, see How to view the registry using 64-bit versions of Windows .

The following table lists the data types currently defined and used by Windows. The maximum size of a value name is as follows:

• Windows Server 2003, Windows XP and Windows Vista: 16,383 characters
• Windows 2000: 260 ANSI characters or 16,383 Unicode characters
• Windows Millennium Edition / Windows 98 / Windows 95: 255 characters

Long values ​​(more than 2,048 bytes) should be stored as files with filenames stored in the registry. This allows the registry to function efficiently. The maximum size of a value is as follows:

• Windows NT 4.0 / Windows 2000 / Windows XP / Windows Server 2003 / Windows Vista: Available memory
• Windows Millennium Edition / Windows 98 / Windows 95: 16,300 bytes

Note

There is a limit of 64K on the total size of all values ​​of a key.

First name
Data type
Description

Binary value
REG_BINARY
Raw binary data. Most hardware component information is stored as binary data and is displayed in Registry Editor in hexadecimal format.

DWORD value
REG_DWORD
Data represented by a 4-byte long number (32-bit integer). Many parameters for device drivers and services are of this type and appear in Registry Editor in binary, hexadecimal, or decimal format. The related values ​​are DWORD_LITTLE_ENDIAN (the least significant byte is the lowest address) and REG_DWORD_BIG_ENDIAN (the least significant byte is the highest address).

Expandable string value
REG_EXPAND_SZ
Variable-length data string. This data type includes variables that are resolved when a program or service uses the data.

Multiple string value
REG_MULTI_SZ
Multiple string. Values ​​that contain lists or multiple values ​​in a format that users can read are usually of this type. Entries are separated by spaces, commas, or other signs.

String value
REG_SZ
Fixed-length text string.

Binary value
REG_RESOURCE_LIST
A set of nested arrays designed to store a list of resources used by a hardware device driver or one of the physical devices it controls. This data is detected and written to the \ ResourceMap tree by the system and is displayed in Registry Editor in hexadecimal format as a binary value.

Binary value
REG_RESOURCE_REQUIREMENTS_LIST
A series of nested arrays designed to store the list of possible hardware resources that the driver or one of the physical devices it controls can use. The system writes a subset of this list into the \ ResourceMap tree. This data is detected by the system and displayed in Registry Editor in hexadecimal format as a binary value.

Binary value
REG_FULL_RESOURCE_DESCRIPTOR
A set of nested arrays designed to store a list of resources used by a physical hardware device. This data is detected and written to the \ HardwareDescription tree by the system and is displayed in the Registry Editor in hexadecimal format as a binary value.

None
REG_NONE
Data without any specific type. This data is written to the registry by the system or applications and is displayed in the registry editor in hexadecimal format as a binary value

Connection
REG_LINK
Unicode string that names a symbolic link.

QWORD value
REG_QWORD
Data represented by a number that is a 64-bit integer. This data appears in Registry Editor as a binary value and was introduced in Windows 2000.

Back up the registry

Before editing the registry, export the keys in the registry that you plan to edit or back up the entire registry. If a problem occurs, you can follow the steps described in the Restore the Registry section to restore the registry to its previous state. To back up the entire registry, use the Backup utility to back up the system state. System state includes the registry, the COM + class registration database, and startup files. For more information on how to use the Backup utility to back up your system state, see the following articles:

Edit the registry

To modify registry data, a program must use the registry functions defined in Registry Functions .

Administrators can edit the registry using Registry Editor (Regedit.exe or Regedt32.exe), Group Policy, System Policy, Registry (.reg) files or by running scripts like VisualBasic script files.

Using the Windows user interface

It is recommended that you use the Windows user interface to change system settings rather than manually editing the registry. However, modifying the registry can sometimes be the best way to troubleshoot a product problem. If the problem is documented in the Microsoft Knowledge Base, there will be an article with detailed instructions for editing the registry for that problem. It is advisable to follow these instructions exactly.

Use Registry Editor

Notice

Editing the registry incorrectly using the editor or some other method can cause serious problems. which may require you to reinstall your operating system. Microsoft cannot guarantee that these problems will be solved. Editing the registry is at your own risk.

You can use Registry Editor to perform the following actions:

• Find a subtree, key, subkey or value
• Add a subkey or value
• Change a value
• Delete a subkey or value
• Rename a subkey or value

Folders are displayed in the navigation area of ​​the Registry Editor. Each folder represents a default key on the local computer. When you access the registry of a remote computer, only two default keys are displayed: HKEY_USERS and HKEY_LOCAL_MACHINE.

Use Group Policy

Microsoft Management Console (MMC) hosts administrative tools that you can use to administer networks, computers, services, and other system components. The Group Policy MMC snap-in allows administrators to define policy settings applied to computers or users. Group Policy can be implemented on local computers by using the Local Group Policy MMC Gpedit.msc snap-in. You can implement Group Policy in Active Directory by using the Active Directory Users and Computers MMC snap-in. For more information on how to use Group Policy, see the Help topics in the appropriate Group Policy MMC snap-in.

Use a registration entries file (.reg extension)

Create a Registration Entries (.reg) file containing the registry changes, then run the .reg file on the computer where you want to make the changes. You can run the .reg file manually or by using a login script. For more information, see How to Add, Modify, or Delete Registry Subkeys and Values ​​Using a Registration Entries (.reg) File.

Using Windows host script

The Windows Script Host allows you to run VBScript and JScript script directly in the operating system. You can create VBScript and JScript files that use Windows host script methods to delete, read, and write registry keys and values. For more information on these methods, visit the following Microsoft websites:

Using Windows Management Instrumentation

Windows Management Instrumentation (WMI) is a component of the Microsoft Windows operating system and is Microsoft’s implementation of Web-Based Enterprise Management (WBEM). WBEM is an industry initiative to develop standard technology for accessing management information in an enterprise environment. You can use WMI to automate administrative tasks, such as modifying the registry, in a corporate environment. You can use WMI in scripting languages ​​that have an engine in Windows and that manage Microsoft ActiveX objects. You can also use the WMI Command-Line utility (Wmic.exe) to edit the Windows registry.

For more information on WMI, see Windows Management Instrumentation .

For more information about the wmi Command-Line utility, see A description of the wmi command-line utility (Wmic.exe) Windows Management Instrumentation (WMI).

Use the console registry tool for Windows

You can use the console registry tool for Windows (Reg.exe) to edit the registry. For information on the Reg.exe tool, type reg /? at the command prompt and then click OK .

Restore the registry

To restore the registry, use the appropriate method.

Method 1: Restore registry keys

To restore the exported registry subkeys, double-click the Registration Entries (.reg) file saved in the Export Registry Subkeys section. Alternatively, you can restore the entire registry from a backup. For more information on how to restore the entire registry, see the Method 2: Restore the Entire Registry section later in this article.

Method 2: Restore the entire registry

To restore the entire registry, restore the system state from a backup. For more information on how to restore the system state from a backup, see How to Use Backup to Protect Your Data and Restore Files and Folders to Your Computer in Windows XP and Windows Vista .

Note

System State Backup also creates updated copies of the registry files in the % SystemRoot% \ Repair folder.

References

For more information, visit the following websites:

The Windows Server Catalog of Tested Products is a reference for products tested for compatibility with Windows Server.

Data Protection Manager (DPM) is a key member of the Microsoft System Center family of management products and is designed to help IT professionals manage the Windows environment. DPM is the new standard for Windows backup and recovery and offers continuous data protection for Microsoft applications and file servers that use seamless integrated disk and tape media. For more information on how to backup and restore the registry, see How to Backup and Restore the Registry in Windows XP and Windows Vista .