presentation on basics of registry editor

WINDOWSREGISTRY

CONTENTS

1. INTRODUCTION2. THE PAST3. WHAT IS REGISTRY AND WHY?4. REGISTRY ORGANISATION5. REGISTRY STRUCTURE6. REGISTRY TOOLS7. CONCLUSION8. REFERENCE

INTRODUCTION• HEART AND SOUL OF THE WINDOWS

OPERATING SYSTEM• CONTAINS CONFIGURATION DATA THAT MAKES

OS WORK• SERVES THOUSANDS OF VALUES IN MINUTE• PLAYS KEY ROLE IN WINDOWS• CONTAINS THOUSANDS OF SETTINGS WHICH

YOU MAY NOT SEE IN DIALOG BOX

1. INTRODUCTION2. THE PAST3. WHAT IS REGISTRY AND

WHY?4. REGISTRY ORGANISATION5. REGISTRY STRUCTURE6. REGISTRY TOOLS7. CONCLUSION8. REFERENCE

THE PAST• MS DOS USED CONFIG.SYS AND AUTOEXE.BAT• WINDOWS 3.0 BRAUGHT INI FILES• WINDOWS 3.1 INTRODUCED REGISTRY FOR

STORING OBJECT LINKING EMBEDDING SETTINGS• WINDOWS 95 AND NT 3.5 EXPANDED REGISTRY• THE REGISTRY HAS BEEN AROUND SINCE BEFORE

1995



INI FILE SYSTEM• STORED IN INI FILES• CONTAINS ONE OR MORE SECTIONS WITH ONE

OR MORE SETTINGS IN EACH SECTION• THEY PROVIDE NO HIERARCHY• STORING BINARY VALUES IN THEM IS

CUMBERSOME• THEY PROVIDE NO STANDARD FOR STORING

SIMILAR TYPES OF SETTINGS• INABILITY TO BUILD COMPLEX RELATIONSHIPS

BETWEEN APPLICATIONS AND THE OPERATING SYSTEM

• ACESS TO INFORMATION IS TOO SLOW



WHAT IS REGISTRY AND WHY• HIERARCHICAL DATABASE• FASTER INFORMATION ACESS• ABILITY TO BUILD COMPLEX RELATIONSHIPS

BETWEEN APPLICATIONS AND THE OPERATING SYSTEM

• APPLICATION COMPATIBLE• POLICY MANAGEMENT• SECURITY MANAGEMENT• DEPLOYMENT CUSTOMIZATION• HARDWARE PROFILES• PERFORMANCE MONITORING



ORGANISATION• FILLED WITH HEXADECIMAL NUMBERS• FIVE SECTIONS – EACH HAVE ITS OWN STORAGE

LOCATION AND LOG FILE• THIS SECTIONS ARE CALLED HIVES• HIVE CONTAINS KEYS AND VALUES• VALUE – INFORMATION OR DATA ASSIGNED TO

A KEY• EACH VALUE HAS NAME, DATA TYPE AND A

VALUE• ENTRY’S NAME IS STORED AS A UNICODE

CHARACTER STRING• ENTRY’S TYPE IS STORED AS AN INTEGER INDEX



ORGANISATION• WINDOWS AND APPLICATION STORES DATA IN

REGISTRY WHICH MAKES COMMON STORAGE• FIVE MAIN HIVES ARE

HKEY_CLASSES_ROOTHKEY_CURRENT_USERHKEY_LOCAL_MACHINEHKEY_USERSHKEY_CURRENT_CONFIG



ORGANISATION1. INTRODUCTION2. THE PAST3. WHAT IS REGISTRY AND


SID• SID IS SECURITY IDENTIFIER USED FOR

IDENTIFICATION OF USER• SID – COMPUTER ACCOUNTS, USER

ACCOUNTS, GROUPS• SID CONTAINS USER RIGHTS AND

PRIVILEGES• SOME COMMONLY USED SIDS ARE

S−1−5−18 - LOCAL SYSTEM OR SYSTEMS−1−5−19 - LOCAL SERVICE S−1−5−DOMAIN−500 - ADMINISTRATORS−1−5−DOMAIN−501 - GUESTS−1−5−32−544 - ADMINISTRATORSS−1−5−32−545 - USERS



DATA TYPES• COMMONLY USED DATA TYPES ARE

REG_BINARY : BINARY DATAREG_DWORD : DOUBLE−WORD VALUES (32−BIT)REG_DWORD_BIG_ENDIAN : DOUBLE−WORDREG_DWORD_LITTLE_ENDIAN : DOUBLE−WORDREG_EXPAND_SZ : VARIABLE−LENGTH TEXTREG_FULL_RESOURCE_DESCRIPTORREG_LINK : A LINKREG_MULTI_SZ : LISTS OF STRINGSREG_NONE : NO DEFINED TYPEREG_QWORD : QUADRUPLE−WORD VALUES (64−BIT)REG_RESOURCE_LIST : LIST OF REG_FULL_RESOURCE_DESCRIPTION VALUESREG_RESOURCE_REQUIREMENTS_LISTREG_SZ : FIXED−LENGTH TEXT



STRUCTURE• KEY’S NAME IS LIMITED TO 512 ANSI OR

256 UNICODE CHARACTERS• REGISTRY HIVES ARE STORED IN

%SYSTEMROOT%\SYSTEM32\CONFIG• WE CAN USE ALL CHARACTERS OTHER

THAN ‘\’, ’*’ AND ‘?’ FOR NAMING A KEY.• EVERY KEY CONTAINS ATLEAST ONE VALUE

THAT IS DEFAULT VALUE.• PER USER SETTINGS IS STORED IN

HKEY_CURRENT_USER.• PER COMPUTER SETTINGS STORED IN

HKEY_LOCAL_MACHINE



HKEY_USERS• CONTAINS ATLEAST 3 SUBKEYS• .DEFAULT CONTAINS USER SETTINGS BEFORE

LOGGING IN TO WINDOWS• SID CONTAINS USER’S DESKTOP PREFERENCES

AND CONTROL PANEL SETTINGS• SID – CLASSES CONTAINS SECURITY

IDENTIFIER OF THE CONSOLE USER



HKEY_CURRENT_USER• CONTAINS PER USER SETTINGS• COMMONLY USED KEYS ARE

APPEVENTS : ASSOCIATES SOUNDS WITH EVENTSCONSOLE : DATA FOR CONSOLE SUBSYSTEMCONTROL PANEL : ACCESSIBILITY, REGIONAL AND DESKTOP APPEARANCE SETTINGSENVIRONMENT : STORES ENVIRONMENT VARIABLESIDENTITIES : ONE SUBKEY FOR EACH IDENTITY IN

MICROSOFT OUTLOOKKEYBOARD LAYOUT : LAYOUTNETWORK : INFORMATION ABOUT MAPPED

NETWORK DRIVERSSOFTWARE : USER PER APPLICATION SETTINGS



HKEY_LOCAL_MACHINE• CONTAINS PER COMPUTER SETTINGS• COMMONLY USED KEYS ARE

HARDWARE : DATA DESCRIBING THE HARDWARE THAT WINDOWS AS IT STARTS,

INFORMATION ABOUT DEVICES, DEVISE DRIVERS AND RESOURCE ASSOSCIATED WITH THEM.SAM : WINDOWS’S LOCAL SECURITY DATABASESECURITY : CONTAINS SAM DATABASE AND SECURITY SETTINGSSOFTWARE : PER COMPUTER APPLICATION SETTINGSSYSTEM : CONTROL SETS



HKEY_CLASSES_ROOT• CONTAINS TWO TYPES OF SETTINGS

– FILE ASSOSCIATION– CLASS REGISTRAITION

CLASS REGISTRATION IS USED FOR COMPONENT OBJECT MODEL



HKEY_CURRENT_CONFIG• IT IS A LINK TO CONFIGURATION DATA FOR THE

CURRENT HARDWARE PROFILE1. INTRODUCTION2. THE PAST3. WHAT IS REGISTRY AND


REGISTRY MANAGEMENT TOOLS• REGISTRY EDITOR IS THE PRIMARY TOOL• CONSOLE REGISTRY TOOL FOR WINDOWS

(REG.EXE) IS COMMAND LINE REGISTRY TOOL

• WINDIFF IS A TOOL COMES WITH THE WINDOWS XP SUPPORT TOOLS

• MICROSOFT WORD FROM THE OFFICE PACKAGE.



CONCLUSION• WE CAN INCREASE THE PERFORMANCE BY

SUITABLY VARYING THE SETTINGS • SIMPLE STRUCTURE• SYSTEM REGISTRY HAS A PRACTICAL

LIMITED SIZE


WHY?4. REGISTRY ORGANISATION5. REGISTRY STRUCTURE6. REGISTRY BASICS7. CONCLUSION8. REFERENCE

REFERENCE• JERRY HONEYCUTT : MICROSOFT WINDOWS

XP REGISTRY GUIDE• http://www.veritas.com• http://www.winternals.com• http://www.honeycutt.com• http://www.heaventools.com


WHY?4. REGISTRY ORGANISATION5. REGISTRY STRUCTURE6. REGISTRY BASICS7. CONCLUSION8. REFERENCE

http://www.veritas.com/

http://www.winternals.com/

http://www.honeycutt.com/

http://www.heaventools.com/

THANK

YOU

presentation on basics of registry editor

Education

windows registry

expanded registry

organisation introduction

organisation windows

user settings

user hkey

console user introduction

list reg