REGISTRY EDITOR

GROUP 1:
KARLA MAE TULIAO
JOHN CARL DEVERA
STEPHANIE BARROGA
ARLIZ JANE SONAJO
ELHISA MELENDRES
SCHARLET DIVINE BATANGAN
ANGEL DESALLA BALUNGAYA
RIX CANDIDO DOMIGO
REGISTRY
The registry is a system-defined database in which applications and system
components store and retrieve configuration data.
STRUCTURE of the REGISTRY

The registry is a hierarchical database that stores the values of variables in

Windows and the applications and services that run on Windows. The operating
system and other programs also use the registry to store data about users and
about the current configuration of the system and its components. Because the
registry is available whenever the system is running, programs that start and stop
can keep persistent data in the registry.
STRUCTURE of the REGISTRY
• Much of the registry consists of nested containers known as
subtrees, keys, and subkeys, which are like folders. The actual data is
stored in the registry entries, the lowest level element in the registry.
The entries are like files. The series of nested containers make up a
path to each entry. Because entry names are unique only within a
path, entries are referenced by their full registry path and name.
SUBTREE
• Subtrees are the root, or primary divisions, of the registry.
• The Windows Server 2003 registry is divided into five subtrees.
Subtrees themselves do not contain configuration data; they
contain the keys, subkeys, and entries in which the data is stored.
THE FOLLOWING ARE THE FIVE SUBTREES OF THE REGISTRY EDITOR:

• HKEY_CLASSES_ROOT
• HKEY_CURRENT_USER
• HKEY_LOCAL_MACHINE
• HKEY_USERS
• HKEY_CURRENT CONFIG
HKEY_CLASSES_ROOT
 Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003
with SP1, Windows Server 2003 with SP2
The HKEY_CLASSES_ROOT subtree contains two types of data:
1. Data that associates file types with programs. The file type subkeys in
HKEY_CLASSES_ROOT have the same name as the file name extension for the file
type, such as .exe. File type associations are stored in the registry, but you should
use Windows Explorer to change them. In Windows Explorer, from
the Tools menu, click Folder Options, and then click the File Types tab.
2. Configuration data for COM objects, Visual Basic programs, or other automation.
The configuration subkeys use either the program IDs (such as for COM, Visual
Basic, automation, and scripting) or parent keys for other classes of information
(such as for CLSID, Interface, TypeLib, AppId, and so on).
HKEY_CLASSES_ROOT
The content of HKEY_CLASSES_ROOT comes from two sources:
1. HKEY_LOCAL_MACHINE\SOFTWARE\Classes
2. HKEY_CURRENT_USER\SOFTWARE\Classes
If a subkey or entry appears in either location, then it also appears
in HKEY_CLASSES_ROOT.
If the values of entries in the two Classes subkeys conflict, then
only the value in HKEY_CURRENT_USER\SOFTWARE\Classes appears
in HKEY_CLASSES_ROOT.
HKEY_CLASSES_ROOT
In Windows NT 4.0 and earlier, HKEY_CLASSES_ROOT displayed the
data only in HKEY_LOCAL_MACHINE\SOFTWARE\Classes. The current,
merged configuration lets the system independently register program
classes for each user. This feature is known as per-user class
registration.
HKEY_CLASSES_ROOT
Per-user class registration has several benefits
• Multiple users can customize a single computer. For example, one user can install an
application that uses a particular file type, and another user can install a different application
that uses the same file type without affecting the first user.
• Roaming class registration. Because class registrations are stored in the user profile, the class
registrations are loaded on each computer through the application management extension
after the profile is loaded. When the user logs on to a different computer, the registration
travels with the user through the directory and is written to a local portion of the user profile.
• Note: Roaming class registration is only available when using Intellimirror Software
Management.
• Increased registry security. Previously, users could change or delete registry keys in HKLM\
SOFTWARE\Classes, thus breaking an application or changing its behavior. However, with class
information now written to the user profile, a system administrator can limit access to HKLM\
SOFTWARE\Classes.
HKEY_CURRENT_USER
 Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1,
Windows Server 2003 with SP2
• The HKEY_CURRENT_USER subtree contains the user profile for the user who is currently
logged on to the computer. The user profile includes environment variables, personal program
groups, desktop settings, network connections, printers, and application preferences. The data
in the user profile is similar to the data stored in the Win.ini file in Windows 3.x.
• The HKEY_CURRENT_USER subtree does not contain any data. It just stores a pointer to the
content of the HKEY_USERS\Security ID (SID) of current user subkey. Therefore, the content of
that subkey also appears in HKEY_CURRENT_USER, and it can be viewed and changed in either
location. The HKEY_CURRENT_USER subtree just provides easier access to the data.
• A new HKEY_CURRENT_USER subtree is created each time a user logs on. The data for the
subtree comes from the profile of the current user. If no profile is available, then the subtree is
built from the user profile settings established for a default user, which are stored in System
drive\Documents and Settings\Default User (WINNT)\Ntuser.dat.
HKEY_LOCAL_MACHINE
 Applies To: Windows Server 2003, Windows Server 2003 R2,
Windows Server 2003 with SP1, Windows Server 2003 with SP2
• The HKEY_LOCAL_MACHINE subtree contains information about the
local computer system, including hardware and operating system
data, such as bus type, system memory, device drivers, and startup
control parameters.
HKEY_CURRENT CONFIG
 Applies To: Windows Server 2003, Windows Server 2003 R2, Windows
Server 2003 with SP1, Windows Server 2003 with SP2
• The HKEY_CURRENT_CONFIG (HKCC) subtree stores configuration data
for the current hardware profile.
• This subtree does not contain any data. It just stores a pointer to the
content of the Hardware Profiles\Current subkey in the
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\CurrentControlSet
\Hardware Profiles subkey. The content of the Current subkey appears
in HKEY_CURRENT_CONFIG, and it can be viewed and changed in
either location. This subtree provides easier access to the data.
KEY
• Keys are the next level down from subtree, which contain at least
one subkey (for example, Hardware Key). Some subtrees do not
have keys.
SUBKEYS
• Subkeys are the next level down from keys or subtrees (if the
subtree has no keys). Subkeys store entries and other subkeys.
ENTRY
• Entries are the lowest-level element in the registry. They appear in
the right pane of the registry editor window. Each entry consists of
the entry name, its Data Types in the Registry (which defines the
length and format of data that the entry can store), and a field
known as the value of the registry entry. Data is stored in the value.
Entries are referenced by their registry path and name.
• Entries store the actual configuration data for the operating system
and the programs that run on the system. As such, they are
different from subtrees, keys, and subkeys, which are merely
containers.
HIVE FILES
The permanent parts of the registry are stored as a set of files called the hive files. You can find a list of
locations for these files in the hivelist subkey in HKLM\SYSTEM\CurrentControlSet\Control. These files are
saved in systemroot\System32\Config and updated with each login. They consist of the following files,
which store four of the five keys in HKEY_LOCAL_MACHINE and one key in HKEY_USERS:
• SAM Contains information stored in the key HKLM\SAM about the Security Accounts Manager (SAM)
service.
• SECURITY Contains the security information stored in the key HKLM\SECURITY.
• SOFTWARE Contains information stored in the key HKLM\SOFTWARE about the computer's software
configuration.
• SYSTEM Contains information stored in the HKLM\SYSTEM about the computer's system configuration.
• DEFAULT Contains the default system information that is stored in the key HKEY_USERS\.DEFAULT.
HKEY_LOCAL_MACHINE\HARDWARE is not stored as a file, because it is recreated each time the system
starts.
Using the Registry Editor
• If you need to view the registry or to change a value that can be changed only in the registry
directly, use Regedit.exe, the registry editor installed with Windows Server 2003. An alternative
registry editor, Regedt32.exe, which is included in Windows 2000 and earlier, is not included in
Windows Server 2003, although many of its functions appear in the Windows Server 2003 version
of Regedit.exe.
Caution!!!!!
• Do not experiment with the registry or change any settings if you do not understand them
completely. The vast majority of registry settings are maintained automatically, and many can only
be maintained correctly by the operating system itself. Changing these settings can produce
unexpected, contradictory, or uninterpretable instructions in operating system and application
programs. Editing registry settings can also degrade the performance of your system, obscure the
location of essential files, or invalidate your Windows licensing agreement. Before making any
changes, be sure to back up the registry by using one of the methods described in 
Backing Up and Restoring the Registry. After you make changes, be sure to test them before
returning your computer to normal operation.