1 What exactly is the Windows 95 Registry?
2 Recovering Registry Data
3 Configuration Backup
4 The Registry Editor (REGEDIT.EXE)
5 The six Hkey_ handles
6 SubKeys of the six Hkey Handles
     |
The Registry is a central database that is created by Windows 95 during installation. The entries in that database consist of the hardware, software, users, and preferences data for a single PC, or any PC on a network. Whenever the user makes changes to the Control Panel settings, File Associations, System Policies, or installed software, the changes are reflected in the Registry.
These Registry settings can be viewed with the Registry Editor (REGEDIT.EXE), which is installed into the Windows\System folder when Windows 95 is installed from CD-ROM. The floppy disk version of Windows 95 will NOT install this editor.
By default, REGEDIT.EXE will NOT appear on any of the system's menus, or the Start button. So, you will have to add your own shortcut, or you can click on the START button, select RUN, and in the OPEN: command line type REGEDIT and press ENTER. If the Registry Editor is installed on your system, it will appear on your Desktop, ready to use.
The Registry replaces the dreaded .INI files from Windows 3.1, and because the information is presented in hierarchical form, the Registry supports nested folders, which .INI files do not support. One of the many benefits of this is that in a network environment, users can log onto any PC in the network, just as it were the very same PC on their desk! In addition, several users can store configuration data on a single machine.
by using the right mouse button to drag the file REGEDIT.EXE from Explorer to the Desktop. |
Registry Editor displays the contents of the Registry in six subtrees called Keys. Keys can contain data strings, as well as SubKeys. Each of these six Keys begins with Hkey_ which indicates that it can be used by a program to access resources.
When you first look at the Registry Editor, this structure looks extremely complicated. Think of the Registry Editor as another type of Windows Explorer, only this explorer ventures into the uncharted waters of your systems' configuration!
| |
In Windows 95, data is written to the Registry only when a flush occurs — that is, when something happens after changed data has aged more than a few seconds or when an application intentionally flushes the data to the hard disk.
Each time Windows 95 successfully starts, the operating system backs up the Registry by copying the current SYSTEM.DAT and USER.DAT files to SYSTEM.DA0 and USER.DA0, respectively. If Windows 95 fails to start, the backed-up Registry from the last successful startup can be copied over the current Registry. This method recovers the last successful settings after a system failure.
If the Registry should ever become damaged, it can be salvaged WITHOUT reinstalling Windows 95. All you have to do is look for a hidden system file called SYSTEM.1ST in the root directory of the drive that hosts Windows 95. This file is a copy of the Registry that was created when Windows 95 setup was first deemed successful.
All you have to do is change the file attributes of the file by locating it in the Windows 95 Explorer, and right clicking on it. Choose properties, and then, the General Properties dialog appears. Change the file attributes from READ-ONLY and HIDDEN to ARCHIVE and copy it to the Windows 95 subdirectory.
Then, rename the file from SYSTEM.1ST to SYSTEM.DAT, copying over the corrupt file, and replacing it with workable system profiles.
with the Configuration Backup utility included on diskette with the Windows 95 Resource Kit. |
To put it another way:
-----------------------
To restore the Registry
-----------------------
1 Click the Start button, and then click Shut Down.
2 Click Restart The Computer In MS-DOS Mode, then click Yes.
3 Change to your Windows directory. For example, if your Windows directory is C:\Windows, you would type the following:
4 Type the following commands, pressing ENTER after each one. (Note that SYSTEM.DA0 and USER.DA0 contain the number zero.)
5 Restart your computer.
Following this procedure will restore your registry to its state when you last successfully started your computer.
Additionally, there is a file on your hard disk named SYSTEM.1ST that was created when Windows 95 was first successfully installed. You could also change the file attributes of this file from read-only and hidden to archive to copy the file to SYSTEM.DAT
| |
It is sheer suicide to attempt to edit the Windows 95 Registry without backing up the necessary files before you begin. There is a little life-saver of a utility that comes with the Resource Kit called Configuration Backup (cfgback.exe). It not only lets the user backup the Registry data, but also allows the complete backup, restoration, and storage of up to NINE SEPARATE system configurations!
Besides, what I really recommend before you attempt to edit the Registry, is to first back up your present configuration, and name it something meaningful, so it can be recognized in the event that it needs to be restored at some point in the future.
Later, if a mistake is made in editing the Registry, or if your latest changes have achived some rather undesireable and disasterous effects, all you have to do is open up the Configuration Backup and select RESTORE. After you reboot your machine, the restored configuration returns your system to the settings BEFORE the disaster took place.
The end result here is that the regular use of this utility will minimize the danger involved in editing the Registry, and can always return you to an earlier configuration of your own choosing.
the Configuration Backup utility, and any one of them can restored after a disaster occurs. |
| |
The Registry Editor is a powerful tool that configures and edits your Windows 95 system settings. Registry Editor can be used to view or modify a Registry on a local computer or on another computer over a network. Both the administrator's computer and the remote computer require the Microsoft Remote Registry service to allow remote Registry access.
When you run the Registry Editor, it displays its' data in two panes. On the left side, you have the six Keys, which are shown as folders in "My Computer." Each key can have a set of values. Each value entry is comprised of three parts: the name of the key, its' data type, and the value itself.
The Registry Editor stores this information in .REG files, which are essentially text files containing the data in a specific format. If there is a small plus sign next to a key, then, it will have further data below called a SubKey. These are more commonly known as nested folders, which simply means that folders can themselves contain other folders.
The value entries in the right pane are associated with the selected key in the left pane. A value entry has three parts: the data type of the value (which appears as an icon), the name of the value, and the value itself. A value entry must limit itself to 64k or less, while the size of the actual total Registry is dependant on available hard disk space.
Data types can either be Binary numerical data or readable text. Most of the hardware information is stored as binary data, and can be displayed as either binary or hexadecimal information.
Right-click anywhere in the Registry Editor, and you can create a NEW Key (or subkey), string value, binary value, or DWORD value.
| |
Hkey_Local_Machine
Contains computer specific information about the type of hardware, software, and other preferences on a given PC. This information is used for all users who log onto this computer.
Hkey_Current_Config
This Key points to a branch of the Key Hkey_Local_Machine \Config that contains information about the current hardware configuration.
Hkey_Dyn_Data
This Key points to a branch of Hkey_Local_Machine that contains various bits of information regarding the System's Plug and Play configuration. This information is DYNAMIC, meaning that it may change as devices are added to or removed from the computer.
Hkey_Classes_Root
This Key points to a branch of Hkey_Local_Machine that describes certain software settings. This Key contains essential information about OLE and drag and drop operations, shortcuts, and core aspects of the Windows 95 GUI.
Hkey_Users
This Key contains information about the users that log onto the computer. Both generic and user-specific information is used, and each user who uses the system has their own Subkey.
Hkey_Current_User
This Key points to a branch of Hkey_Users for the user who is currently logged onto the system.
| |
Hkey_Local_Machine may contain the following Subkeys
SubKey Description
------ --------------------------------------------------
Config A collection of configurations for the local computer
Enum Info. on the system's installed hardware devices
Hardware Info. on the ports and modems used with HyperTerminal
Network Info. Created when a user logs on to a networked PC
Security Info. on network security and remote administration
Software Info. about software and it's configuration on system
System The database that controls system start-up, device
driver loading, Windows 95 services, and OS behavior
------- ----------------------------------------------------
Hkey_Local_Machine\Config
The Hkey_Local_Machine\Config subtree contains information about alternate hardware configurations for the computer. For example, it can contain information about multiple configurations to be used when the computer is connected to a network, when it is undocked from a docking station, and so on. Each alternate configuration is assigned a unique identifier, and this configuration ID has a subkey under the Config key. Each configuration appears in the list of hardware profiles in the System option in Control Panel.
When Windows 95 checks the hardware configuration
at system startup, one of three things occurs:
Hkey_Local_Machine\Enum
Windows 95 bus enumerators are responsible for building the hardware tree. This includes assigning an identification code to each device on its bus and retrieving the device's configuration information, either directly from the device or from the Registry. For more information about the hardware tree and bus enumerators, see Introduction to System Configuration, and Windows 95 Architecture.
Bus enumeration information is stored in the Hkey_Local_Machine\Enum subtree. For all types of devices, subkeys contain information such as device type, assigned drive letter, hardware ID, and device manufacturer, plus driver-related information for network components.
The following table shows which devices are enumerated in typical subkeys.
------ -------------------------------------- Subkey Device enumeration ------ --------------------------------------- ESDI Fixed disk devices FLOP Floppy disk devices ISAPNP Plug and Play devices on an ISA bus Monitor Monitor devices Network Network protocol, server, and bindings Root Legacy devices ------- ---------------------------------------
Hkey_Local_Machine\Hardware
Information about serial ports and modems used with the HyperTerminal program.
Hkey_Local_Machine\Network
Network information created when a user logs on to a networked computer, including the user name, primary network provider, whether the logon was validated by a server, and information about the system policies processor.
Hkey_Local_Machine\Security
Information about the network security provider and remote administration capabilities.
Hkey_Local_Machine\Software
The Hkey_Local_Machine\Software subtree contains configuration information about all installed software that can write information in the Registry. The entries in this key apply for anyone using this particular computer, and include definitions for file associations and OLE information. The software subkey contains, for example, the information you add when registering an application to use a specific filename extension and information added during installation of Windows-based applications.
The Hkey_Local_Machine\Software subtree contains several subkeys, including the Classes subkey, plus description subkeys for all installed software that can write to the Registry, as described in the following sections.
Specific Key Information:- (1)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Contains a list of all programmes currently installed on you machine and can be used to remove unmovable entries from the uninstall section of the Add/Remove Control Panel. Please note that is is safer to use Tweakui to achive this same end. (Markd@)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
These are the programs that have been set up to run whenever the computer reboots. Same as the start menu but they start booting first but may finish after if they take a long time to open.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
These programs run only on the first boot of the day such as doing a virus scan.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
Do the same thing but only special set up programs etc. For example if you install the MS service pack for win95 you need to replace many of the basic windows files. Since these files are in use you cannot just copy and replace. The installation routine copies the files to a temp directory, adds runservices keys to the registry, tells you to reboot, and on the reboot copies the files from the temporary directory to the windows directory at the very start of the boot process and finally erases the runservices entries.
This is why you should always reboot after each installation. What a second install or you might do is erase the temp files or the runservices entries which results in a failure of the installation.
Hkey_Local_Machine\System
The data in Hkey_Local_Machine\System is organized
into control sets that contain a complete set of parameters for device
drivers and services that can be loaded with Windows 95. All data that
controls startup is described in the CurrentControlSet subtree under Hkey_Local_Machine\System.
This control set has two parts:
The Control key contains information used to control system startup, including the computer's network name and the subsystems to start.
The Services key contains information to control the loading and configuration of drivers, file systems, and so on. The data in the Services key also controls how these services call each other.
[3-6-2] Hkey_Current_Config may contain the following Subkeys
To be included in a future version of the FAQ.
[3-6-3] Hkey_Dyn_Data may contain the following Subkeys
To be included in a future version of the FAQ.
[3-6-4] Hkey_Classes_Root may contain the following Subkeys
To be included in a future version of the FAQ.
[3-6-5] Hkey_Users may contain the following Subkeys
To be included in a future version of the FAQ.
[3-6-6] Hkey_Current_User may contain the following Subkeys
To be included in a future version of the FAQ.
Sources, References and people.
Date: Sun, 15 Dec 1998 12:01:35 -0500 (1) From: "Joseph C. Kennedy" <[email protected]> Subject: Windows Registry
Permission is granted freely to distribute this article in electronic form as long as it is posted in its entirety including this copyright statement. This article may not be distributed for financial gain. This article may not be included in any commerical collections or compilations without the express permision of the author, Hans Klarenbeek([email protected])