Registry Architecture

1 What exactly is the Windows 95 Registry?

2 Recovering Registry Data

3 Configuration Backup

4 The Registry Editor (REGEDIT.EXE)

5 The six Hkey_ handles

6 SubKeys of the six Hkey Handles


index top end <-->

1 What exactly is the Windows 95 Registry?

The Registry is a central database that is created by Windows 95 during installation. The entries in that database consist of the hardware, software, users, and preferences data for a single PC, or any PC on a network. Whenever the user makes changes to the Control Panel settings, File Associations, System Policies, or installed software, the changes are reflected in the Registry.

These Registry settings can be viewed with the Registry Editor (REGEDIT.EXE), which is installed into the Windows\System folder when Windows 95 is installed from CD-ROM. The floppy disk version of Windows 95 will NOT install this editor.

By default, REGEDIT.EXE will NOT appear on any of the system's menus, or the Start button. So, you will have to add your own shortcut, or you can click on the START button, select RUN, and in the OPEN: command line type REGEDIT and press ENTER. If the Registry Editor is installed on your system, it will appear on your Desktop, ready to use.

The Registry replaces the dreaded .INI files from Windows 3.1, and because the information is presented in hierarchical form, the Registry supports nested folders, which .INI files do not support. One of the many benefits of this is that in a network environment, users can log onto any PC in the network, just as it were the very same PC on their desk! In addition, several users can store configuration data on a single machine.

POWERTIP!

You can add the Registry Editor to your system
by using the right mouse button to drag the
file REGEDIT.EXE from Explorer to the Desktop.

Registry Editor displays the contents of the Registry in six subtrees called Keys. Keys can contain data strings, as well as SubKeys. Each of these six Keys begins with Hkey_ which indicates that it can be used by a program to access resources.

When you first look at the Registry Editor, this structure looks extremely complicated. Think of the Registry Editor as another type of Windows Explorer, only this explorer ventures into the uncharted waters of your systems' configuration!


index top end <-->

2 Recovering Registry Data

In Windows 95, data is written to the Registry only when a flush occurs — that is, when something happens after changed data has aged more than a few seconds or when an application intentionally flushes the data to the hard disk.

Each time Windows 95 successfully starts, the operating system backs up the Registry by copying the current SYSTEM.DAT and USER.DAT files to SYSTEM.DA0 and USER.DA0, respectively. If Windows 95 fails to start, the backed-up Registry from the last successful startup can be copied over the current Registry. This method recovers the last successful settings after a system failure.

If the Registry should ever become damaged, it can be salvaged WITHOUT reinstalling Windows 95. All you have to do is look for a hidden system file called SYSTEM.1ST in the root directory of the drive that hosts Windows 95. This file is a copy of the Registry that was created when Windows 95 setup was first deemed successful.

All you have to do is change the file attributes of the file by locating it in the Windows 95 Explorer, and right clicking on it. Choose properties, and then, the General Properties dialog appears. Change the file attributes from READ-ONLY and HIDDEN to ARCHIVE and copy it to the Windows 95 subdirectory.

Then, rename the file from SYSTEM.1ST to SYSTEM.DAT, copying over the corrupt file, and replacing it with workable system profiles.

POWERTIP!

You can also maintain back-ups of the Registry
with the Configuration Backup utility included
on diskette with the Windows 95 Resource Kit.

To put it another way:

-----------------------
To restore the Registry
-----------------------

1 Click the Start button, and then click Shut Down.

2 Click Restart The Computer In MS-DOS Mode, then click Yes.

3 Change to your Windows directory. For example, if your Windows directory is C:\Windows, you would type the following:

cd C:\Windows

4 Type the following commands, pressing ENTER after each one. (Note that SYSTEM.DA0 and USER.DA0 contain the number zero.)

attrib -h -r -s system.dat
attrib -h -r -s system.da0
copy system.da0 system.dat
attrib -h -r -s user.dat
attrib -h -r -s user.da0
copy user.da0 user.dat

5 Restart your computer.

Following this procedure will restore your registry to its state when you last successfully started your computer.

Additionally, there is a file on your hard disk named SYSTEM.1ST that was created when Windows 95 was first successfully installed. You could also change the file attributes of this file from read-only and hidden to archive to copy the file to SYSTEM.DAT


index top end <-->

3 Configuration Backup

It is sheer suicide to attempt to edit the Windows 95 Registry without backing up the necessary files before you begin. There is a little life-saver of a utility that comes with the Resource Kit called Configuration Backup (cfgback.exe). It not only lets the user backup the Registry data, but also allows the complete backup, restoration, and storage of up to NINE SEPARATE system configurations!

Besides, what I really recommend before you attempt to edit the Registry, is to first back up your present configuration, and name it something meaningful, so it can be recognized in the event that it needs to be restored at some point in the future.

Later, if a mistake is made in editing the Registry, or if your latest changes have achived some rather undesireable and disasterous effects, all you have to do is open up the Configuration Backup and select RESTORE. After you reboot your machine, the restored configuration returns your system to the settings BEFORE the disaster took place.

The end result here is that the regular use of this utility will minimize the danger involved in editing the Registry, and can always return you to an earlier configuration of your own choosing.

POWERTIP!

You can save up to NINE separate backups with
the Configuration Backup utility, and any one
of them can restored after a disaster occurs.


index top end <-->

4 The Registry Editor (REGEDIT.EXE)

The Registry Editor is a powerful tool that configures and edits your Windows 95 system settings. Registry Editor can be used to view or modify a Registry on a local computer or on another computer over a network. Both the administrator's computer and the remote computer require the Microsoft Remote Registry service to allow remote Registry access.

When you run the Registry Editor, it displays its' data in two panes. On the left side, you have the six Keys, which are shown as folders in "My Computer." Each key can have a set of values. Each value entry is comprised of three parts: the name of the key, its' data type, and the value itself.

The Registry Editor stores this information in .REG files, which are essentially text files containing the data in a specific format. If there is a small plus sign next to a key, then, it will have further data below called a SubKey. These are more commonly known as nested folders, which simply means that folders can themselves contain other folders.

The value entries in the right pane are associated with the selected key in the left pane. A value entry has three parts: the data type of the value (which appears as an icon), the name of the value, and the value itself. A value entry must limit itself to 64k or less, while the size of the actual total Registry is dependant on available hard disk space.

Data types can either be Binary numerical data or readable text. Most of the hardware information is stored as binary data, and can be displayed as either binary or hexadecimal information.

Right-click anywhere in the Registry Editor, and you can create a NEW Key (or subkey), string value, binary value, or DWORD value.


index top end <-->

5 The six Hkey_ handles

Hkey_Local_Machine

Contains computer specific information about the type of hardware, software, and other preferences on a given PC. This information is used for all users who log onto this computer.

Hkey_Current_Config

This Key points to a branch of the Key Hkey_Local_Machine \Config that contains information about the current hardware configuration.

Hkey_Dyn_Data

This Key points to a branch of Hkey_Local_Machine that contains various bits of information regarding the System's Plug and Play configuration. This information is DYNAMIC, meaning that it may change as devices are added to or removed from the computer.

Hkey_Classes_Root

This Key points to a branch of Hkey_Local_Machine that describes certain software settings. This Key contains essential information about OLE and drag and drop operations, shortcuts, and core aspects of the Windows 95 GUI.

Hkey_Users

This Key contains information about the users that log onto the computer. Both generic and user-specific information is used, and each user who uses the system has their own Subkey.

Hkey_Current_User

This Key points to a branch of Hkey_Users for the user who is currently logged onto the system.


index top end <-->

6 SubKeys of the six Hkey Handles

Hkey_Local_Machine may contain the following Subkeys

SubKey   Description
------   --------------------------------------------------
Config   A collection of configurations for the local                           computer

Enum     Info. on the system's installed hardware devices

Hardware Info. on the ports and modems used with                                        HyperTerminal

Network  Info. Created when a user logs on to a networked PC

Security Info. on network security and remote administration

Software Info. about software and it's configuration on                                 system

System   The database that controls system start-up, device
         driver loading, Windows 95 services, and OS behavior
-------  ----------------------------------------------------

Hkey_Local_Machine\Config

The Hkey_Local_Machine\Config subtree contains information about alternate hardware configurations for the computer. For example, it can contain information about multiple configurations to be used when the computer is connected to a network, when it is undocked from a docking station, and so on. Each alternate configuration is assigned a unique identifier, and this configuration ID has a subkey under the Config key. Each configuration appears in the list of hardware profiles in the System option in Control Panel.

Hkey_Local_Machine\Enum

Windows 95 bus enumerators are responsible for building the hardware tree. This includes assigning an identification code to each device on its bus and retrieving the device's configuration information, either directly from the device or from the Registry. For more information about the hardware tree and bus enumerators, see Introduction to System Configuration, and Windows 95 Architecture.

Bus enumeration information is stored in the Hkey_Local_Machine\Enum subtree. For all types of devices, subkeys contain information such as device type, assigned drive letter, hardware ID, and device manufacturer, plus driver-related information for network components.

The following table shows which devices are enumerated in typical subkeys.

------  --------------------------------------
Subkey  Device enumeration
------  ---------------------------------------
ESDI    Fixed disk devices
FLOP    Floppy disk devices
ISAPNP  Plug and Play devices on an ISA bus
Monitor Monitor devices
Network Network protocol, server, and bindings
Root    Legacy devices
------- ---------------------------------------

Hkey_Local_Machine\Hardware

Information about serial ports and modems used with the HyperTerminal program.

Hkey_Local_Machine\Network

Network information created when a user logs on to a networked computer, including the user name, primary network provider, whether the logon was validated by a server, and information about the system policies processor.

Hkey_Local_Machine\Security

Information about the network security provider and remote administration capabilities.

Hkey_Local_Machine\Software

The Hkey_Local_Machine\Software subtree contains configuration information about all installed software that can write information in the Registry. The entries in this key apply for anyone using this particular computer, and include definitions for file associations and OLE information. The software subkey contains, for example, the information you add when registering an application to use a specific filename extension and information added during installation of Windows-based applications.

The Hkey_Local_Machine\Software subtree contains several subkeys, including the Classes subkey, plus description subkeys for all installed software that can write to the Registry, as described in the following sections.

Specific Key Information:- (1)

Hkey_Local_Machine\System


Sources, References and people.

Date:    Sun, 15 Dec 1998 12:01:35 -0500 (1)
From:    "Joseph C. Kennedy" <[email protected]>
Subject: Windows Registry


Disclaimer

This article and web site listing is provided without any express or implied warranties. While every effort has been taken to ensure the accuracy of the information contained in this article, the author, faq maintainers and contributors assume no responsibility for errors or ommissions, or for damages resulting from the use of the information herin. This document respects all owners of their repected trademarks and or copyrights, Microsoft Windows 95 and Windows NT are the sole copyright of Microsoft Corporation and thus belongs to Bill.

Copyright Notice ©

Windows95 (Win95-L) FAQ COPYRIGHT © 1998-7 by Hans Klarenbeek

All Rights Reserved by the author, Hans Klarenbeek

Windows95 (Win95-L) FAQ © 1998-7 PERMISSION:

Permission is granted freely to distribute this article in electronic form as long as it is posted in its entirety including this copyright statement. This article may not be distributed for financial gain. This article may not be included in any commerical collections or compilations without the express permision of the author, Hans Klarenbeek([email protected])