presentation on Windows and basics registry. These slides deals with the basic terms and working of windows registry under Windows O.S. Windows tricks by registry.

1. By Parekh Jigar H
10MCA059

2. Registry is a hierarchical database of windows
Many changes are made to the system configurations
through various Control Panel applets and applied to
Registry

3. Type Description
REG_BINARY Binary data. Displays binary data in hexadecimal notation
REG_DWORD Double-word values 32 bits.
REG_EXPAND_SZ Variable-length text to store long string
REG_NONE Values with no defined type.
REG_LINK A link. You can’t create REG_LINK values

4. REG_DWORD_BIG_ENDIAN REG_DWORD_LITTLE_ENDIAN
REG_FULL_RESOURCE_DESCRIPTOR REG_MULTI_SZ
REG_QWORD REG_QWORD_BIG_ENDIAN
REG_QWORD_LITTLE_ENDIAN REG_RESOURCE_LIST
REG_RESOURCE_REQUIREMENTS_LIST REG_SZ
Some data types can be used in only 64 bit windows
Some are for only Windows

5. Each time Windows XP starts, Registry is loaded into
memory from files on the hard drive …
Changes become effective immediately
Only on rare occasions is rebooting the system
required

6. The Registry is stored not in one file, but rather in several
Each contains a discrete body of keys, subkeys and values
known as a hive
Complete listing of path and filenames are found in Registry at
subkey:
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetCon
trolhivelist

7. The five highest-level keys (HKEY) in the
Registry are:
 HKEY_CLASSES_ROOT
 HKEY_CURRENT_USER
 HKEY_LOCAL_MACHINE
 HKEY_USERS
 HKEY_CURRENT_CONFIG

8. Abbreviations for the root keys are:
HKEY_CLASSES_ROOT—“HKCR”
HKEY_CURRENT_USER—“HKCU”
HKEY_USERS—“HKU”
HKEY_LOCAL_MACHINE—“HKLM”
HKEY_CURRENT_CONFIG—“HKCC”

9. Container for information pertaining to application associations
based on file extensions and COM object data

10. Container for profile for whichever user is currently
logged on
Contents are built each time a user logs on by copying
appropriate subkey from the HKEY_USERS key

11. Controls the local computer, establishing configuration of
hardware and operating system environment
Includes information about the hardware devices, installed
applications, device drivers, kernel services, physical
settings
Dependent on physical composition of the hardware and
software present on machine

12. Main 5 sub keys of HKLM
HARDWARE
SAM
SECURITY
SOFTWARE
SYSTEM
All these subkeys except HARDWARE are saved to hive
files in
%systemroot%system32config

13. HARDWARE-
Sub key containing data related directly to physical
devices installed on a computer
SAM –Security Account Manager
Location where user accounts and group
memberships are defined
SECURITY:
security policy on the local machine Applies to all
local users

14. SOFTWARE:
It serves as a container for data about installed software
and mapped file extensions
Resides in a hive file named SOFTWARE in
%systemroot%System32config directory

15. SYSTEM
It stores data required to boot Windows XP:
 Startup parameters
 Loading order for device drivers
 Service startup credentials (settings and
parameters)
 Basic operating system behavior

16. Contains profiles for all current users who have ever logged
onto system
Each time system boots builds the key:
Loads a default user profile file and locally stored copies
of either "Ntuser.dat" or "Ntuser.man" from user's profile
directory (Documents and Settings%username%)
HKEY_USERS.Default node is location for the default
(new) user settings

17. Container for data that pertains to whatever hardware
profile is currently in use
Links to the:
HKLMSYSTEMCurrentControlSetHardwareProfilesCurrent
Maintained for backward compatibility
Not strictly required by Windows XP

18. Registry key Logging and backup file
HKLMSAM Sam, Sam.log,Sam.sav
HKLMSECURITY Security, Security.log, Security.sav
HKLMSOFTWARE Software, Software.log, Software.sav
HKLMSYSTEM System, System.alt, System.log,
System.sav
HKU.Default Default, Default.sav, Default.log
HKCU Ntuser.dat, Ntuser.dat.log

19. The Registry file extensions:
No extension - the actual storage file itself (the hive file)
.alt -The backup file for the subkey Only HKLMSYSTEM
has a backup file
.log -log files record all successful and failed changes to
Registry Verifies all modifications are completed
.sav -copies of original key values after the text portion of
Windows XP installation

20. Name Default Path
AppData %UserProfile%Application Data
Personal %UserProfile%My Documents
Desktop %UserProfile%Desktop
Cookies %UserProfile%Cookies
Cache %UserProfile%Local SettingsTemporary Internet Files
Recent %UserProfile%Recent
HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerUser Shell

21. GUIDs are numbers that uniquely identify objects such as
computers, program components, and devices.
All GUIDs have the same interesting format. They’re 16-
byte hexadecimal numbers in groups of 8, 4, 4, 4, and 12
digits (0 through 9 and A through F). A dash divides each
group of digits, and curly brackets enclose the whole
number

22. ActiveX Cache {88C6C381-2E85-11D0-94DE-444553540000}
Computer Search Results {1F4DE370-D627-11D1-BA4F-00A0C91EEDBA}
History {FF393560-C2A7-11CF-BFF4-444553540000}
Internet Explorer {871C5380-42A0-1069-A2EA-08002B30309D}
My Computer {20D04FE0-3AEA-1069-A2D8-08002B30309D}
My Documents {450D8FBA-AD25-11D0-98A8-0800361B1103}
My Network Places {208D2C60-3AEA-1069-A2D7-08002B30309D}
Offline Files {AFDB1F70-2A4C-11D2-9039-00C04F8EEB3E}
Programs {7BE9D83C-A729-4D97-B5A7-1B7313C39E0A}
Recycle Bin {645FF040-5081-101B-9F08-00AA002F954E}
Search Results {E17D4FC0-5564-11D1-83F2-00A0C90DC849}

23. Desktop.ini is the feature of windows that allowws to change
Folder background, folder tool-tip text, folder icon
[.ShellClassInfo]
IconFile=2.ico
IconIndex=0
InfoTip="Parekh's tooltip folder"
[{BE098140-A513-11D0-A3A4-00C04FD706EC}]
iconarea_image=s1.jpg
IconArea_Text=0xFFFFFFFF
Make folder and file to system file

24. The .inf files specify the program files required for components
to run on 32-bit versions of Windows. By using the setup
engine built into Windows, .inf files can take advantage of the
setup engine's small size, as well as functions of the Windows
operating system such as copying files, adding registry entries,
and creating shortcuts. The .inf files can also provide limited
platform independence and specify limited software
dependencies.

25. By default all .inf files are stored in C:windowssysteminf
[Version]
Signature=$CHICAGO$
[DefaultInstall]
AddReg=Reg.Settings
[Reg.Settings]
Add registery keys
Format to add key
Rootkey, subkey, keyname, flag, value

26. flags
0x00000000. Value is REG_SZ. This is the default if you
omit flags.
0x00000001. Value is REG_BINARY.
0x00010000. Value is REG_MULTI_SZ.
0x00020000. Value is REG_EXPAND_SZ.
0x00010001. Value is REG_DWORD.
0x00020001. Value is REG_NONE.

27. Microsoft Tweak UI is a must-have tool for anyone
customizing Microsoft Windows
XP or Windows Server 2003 (Windows).
It allows users to customize settings that
wouldn’t be available in the operating system’s user interface
without editing the registry

28. HKEY_LOCAL_MACHINE Software Microsoft Windows
CurrentVersion Explorer Shell Icons
2= Applications Generic
3= Closed Folder
4= Open Folder
7= Removable Drive
8= Hard Drive
9= NetWork Drive
31= Recycle Bin Empty
32= Recycle Bin Full
33= Dial-up Network
34= DeskTop
35= Control Panel
36= Start Menu's Programs

29. Internet
Self Experiments