Modifying the Registry

Modifying the Registry

Windows NT 4.0 introduced the Registry database to this operating system, building on an early version in Windows NT 3.1 that stored OLE location information on object servers. The first complete Registry appeared in Windows 95, although the versions of both are different. The Registry is a database of settings and parameters. Among the features set by the Registry are the nature of the interface, operating system hardware and software settings, user preferences, and other settings. Prior to Windows NT Workstation 4.0 and Server 4.0, these settings appeared as sections and lines in various .INI files.

The Registry is hierarchical and each branch is referred to as a hive. Individual sub-branches are called keys, which is a binary file. The top or first key of a hive is the primary key, with each key composed of subkeys that take value entries. Most Registry entries are permanent, although some are session dependent, transient, and never written to disk. An example of a transient key is the HKEY_LOCAL_MACHINE\Hardware as generated by automatic hardware detection by the Hardware Recognizer (ntdetect.com for Intel computers). The Hardware key is an example of a session value. Another transient value is the information written as part of a logon for a session, including security tokens.

When you install software, either a program or a part of the operating system such as a device driver or service, new subkeys and value entries are written to the Registry. Uninstall these components to remove the information. Subkeys and value entries store information about hardware settings, driver files, environmental variables that need to be restored, anything the application developer requires reference to.

This is likely to be on the exam because many troubleshooting operations require access to the Windows NT Registry.

Only members of the Administrators or Power Users group can access the Registry by default. You can assign other users rights to modify all or part of the Registry by hives, but you should think long and hard before doing so. The potential to compromise security or corrupt an installation is high. By default, any user can see the Registry files, but cannot edit, delete, or copy Registry files without specific permission to do so.

Further Information