Registry

The Windows Registry is a critical component of Microsoft Windows. It is used to store and manage configuration settings about the software, hardware, and user preferences. It serves as a centralized database that stores settings for both the operating system itself and the applications.

The registry is specific to Windows – other operating systems have different ways to manage configuration settings.

The registry is protected by an ACL (access client list). The admin does not have the right to change every entry, although he can change the rights as needed.

The registry can be modified with Regedit.

Back up your data before modifying the registry.

Make a note of the changes you make, so you can change them back if needed.

If you change the wrong data using Regedit, you can easily cause problems, or even make the computer unbootable.

Only change data using Regedit if you have clear instructions, and know what you are doing – or on a test machine which you don’t mind breaking.

It’s usually safer not to edit the registry directly – try to find another way to change the settings instead.

The files which constitute the registry are for the user part: ntuser.dat (in the user profile) and for the computer part the files components, default, SAM, Security, Software, System (in the system drive under \system32\config).

The Windows Registry is organized into a hierarchical structure that resembles a tree, with keys and subkeys. These are the roots;

• HKEY_CLASSES_ROOT (HKCR): Contains information about file associations and OLE object class registrations.
• HKEY_CURRENT_USER (HKCU): Stores user-specific settings and configurations for the currently logged-in user.
• HKEY_LOCAL_MACHINE (HKLM): Contains system-wide settings and configurations.
• HKEY_USERS (HKU): Stores user profiles for all users on the system.
• HKEY_CURRENT_CONFIG (HKCC): Contains information about the current hardware profile.

The tree structure is as follows:

• HKEY_LOCAL_MACHINE = root key or branch
• HARDWARE, SAM, SECURITY... = Hives
• Key
• Sub Key
• Value

The different types of values are :

• Reg_SZ = String, character string
• Reg_expand_SZ = Expand String, to be used when the data will contain an environment variable
• Reg_Multi_SZ = list
• Reg_binary = binary data
• Reg_Dword = double word of 16 bit, or 32 bits
• Reg_qword = quadruple word of 16 bit, or 64 bits

Examples of registry changes:

• Activate the Num Lock before opening session 

HKEY_USERS\.DEFAULT\Control Panel\KeyboardInitialKeyboardIndicators to set to 2

• Change the default keyboard before loading Windows

HKEY_USERS\.DEFAULT\Keyboard Layout\Preload

Double click on 1 and change the number to your local layout

00000409 English (United States)

00000809 English (United Kingdom)

0000040c French (Standard)

00000407 German (Standard)

You can export and import Registry settings to transfer configurations between computers or create backups. This is done using .reg files, which contain a snapshot of specific Registry keys and values.

To add a pre saved registry value using a script file:

• Edit the registry value and export it as a .reg file(i.e. keyboard.reg). For example, for the export of the value that changes the Num Lock key before opening session, the file will look like this:
  Windows Registry Editor Version 5.00
  HKEY_USERS\.DEFAULT\Control Panel\Keyboard
  "InitialKeyboardIndicators"="2"
• Create a batch file to import the registry file.
  For more information on batch files, see here.
  For example, you could create a batch file containing this text:
  regedit /s C:\Users\Admin\Desktop\Keyboard.reg
• Run the batch file with admin rights on the other computers