USING WINDOWS ADMIN TOOLS LIKE A PRO/WINDOWS REGISTRY EDITOR

What is the Registry?

The Windows Registry is a hierarchical database that contains all of the configurations and settings used by components, services, applications, and pretty much everything in Windows.
The registry has two basic concepts to be aware of: Keys and Values. Registry Keys are objects that are basically folders, and in the interface even look exactly like folders. Values are a bit like the files in the folders, and they contain the actual settings.
When you open the Registry Editor for the first time, you’ll see a treeview on the left-hand pane that contains all of the keys, with values on the right-hand side. It’s about as simple as an interface gets.

The root-level keys that you see in the left-hand side of the screenshot are important. Each one houses a different set of information, so depending on what you are trying to do, you’ll need to know which section to browse down into.
The interesting thing that most people don’t know is that 3 of the 5 items on the root level aren’t actually there… they are just linked to items further down in one of the other keys.

HKEY_CLASSES_ROOT

Windows uses this section to manage file type associations, and it is usually abbreviated HKCR when being referenced in documentation. This key is actually just a link to HKLM\Software\Classes.
You can also use this section if you want to tweak the context menu for a particular file type.

HKEY_CURRENT_USER

Holds the user settings for the currently logged in user, and is usually abbreviated HKCU This is actually just a link to HKEY_USERS\. The most important sub-key in here is HKCU\Software, which contains user-level settings for most of your software.

HKEY_LOCAL_MACHINE

All of the system-wide settings are stored here, and it is usually abbreviated as HKLM. You’ll mostly use the HKLM\Software key to check machine-wide settings.

HKEY_USERS

Stores all of the settings for all users on the system. You’ll typically use HKCU instead, but if you need to check settings for another user on your computer, you can use this one.

HKEY_CURRENT_CONFIG

Stores all of the information about the current hardware configuration. This one isn’t used very often, and it just a link to HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\Current.

Creating New Keys and Values

Right-clicking on any key in the left-hand side of the window will give you a set of options, most of which are fairly straightforward and easy to understand.

You can create a new Key, which will show up as a folder on the left-hand side, or a new value, which will show up on the right-hand side. Those values can be a little confusing, but there are really only a couple of values that are used regularly.

• String Value (REG_SZ) – This contains anything that will fit into a regular string. The vast majority of the time, you can edit human-readable strings without breaking everything.
• Binary Value (REG_BINARY) – This value contains arbitrary binary data, and you will almost never want to attempt to edit one of these keys.
• DWORD (32-bit) Value (REG_DWORD) – These are almost always used for a regular integer value, whether just 0 or 1, or a number from 0 to 4,294,967,295.
• QWORD (64-bit) Value (REG_QWORD) – These are not used very often for registry hacking purposes, but it’s basically a 64-bit integer value.
• Multi-String Value (REG_MULTI_SZ) – These values are fairly uncommon, but it works basically like a notepad window. You can type multi-line textual information into a field like this.
• Expandable String Value (REG_EXPAND_SZ) – These variables have a string that can contain environment variables and is often used for system paths. So a string might be %SystemDrive%\Windows and would expand to C:\Windows. This means that when you find a value in the Registry that is set to this type, you can change or insert environment variables and they will be “expanded” before the string is used.

Fun Fact: DWORD is short for “Double Word”, because a “Word” is a term for the default unit of data used by a processor, and when Windows was created that was 16 bits. So a “word” is 16 bits, and a “Double Word” is 32 bits. While modern processors are all 64-bit, the Registry still uses the older format for compatibility.

The Favorites Menu

One of the really useful features that nobody seems to notice is the Favorites menu, which is great when you want to check a registry location regularly. What’s really fun is that you can export the list of favorites and use it again on another computer without having to browse down to the keys and add them to the favorites menu.
It’s also a great way to bookmark something in the registry if you are looking around in multiple locations, so you can easily flip back to the last place you were at.

Exporting Registry Files

You can export registry keys and all of the values contained underneath them by right-clicking on a key and choosing Export. This is really important if you are going to be making changes to your system.

Once you’ve got your exported registry file, you can double-click on it to enter the information back into the registry, or you can choose Edit to take a look at the contents in Notepad.

The registry hacking file format is pretty simple – value names on the left, and actual values on the right.

For more on registry hack files, make sure to read our guide on the subject.

Setting Permissions

Some of the registry keys won’t allow you to make changes by default. This is generally because you don’t have permission to those keys, but you can tweak the permissions scheme if you want by right-clicking a key and choosing Permissions, and then adjusting them from there.

We should note that this is not a good idea, and you should usually stay away from keys that require this much work to edit.

Loading Registry Hives

You can use the File -> Load Hive feature to load up a registry from an offline system. Perhaps you are troubleshooting another computer, and would like to see what is going on in the registry for a system that isn’t booting. So you boot the system from a rescue disk, or maybe a Linux live CD, and then copy the registry files onto your thumb drive.
Now you can open them up on another computer and look around by using the Load Hive option.

Where are these registry files stored?

You can find most of them in the Windows\System32\Config folder.

See those SAM, SECURITY, SOFTWARE, and SYSTEM files? They correspond to the same keys underneath the HKEY_LOCAL_MACHINE folder.

The data for the HKEY_CURRENT_USER branch is stored in your user folder, in a hidden file called NTUSER.DAT.

Backing Up Your Registry

You might have noticed over the years that every site that advises you to hack the registry in some way also tells you to backup your registry. But what’s the best way to do that?
You can’t export the entire registry to a file, and it wouldn’t work very well to import it again either. You also can’t easily access the files themselves on the hard drive, because they are completely locked. So that’s not going to work.
The best option to backup your registry? Create a System Restore point.

Rolling back a system restore point is quite easy.

Some Important Things to Note

While many people refuse to agree, the fact is that registry cleaners are pointless and should not be used. Cleaning up a few hundred keys out of a database of millions isn’t going to provide any performance boost, and any errors in the registry that resulted in a component not loading properly would be caught in Event Viewer or elsewhere, and could be fixed without resorting to cleaning the registry.
And don’t even get us started on registry “defrag”, which is complete nonsense these days. Perhaps back on Windows 95 with dirt-slow hard drives, it made sense. But now, with modern hard drives, or solid state drives that don’t need defragmenting at all? Don’t do it