Creating, Renaming, and Deleting Entries

The Registry Editor allows you to quickly create, delete, or rename an entry. Entries may consist of keys, subkeys, or value entries.

Creating a New Key

You can quickly create a new key by following these steps: 1. Select the hive or key in which the new key is to be created. Either right-click the object or select Edit → New, and then select the type of object to create. 2. The Registry Editor creates the new subkey, giving it a default name of New Key #n where n is a number beginning with 1. Edit the new subkey's name. Give the subkey a meaningful name or the name that is expected for this subkey. (If you neglect to edit the key's name at this time, you can rename it later.) Once the new subkey has been created, you can populate it with additional subkeys and value entries. Note A hive, key, or subkey may contain both value entries and other subkeys at the same time.

Why Can't I Create a Key Here?

New! Prior to Windows XP, not all hives allowed you to create keys directly under the hive itself. For example, it was not possible to create a key under HKEY_LOCAL_MACHINE, though you could create a key under HKEY_CURRENT_USER. Now you can create keys virtually anywhere. However... Why not create an object in those locations? Simply put, the HKEY_LOCAL_MACHINE hive is not "saved" when Windows shuts down. Rather it is re-created anew each time Windows boots therefore, any key or subkey created is lost at the next boot-up time.

Creating a Value Entry, Then Renaming It

You can quickly create a new value entry by following these steps:

1. Select the hive or key in which the new value entry is to be created. 2. Select Edit → New and then select either String Value, Binary Value, DWORD Value, Multi-String Value, or Expandable String Value, depending on the type of data that this value entry will have. 3. The Registry Editor creates the new value entry, giving it a default name of New Value #n where n is a number beginning with 1. Edit the new value entry's name. Give it a meaningful name or the name that is expected for it. Press the Enter key to save the new name. Tip At any point, you may rename a key or value entry by right-clicking the item to be renamed and selecting Rename from the context menu. 4. To enter data into the new entry, double-click the entry. The correct edit box is displayed, allowing you to edit the data. If you right-click, you can choose to edit the object using the binary format.

REG_FULL_RESOURCE_DESCRIPTOR, showing the Modify Binary Data selection in the context menu Once you've created the new value entry, you can enter data as necessary. Note A key need not have a data value entered. A key is valid without any data, though nodata defaults vary depending on the type of data the key contains:

String values have a zero-length string as their default. Binary values have a zero-length binary value (which is different from having a value of zero). DWORD values have a value of zero.

In the example, I gave each of the new value entries a name to match the type of data it stores. I created each value using the Edit → New selection in the menu. You can edit value entries at any time, either in their native format or in a raw, binary format. To change the name, select the key or value entry and choose Edit → Rename. To change the value entry's contents, select the value entry and choose Edit → Modify. To change the value entry's contents in binary format, select the value entry and choose Edit → Modify Binary Data. You can also double-click the value entry or right-click (also known as a context-click) the item and choose Modify to change the value.

Deleting the Unwanted

Getting rid of the unwanted is easy. Select the object, either a key, subkey, or value entry, to be deleted and then either select Edit → Delete or just press the Delete key. The Registry Editor prompts you to confirm that the object is to be deleted, if the Confirm on Delete option is selected. Warning Once deleted, 'tis gone forever! Be careful not to delete anything that you will want later. Prior to deleting, it's appropriate to back up the registry. It also might be a good idea to rename the object, just in case you need to restore it at a later time.

Copying Key Names

Is this as simple as it seems? A long, convoluted name without having to type it? Yes, it is! Copy Key Name, found in the Registry Editor's Edit menu (and from the key's context menu if you right-click the key and select Copy Key Name), copies the key's name to the Clipboard. The information is copied in text format and may then be pasted into other applications or word processors as needed. For example, when I copy the new key created, the following text is placed into the Clipboard: HKEY_LOCAL_MACHINE\Hardware\Description\System\Test Key\Test sub-key This means it is not necessary to manually type in long registry keys into other applications and documents. This feature, for example, was a great help when writing this tutorial. Tip Sadly, we can't copy either value names or their contents in this manner! To copy a key's data, you must edit it and select and copy from the editor.

Searching: Find and Find Next

Searching a registry is one of the most important tasks you'll have to undertake. Before you make a modification, do debugging, or start browsing, it is usually necessary to search for something. Now, as I've mentioned previously, the Registry Editor's search capabilities are a bit limited. Tip The Registry Editor searches downward only. If what you are searching for is located above the current selection, you'll be in for a long wait, as the search will have to scan to the end of the registry and then restart at the beginning to find it. When in doubt, start at My Computer, and you can be assured that the search will include the entire registry. Oh, the Registry Editor's search is deathly slow a long search, in a large registry, is a sure sign that it's time for a coffee break. Searching allows you to look at keys, data value names, and data value contents. You may choose to search any or all of these, and you can limit the search to whole strings only, which applies to searching text strings exclusively.

Once the search finds the item searched for, it stops on the word(s) found. Use F3 to continue the search or to find subsequent matches. If the Registry Editor's search is unable to find the string entered, you will see an error dialog box. Loading and Unloading Hives The Registry Editor allows a hive to be loaded into the current registry. This hive may be modified and later unloaded. Why? There are several reasons for loading and unloading hives into the Registry Editor. The following example, configuring a modified new user profile, concerns the file ntuser.dat. In ntuser.dat is the HKEY_CURRENT_USER hive. Within this hive are settings, such as internationalization, colors, schemes, and other items. Windows XP's installation process creates a default user profile nothing spectacular, a very plain configuration. Whenever a new user logs on to a workstation (or domain), this default user profile is copied to the user's profile. After that, the user may modify this default profile to his or her requirements and needs. Of course, you might want to establish some organizational defaults, such as a company scheme. Warning The techniques shown next are advanced uses of the Registry Editor. Back up the registry before doing the following. The default user profile is saved in the following disk directory:

• For new installations: %SystemDrive%\Documents and Settings\Default User (this directory may have the hidden attribute set, so that it is not displayed when using either Explorer or a command session)

• For Windows NT 4, and Windows 2000 installations that are upgraded from Windows NT 4: %SystemRoot%\Profiles\Default User\

The name of the user profile is ntuser.dat. There is an entire configuration for new users in the directory %SystemDrive%\Documents and Settings\Default User; check out the Start Menu, Desktop, and other directories, too. You will find that interesting modifications can be made that enable new users to become proficient quickly without spending too much time customizing their computers.

First, to make this new user profile accessible to remote users (users other than those who log on locally), you must copy the Default User directory to the share named NetLogon. This share is typically located in the directory at C:\Winnt\SysVol\SysVol in Windows Server. Placing files in Export (in Windows NT 4) causes replication to copy them locally to Import, along with any BDCs (Backup Domain Controllers). Note that the share might be located elsewhere. The NetLogon share can be located quickly by typing the following command at a command prompt:

net share

The computer's shares will be displayed. One process to copy these files is to create a new custom profile, and then copy the new custom profile using the System applet's User Profiles tab. Warning Be smart! Be sure to make a backup copy of the ntuser.dat file before you make any changes in it! Do the following to modify the default new user profile. (Remember to create a new Default User directory, saving the current Default User directory as a backup.) 1. Start the Registry Editor using either a command prompt or by selecting Start → Run. 2. Click the title bar of the HKEY_USERS on Local Machine window to make it active. 3. Choose File → Load Hive from the Registry Editor menu. 4. Open the hive file in %SystemDrive%\Documents and Settings\Default User. (If your system is configured, or installed, with different directory names, choose the correct name.) This hive has a filename of ntuser.dat. 5. The Registry Editor prompts you for a new Key Name. Use the name ntuser. 6. Change whatever keys in ntuser need to be modified. There will be a slew of changeable items in the new profile, including AppEvents, Console, Control Panel, Environment, Keyboard Layout, Software, and Unicode Program Groups. When adding new keys, do be careful to ensure that all users have at least read access to the new keys. No read access means that the key won't be accessible to the person named "user." Tip To set the permissions for a key, select the key, and then select Security → Permissions from the Registry Editor menu. Ensure that the Everyone group has at least read access. Resist the urge to give everyone more than read access to this key. Too much power can be a dangerous thing! 7. After making all modifications to NTUSER, choose File → Unload Hive from the Registry Editor menu. Unload the hive to the file ntuser.dat. (You did back up the original file, right?) 8. Exit the Registry Editor. Once this profile is saved in the Netlogon share location, each time a new user logs on to the network, the user will get this new profile.

Can't Find the Location for ntuser.dat?

Remember that the ntuser.datfile has the hidden attribute, so it is not normally displayed in either a command window or in Explorer. Either tell Explorer to display hidden files or, at a command prompt, use the dir command with the /ah option to display hidden files and directories. If worse comes to worst, open a command window (tough to do this in Explorer) and, in the root of the system drive, use the command:

   DIR /ah /s ntuser.dat

This command lists all copies of the ntuser.dat file, allowing you to change the appropriate one. One thought though: don't change the "current user" ntuser.dat file it won't work! Windows will rewrite the file when the user next logs off, causing any changes you made to disappear!