Learn How to use Windows Registry

In this article, I’ll explain how the Registry Editor works and show how to tweak  the Registry. Applies to Windows XP / Vista / 7.

Introduction

Many people like to configure Windows their own way and Windows is a system with numerous possible tweaks. Most of these tweaks are actually edits of the Registry. There are several ways to apply Registry changes but the true tweaker often likes to go to the source and tune up the Registry directly with the Windows Registry editor Regedit.

Regedit is one of those Windows programs that Microsoft doesn't say much about. It isn’t listed in the All Programs menu and the Help function doesn’t say how to use it. In fact, in Windows XP it warns, “Although you can use Registry Editor to inspect and modify the registry, doing so is not recommended, as making incorrect changes can damage your system.” Pretty offputting but the caution is overdone. In Windows Vista/7, Microsoft relaxed a bit and included a few more details in Help but still not enough to let anyone understand how to use Regedit. If you are bold enough to go to Regedit itself, you will find it has its own Help menu with some instructions but they are rather sparse.

This tutorial will flesh out what Microsoft has omitted and give you all the information you need to begin editing the Registry.

But first, I must make the rules of Registry editing clear.

Rules for editing the Registry safely

I have edited the Registry hundreds of times over the years and have developed the steps below for safe editing. I have messed things up once or twice but I have always been able to get back to the original system state without trouble because I followed the rules. Here are my five rules for safer Registry editing:

1. The ironclad rule of Registry editing is that you must first back up the Registry. For many, making a System Restore point is the most convenient backup method. I also use the export facility of Regedit to make a copy of the Registry key that I am working on. Keep in mind that Regedit has no Undo function.
2. Know how to restore a Registry backup. It can be as simple as running System Restore or merging a backup REG file.
3. Make only one Registry edit at a time. Wait to see if everything works the way you want before making any more changes to the Registry. Don't forget that many Registry edits require that you log off or reboot before they take effect.
4. Only use Registry edits recommended by known reliable sources. Many of the common recommendations on the Internet are useless or nearly so. And some are even harmful.
5. Remember Rule #1.
   
   

With the precautions out of the way, we can get down to learning about Regedit.

How to open Regedit

A quick way to access Regedit that applies to Windows XP, Vista, and 7 is the following:

1. Open the Run box with the keyboard combination Windows key + r
2. In the Run line, enter “regedit” (without quotes)
3. Click “OK”
4. Say “Yes” to User Account Control (Windows Vista/7)

The structure of the Registry as presented in Regedit

Using Regedit requires some knowledge of the basic structure of the Registry. I would go further and say I think it is worthwhile to take a look at the structure of the Registry even if you never intend to change a single comma in it. Total ignorance about what is actually in the Registry allows the imagination to assign mysterious and fearsome properties to something that is actually just a database. You may not remember any details but having once seen what is actually in the Registry, you will be psychologically better prepared to do the type of Registry operations that everybody should know- backing up and restoring.

Types of Information in the Registry

The information that the computer system needs to have is divided into two main categories. One is general information about the computer itself. These are settings that apply system wide and include the hardware on the system. This is named the Local Machine. The other general category consists of settings that are specific to each user account and is labeled Users. The particular user who is logged on is called the Current User.

The Hierarchical Tree Structure

Information in the Registry is presented in a tree-like system akin to folders and files. In the Registry, the containers for information are called "keys". These are analogous to folders. Keys can have subkeys just as folders can have subfolders. The name of data that is contained in a key is called a "value". This is something analogous to a file name. The actual data can have several formats and may be a string, a number, or a series of numbers.

Just as the computer file and folder system has a root (usually a hard drive) the Registry has root keys at the top of the hierarchy of keys and values. I have mentioned the two general categories of information and these constitute two root keys. Unfortunately, we now have to deal with some Microsoft jargon. Table I shows the names that Microsoft uses. The names of root keys have "HKEY" tacked on the front. and these keys are often called "hives". Although five root keys are used, three of them are really just subkeys or combinations of subkeys of the two main keys, HKLM and HKU. The additional root keys make programming easier.The abbreviations that are given are often used in writing scripts and INF files.

Table I. Root keys or Hives

Keys	Abbreviation	Description
HKEY_CLASSES_ROOT	HKCR	Stores file association and COM object registration
HKEY_CURRENT_USER	HKCU	Stores data associated with the account currently logged on
HKEY_LOCAL_MACHINE	HKLM	Stores system-related information
HKEY_USERS	HKU	Stores information about all the accounts on the machine
HKEY_CURRENT_CONFIG	HKCC	Stores information about the current machine profile

Using Regedit

Regedit is a two-pane interface with keys in the left pane (key pane) and value names with the corresponding data in the right pane (value pane). The setup is not unlike Windows Explorer with keys analogous to folders and values analogous to files. An example is shown in the figure below. This is from Windows XP but Vista/7 is very similar.

Figure 1. Registry Editor (Regedit)

The bottom of the window for Regedit shows the path of the currently highlighted key as can be seen in the figure above. This is an example of  typical Registry address although the leading "My Computer" is normally omitted.

Also listed in the right or value pane is the type of data contained in a value. There are a number of formats that data can take and the usual ones that most PC users will encounter are given in Table II. I have omitted the more esoteric types. The three listed in the table constitute the vast majority of all Registry entries. Other data types are described at this Microsoft link.

Table II. Common Registry data types

Data type	Description
REG_BINARY	Binary data . Usually in hexadecimal notation. An example is 0xA8
REG_DWORD	Double word (32 bits). Can be edited in either hexadecimal or decimal
REG_SZ	A string. Figure 1 shows examples in the right pane.

Menus in Registry Editor

Regedit has some of the same menus that are so familiar throughout Windows. The menu bar can be seen near the top of Figure 1. Shown below are two commonly used menus.

Figure 2. File menu	Figure 3. Edit menu

The File menu has the functions "Import" and "Export" that can be used to backup and restore individual Registry keys with REG files. The next section will have more detail about this important function.

As you would expect, the "Edit" menu is where commands are located for making changes to the Registry. Keys and values can be deleted, added, or renamed. (Permission settings on keys can also be edited but that is an advanced subject beyond our scope.) Another two very useful functions are "Find..." and "Find Next". The Registry has thousands of keys and these search functions are very necessary. Unfortunately, the search function cannot find binary values or REG_DWORD entries. It searches key names, value names, and string data.

The Edit menu also contains a useful entry "Copy Key Name" that sends the path of the key to the clipboard, Since path names can be quite long, this can be very useful.

Another menu that can be quite useful is "Favorites". If you find that there are is a certain key that you modify often, this key can be added to the "Favorites' list for easy access. The example of a "Favorites" menu shown on the right contains three favorites. Note the names have been chosen by this user and can be anything that is a convenient reminder. They actually refer to specific Registry keys, which can have very long path names.

Backing up and restoring Registry keys with REG files

Here is how to back up a key (remember, a key is something like a folder):

1. Open Regedit and highlight the key
2. Open the "file" menu and click "Export". An alternative method is to right-click the key and choose "Export"
3. A standard dialog box for saving files will open. For most cases, you will choose to save as a registration or REG file. This is a text file with extension.reg that is a copy of the highlighted Registry key
4. Save it someplace safe

Note that whole keys and not single values are involved. To restore a Registry key, you can use the "Import" function. However, it is easier to merge REG files into a Registry by right-clicking the file and choosing "Merge". On many machines the default left double-click on a REG file will also create a merge. I prefer to change the double-click action to "Edit" so that accidental mergers do not happen. Notice that I use the word "merge". REG files do not replace keys but add to them, something to keep in mind. Anything extra that you may have added is not deleted. Some experienced PC users prefer to do any actual editing in the exported REG file and then to merge the edited file. This prevents accidentally doing something to the wrong key.

Keep in mind that Regedit has no "undo" function. What's done is done.

Editing the Registry

There are many useful adjustments to the Windows configuration or behavior that can be made by simple editing of the Registry. Unless you are a trained IT professional, you should probably limit Registry editing to one or two values at a time. I will limit this discussion to this type of straightforward scenario.

For the most part, direct Registry editing means changing a value. Highlight the value in question in the right-pane of Regedit. Then choose "Modify" from the "Edit" menu or right-click the value and choose "Modify" from the context menu. For strings, a box like the one shown in the nearby picture will open. As a specific example, consider the last value in the right-pane of Figure 1. The time that the system waits for a service to close at Shutdown is controlled by the entry for the value, WaitToKillServiceTimeout. The value is in milliseconds and the default is 20000 (20 seconds). To make things close up more quickly, you could change the value to 10000 (10 seconds). Or you might need to make it longer for certain systems. Enter the desired string in the line "Value data" and click OK.

A great many Registry values are strings but another type of data that is common is the "DWORD". A slightly different box will appear if you are editing a REG_DWORD value. The figure on the left shows the appropriate box. Note that when entering a DWORD value, you need to specify the base for the number. Be careful to be sure that you have chosen correctly between hexadecimal and decimal. You can enter either but the number that you enter must correspond to the correct value for the chosen base. In the example here the decimal number "96" would have to be "60" if hexadecimal were picked for the base.

And so we come to the end of the unveiling of the mysteries of the Registry. Go forth and edit well but carefully.