Registry Tools and Tips–Getting the Work Done

Overview

Windows XP uses only one registry editor. Gone are the separate RegEdit and RegEdt32 editors that existed in Windows 2000. No matter which command you enter in Windows XP, RegEdt32 or RegEdit, the same program (RegEdit, which is called the Registry Editor) will run. Windows XP also has a utility called REG that is included as part of the system installation no more needing to install a separate Resource Kit. This tool is run at the command prompt. REG allows flexible manipulation of the registry, replacing earlier versions of a number of the other Resource Kit components. In this tutorial, I'll first discuss the registry tools specific to Windows XP. In the second half of the tutorial, I'll review the many useful tools available in earlier versions of Windows.

Using the Registry Editor

If you have used Windows 2000's RegEdt32, you'll notice some differences in Windows XP's Registry Editor. While RegEdt32 has much more power, the Registry Editor is easier to use. RegEdt32 is an MDI (multiple document interface) application, and it displays each of the main hives in the registry in its own window. RegEdt32 has powerful administrative tools that the Registry Editor doesn't support, including read-only mode (note the following Warning) and a security configuration, which allows you to restrict access to some registry hives, keys, and subkeys. Using the Registry Editor is as simple as starting it. From a command prompt, type regedit to start the program. You can also select Start → Run, type RegEdit, and click the OK button to start the Registry Editor. In either case, typing RegEdt32 will have exactly the same effect in Windows XP. Warning Registry Changes Are Permanent! All changes made with the Registry Editor are immediate and, for all intents, permanent! Though you can go back and manually undo a change made with the Registry Editor, everything that you change with the Registry Editor affects the current registry. Unlike Windows 2000's RegEdt32, XP's Registry Editor does not have a read-only mode. There is no safety net and nothing to catch your bloopers and booboos, and generally you'll have to clean up your own mess. In other words, you are editing the real, working, live, honest-to-goodness registry not a copy. There is no Save command in the Registry Editor; you type in a change, and it is saved right then and there. So, make sure you have a backup of the registry files before fiddling with registry. Once started, the Registry Editor displays the current registry. By default, this is the local registry. However, you can open a registry on a remote computer by selecting File → Connect Network Registry and entering the name of the computer whose registry you want to open. If you cannot remember the exact name of the desired computer, the Select Computer window displays a list of all computers found in the domain directory.

The Registry Editor has a straightforward set of menus. The Edit menu allows you to save and load text-based .reg (registry) files, connect to and disconnect from a network registry, and print the current branch or the entire registry.

Making the Registry Editor Do What It Used to Do!

Since Windows 2000, the Registry Editor displays the last open key from the previous editing session. Some users like this feature; others do not. There is no easy way to disable this functionality, though perhaps Microsoft will give us the option to do so at a later time. Until that time, try this to disable the feature:

1. Using the Registry Editor, open HKEY_CURRENT_USER\Software\Microsoft\Windows\ CurrentVersion\Applets\Regedit 2. Edit the LastKey value, and change its contents to an empty string. (If you want to always start in a specified location, you can put that location in this key's value.) 3. Select the RegEdit key. 4. Select Edit → Permissions. 5. Uncheck the Full Control permission for every user in the list.

This prevents the Registry Editor from saving a value in this key. (Note that this also prevents the Registry Editor from saving any defaults or favorites.) New! You use the Edit menu to create a new key or value entry. Data types in the Registry Editor are restricted to string, binary, multistring, expandable string, and DWORD. Generally, these types are the only registry data types that you would want to edit. New to the Registry Editor's Edit menu is the Permissions option. Prior versions of the Registry Editor did not allow you to set permissions, but this limitation has been fixed as of Windows XP. The Edit menu also lets you delete an object, rename a key or subkey, and copy a key name to a new name. At the bottom of the Edit menu are the Find and Find Next options. Windows 2000 added improvements to the Registry Editor that continue in Windows XP. One improvement is the addition of the Type column in the right-hand display of values and data, which lists each value's type. Although the Registry Editor displays the names of all the data types available to Windows, the user is still restricted to editing the data types listed above. Another 2000 improvement is the addition of the Favorites menu. This feature lets you place your most commonly accessed subkeys into a list of favorites so you can quickly navigate to a subkey. Note If you have disabled the Registry Editor's last open key functionality (as described above), then you have essentially disabled the Favorites options as well. You can't have one without the other...

Importing and Exporting Registry Hives and Keys

The ability to export a registry hive or key (or the entire registry, if necessary) is a powerful feature of the Registry Editor. Once a registry is open, select a hive or key (or My Computer to export the entire registry) and choose File → Export to open the Export Registry File window.

Note The typical Windows registry is several thousand to hundreds of thousands of lines long. The registry on my server has over 130,000 lines. At 66 lines per page, the printed report would be at least 2,000 pages. At least, you say? Yes, many registry lines require more than one line to print, so the printout would actually be much more than 2,000 pages. A hive is exported into a Unicode text-based file. This file has no comments; some of the Resource Kit registry tools do comment exported sections of the registry. However, the file may be opened with most any text editor (such as Notepad), searched, and even (carefully) modified. Any changes made to the exported text file may be incorporated into the registry by simply importing the modified file. Importing a file that the Registry Editor had previously exported is as simple as selecting Registry → Import Registry File and entering the name of the registry file to import.

What Is an Exported Registry File?

A registry file exported by the Registry Editor starts with the line: "Windows Registry Editor Version 5.00." The following line is the first hive exported in a hierarchical format:

   Windows Registry Editor Version 5.00
   [HKEY_LOCAL_MACHINE]
   [HKEY_LOCAL_MACHINE\Hardware]
   [HKEY_LOCAL_MACHINE\HARDWARE\Description]

Generally, a full export of a registry starts with an export of the HKEY_LOCAL_MACHINE hive, as the above example shows. The contents of an exported registry are arranged in the file as a hive and key combination (fully qualified, enclosed in brackets), with the data key name in quotes and its value following the equal sign. The following example shows the three value entries that the FloatingPointProcessor contains:

   [HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0]
 "Component Information"=hex:00,00,00,00,00,00,00,00,00,00,00,00,01,00,00,00
 "Identifier"="x86 Family 5 Model 4 Stepping 3"
 "Configuration Data"=hex(9):ff,ff,ff,ff,ff,ff,ff,ff,00,00,00,00,00,00,00,00

Why export the registry? First, the search capabilities in the Registry Editor are not optimal. (Well, that's my opinion!) Loading an exported registry file into an editor (such as Word, or even Notepad) allows you to quickly search for strings using the editor's search capability. Another benefit is that it is easy to export the registry before installing an application or system extension. After an installation, it is also a good idea to export the registry. Then, using one of the system comparison tools (such as FC or, if you have it, WinDiff), you can compare the two versions of the registry and see what the installation has changed. Bingo a quick way to see what's happening to the registry on installations.

Printing the Registry

Printing a registry hive or key is possible in the Registry Editor. As mentioned previously, printing an entire registry is not a swell idea you'd have to make a major investment in paper and printer supplies. Typically, a registry would require thousands of pages to print. Printing sections of a registry hive can be very useful if a paper record is needed, or if you need something to take to a meeting, or if you want to jot down some quick notes. The limit of a printed registry hive or key is that searching it might be difficult. Printing is easily done if you select the hive or subkey to print, then select File → Print from the Registry Editor's main menu. The Print dialog box, allows you to edit the branch to be printed (with the currently selected object as the default). The results of printing a registry report are almost identical to exporting, with the exception that a printed report lacks the initial header line that's found in an exported registry file.

HKEY_LOCAL_MACHINE. Tip Is the registry file readable? Generally, the Registry Editor in Windows XP creates a better report than previous versions did. The Registry Editor print facility is basic and simply wraps lines at 80 characters. Any line more than 80 characters wraps and is difficult to read. Complex registry data types (such as REG_FULL_RESOURCE_DESCRIPTOR) are well formatted. Another solution is to print the registry to a file, load the file into a word processor, format it to be readable, and print it from the word processor. To do this, you must define a generic text printer device.