Best practices

In Windows 2000, system configuration information is centrally located in the registry. While this simplifies the administration of a computer or network, one incorrect edit to the registry can disable the operating system. The following list provides some best practices for using the registry and Registry Editor safely:

  • Before making changes to the registry, make a backup copy.

    • You can back up the registry by using a program such as Backup. After you make changes to the registry, update your Emergency Repair Disk (ERD). For troubleshooting purposes, keep a list of the changes you make to the registry. For more information, see Backing up, restoring, and recovering the Windows 2000 registry.

  • Do not replace the Windows 2000 registry with the registry of another version of the Windows or Windows NT operating systems.
  • Use tools and programs other than Registry Editor to edit the registry.

    • Incorrectly editing the registry may severely damage your system. You should use tools and programs that provide safer methods for editing the registry.

  • Limit the number of people who have access to the registry.

    • For example, because members of the Administrators group have full access to the registry, add only users who need such access to the Administrators group. Also, you can use Group Policy to restrict the use of Registry Editor (both Regedt32.exe and Regedit.exe) for users who do not need access to the registry, or you can simply remove Registry Editor from the computers of these users.

  • Keep Registry Editor in read-only mode.

    • If you use Regedt32.exe, verify that Read Only Mode on the Options menu is checked. When you need to make changes to the registry, click Read Only Mode to turn off read-only mode, and then verify that Confirm on Delete is checked. When you are done making changes and have saved your edits, click Read Only Mode again to turn on read-only mode.

  • Never leave Registry Editor running unattended.


How to...

This section provides instructions for using the Registry Editor utilities provided in Windows 2000:

  • Open Registry Editor
  • Use Registry Editor


Open Registry Editor

To open Registry Editor

  • Click Start, click Run, type regedt32 or regedit (depending on which Registry Editor you want to open), and then click OK.

Caution

  • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer. Whenever possible, use tools and programs other than Registry Editor to edit the registry.

Note

  • To open Registry Editor from a command prompt, click Start, point to Programs, point to Accessories, click Command Prompt, type regedt32 or regedit, and then press ENTER.

Related Topics


Use Registry Editor

  • Registry Editor (Regedt32.exe)
  • Registry Editor (Regedit.exe)


Concepts

This section covers:

  • Windows 2000 registry overview
  • Understanding the Windows 2000 registry
  • Managing the Windows 2000 registry


Windows 2000 registry overview

In Microsoft Windows 2000, system configuration information is stored centrally in a hierarchical database called the registry. The registry replaces many of the .ini, .sys, and .com configuration files used in Windows for MS-DOS and Microsoft LAN Manager.

For information about specific registry keys, see the Windows 2000 Resource Kit.


Understanding the Windows 2000 registry

The registry contains configuration information, such as settings for utilities in Control Panel, that the Windows 2000 operating system continually references. This section covers:

  • Registry structure
  • How Windows 2000 components use the registry


Registry structure

The registry is organized in a hierarchical structure of subtrees and their keys, subkeys, and value entries.

The contents of the registry for one computer may vary widely from that of another, depending on the devices, services, and programs installed on each computer. The following illustration shows an example of a registry, as viewed by a version of Registry Editor (Regedit.exe) provided with Windows 2000.

Example of a registry

Keys can have subkeys and subkeys can, in turn, have subkeys. While most information in the registry is stored on disk and is considered permanent, some information, stored in volatile keys, is overwritten each time the operating system starts.

Registry subtrees

Windows 2000 has two registry subtrees: HKEY_LOCAL_MACHINE and HKEY_USERS. However, to make the information in the registry easier to find, the Registry Editor utilities display five subtrees, which are listed and described in the following table.

Root key name | Description
HKEY_LOCAL_MACHINE | Contains information about the local computer system, including hardware and operating system data such as bus type, system memory, device drivers, and startup control data.
HKEY_CLASSES_ROOT | Contains information used by various OLE technologies and file-class association data (equivalent to the registry in Windows for MS-DOS). A particular key or value exists in HKEY_CLASSES_ROOT if a corresponding key or value exists in either HKEY_LOCAL_MACHINE\SOFTWARE\Classes or HKEY_CURRENT_USER\SOFTWARE\Classes. If a key or value exists in both places, the HKEY_CURRENT_USER version is the one that appears in HKEY_CLASSES_ROOT.
HKEY_CURRENT_USER | Contains the user profile for the user who is currently logged on interactively (as opposed to remotely), including environment variables, desktop settings, network connections, printers, and program preferences. This subtree is an alias of the HKEY_USERS subtree and points to HKEY_USERS\security ID of current user.
HKEY_USERS | Contains information about actively loaded user profiles and the default profile. This includes information that also appears in HKEY_CURRENT_USER. Users who are accessing a server remotely do not have profiles under this key on the server; their profiles are loaded into the registry of their own computers.
HKEY_CURRENT_CONFIG | Contains information about the hardware profile used by the local computer system at startup. This information is used to configure settings such as the device drivers to load and the display resolution to use. This subtree is part of the HKEY_LOCAL_MACHINE subtree and points to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\Current.

Each root key name begins with HKEY_ to indicate to software developers that this is a handle that a program can use. A handle is a value used to identify a resource so that a program can access it.

Notes

  • One version of Registry Editor, Regedit.exe, displays a sixth subtree, HKEY_DYN_DATA. This is a subtree of the Windows 95 and Windows 98 registries, but it is not used by Windows 2000. For more information about Registry Editor, see Using Regedt32.exe and Regedit.exe.
  • The behavior of HKEY_CLASSES_ROOT is different from previous versions of Windows. In Windows 2000, a feature called per-user class registration provides a view of HKEY_CLASSES_ROOT that contains both user-specific class registrations and computer-specific class registration. With this feature, different users can have different sets of class registrations (including those for file associations, COM components, and MIME types). Previously, all users shared registrations, so that one user could alter registrations for other users. Per-user class registration isolates each user's registrations and allows the administrator to increase security on HKEY_LOCAL_MACHINE\Software\Classes.

Registry hives and files

The term hive describes a body of keys, subkeys, and values that is rooted at the top of the registry hierarchy. A hive is backed by a single file and a .log file that are in the systemroot\System32\Config or the systemdrive\Documents and Settings\username folders. The string systemroot is a placeholder for the directory name that contains the Windows 2000 system files; the string systemdrive is a placeholder for the partition that contains the Windows 2000 system files. For example, if the Windows 2000 system files for a user named Annie are in a directory called Winnt in the C: partition, the hive files are stored in the C:\Winnt\System32\Config and C:\Documents and Settings\Annie folders. Hives may also be called registry files or registry log files.

By default, most hive files (DEFAULT, SAM, SECURITY, SOFTWARE, and SYSTEM) are stored in the systemroot\System32\Config folder. In Windows 2000, the location of user profile information for each user of a computer, including the Ntuser.dat and Ntuser.dat.log, may depend on whether the installation of the operating system was a fresh installation or whether it was installed as an upgrade from Windows 95, Windows 98, or Windows NT. In fresh installations and upgrades from Windows 95 and Windows 98, the Ntuser.dat and Ntuser.dat.log files are stored in the systemdrive\Documents and Settings\username folder. In installations that are upgrades from Windows NT, the Ntuser.dat and Ntuser.dat.log files are stored in the systemroot\Profiles\username folder.

Each hive in the Windows 2000 registry is associated with a set of standard files. The following table shows the standard hives and files for a computer running Windows 2000.

Registry hive | File names
HKEY_LOCAL_MACHINE\SAM | Sam and Sam.log
HKEY_LOCAL_MACHINE\SECURITY | Security and Security.log
HKEY_LOCAL_MACHINE\SOFTWARE | Software and Software.log
HKEY_LOCAL_MACHINE\SYSTEM | System and System.log
HKEY_CURRENT_CONFIG | System and System.log
HKEY_CURRENT_USER | Ntuser.dat and Ntuser.dat.log
HKEY_USERS\.DEFAULT | Default and Default.log

Value entries in the registry keys

Each registry key or subkey can contain data called value entries. Some value entries store information that is specific to each user, while others store information that applies to all users of a computer. A value entry has three parts: the name of the value, the data type of the value, and the value itself. The three parts of value entries always appear in the following order.

Structure of value entry

Data types describe the format of the data. Data types from 0 through 0x7FFFFFFF are reserved for definition by the system. Programs are encouraged to use these data types, but data types from 0x80000000 through 0xFFFFFFFF are also reserved for use by programs.

The following table lists the data types currently defined and used by the system.

Data type | Description
REG_BINARY | Raw binary data. Most hardware component information is stored as binary data and is displayed in Registry Editor in hexadecimal format.
REG_DWORD | Data represented by a number that is 4 bytes long. Many parameters for device drivers and services are this type and are displayed in Registry Editor in binary, hexadecimal, or decimal format.
REG_EXPAND_SZ | A variable-length data string. This data type includes variables that are resolved when a program or service uses the data.
REG_MULTI_SZ | A multiple string. Values that contain lists or multiple values in a form that people can read are usually this type. Entries are separated by spaces, commas, or other marks.
REG_SZ | A fixed-length text string.
REG_FULL_RESOURCE_DESCRIPTOR | A series of nested arrays designed to store a resource list for a hardware component or driver.

Registry size limits

Registry data is stored in the paged pool, a portion of virtual memory that is written to a physical disk when not in use. A value called the registry size limit prevents programs from completely filling the paged pool with registry data.

You can view and set the size of the registry by using System in Control Panel. On the Advanced tab, click Performance Options, and then click Change. For more information about setting the registry size, see To change the maximum size of the computer's registry and To change the size of the virtual memory paging file.

By default, the registry size limit is 33 percent of the size of the paged pool. A registry size limit of up to 80 percent of the size of the paged pool is allowed. The minimum registry size is 16 megabytes (MB). If you attempt to set the registry size to anything smaller, the system resets this value to 16 MB.

You should change the registry size only if the computer is a domain controller for a large network or if you receive an error message warning you that the registry is too small. Note that setting a large value for the registry size limit does not cause the system to use that much space unless it is actually needed by the registry. In addition, a large value does not guarantee that the maximum space is actually available for use by the registry.


How Windows 2000 components use the registry

The following illustration shows how Windows 2000 components and programs use the registry. The list that follows provides details.

How components and programs use the registry

Setup. Both the Windows 2000 Setup program and other setup programs (for programs or hardware) add configuration data to the registry. For example, new information is added when you install a new SCSI adapter or change the settings for your display. Setup also reads information from the registry to determine if the prerequisite components are installed.

Recognizer. Each time you start a computer running Windows 2000, the recognizer places hardware configuration data in the registry. This data includes a list of hardware detected in your system. Hardware detection is done by the hardware recognizer (Ntdetect.com) and the Windows 2000 kernel (Ntoskrnl.exe) programs.

Windows 2000 kernel. During system startup, the Windows 2000 kernel extracts information from the registry, such as which device drivers to load and their load order. The Ntoskrnl.exe program also passes information about itself (such as its version number) to the registry.

Device drivers. Device drivers send and receive load parameters and configuration data from the registry. This data is similar to what you might find on the DEVICE= lines in the Config.sys file in the MS-DOS operating system. A device driver must report the system resources that it uses, such as hardware interrupts and DMA channels, so that the system can add this information to the registry. Programs and device drivers can access this registry information to provide users with smart installation and configuration programs.

Administrative tools. You can use the options and administrative tools in Windows 2000 (such as those provided in the Administrative Tools folder in Control Panel) to modify configuration data indirectly.


Managing the Windows 2000 registry

Most users of Windows 2000 never need to access the registry. However, managing the registry is an important part of a system administrator's job. This includes tasks such as viewing, editing, backing up, and restoring the registry. In addition, administrators need to consider security issues. For more information about security and the registry, see Maintain registry security.

This section covers:

  • Using Regedt32.exe and Regedit.exe
  • Backing up, restoring, and recovering the Windows 2000 registry


Using Regedt32.exe and Regedit.exe

Windows 2000 provides two versions of Registry Editor: Regedt32.exe and Regedit.exe. Regedt32.exe is automatically installed in the systemroot\System32 folder. Regedit.exe is automatically installed in the systemroot folder.

You can modify the registry by using either of the Registry Editor utilities. However, if possible, you should use other utilities and tools provided with Windows 2000, such as those in Control Panel. When you modify the registry by using Registry Editor, Registry Editor does not check for syntax or other errors. In addition, one modification to the registry may cause a cascade of changes throughout the registry. The results of an incorrect edit made with Registry Editor are unpredictable and may impair or disable the Windows 2000 operating system. However, by using other tools and utilities, you can ensure that edits made to the registry are valid and manage any ensuing cascade of changes caused by an edit.

You can safely view the registry by using Regedt32.exe in read-only mode (on the Options menu, click Read Only Mode), so that you cannot inadvertently make changes.

Your ability to make changes to the registry by using Registry Editor depends on your access permissions. In general, you can make the same kinds of changes with Registry Editor as your permissions allow for other administrative tools. Users who belong to the Administrators group can view the registry of remote computers by using the Select Computer option on the Registry menu.

When you start Registry Editor, an associated icon appears on your taskbar. For information about starting Registry Editor, see Open Registry Editor.

For detailed instructions about using Registry Editor, see How to.

For recommendations about safely using the Windows 2000 registry and Registry Editor, see Best practices.


Backing up, restoring, and recovering the Windows 2000 registry

It is important that you have current, reliable backup copies of the registry. You should back up the registry as part of your regular backup routine and before you edit the registry. In Windows 2000, if you select the System State check box on the Backup tab in Backup, the registry is automatically backed up.

You can also use Backup to restore lost data to the registry. To do this, the system must be stable enough for you to open Backup. It is possible, however, for Windows 2000 to become so damaged by incorrect registry edits that it cannot start. You may be able to repair the operating system if you have created an Emergency Repair Disk (ERD). In the worst case, you must reinstall the operating system and device drivers and reconfigure the system before you can restore the data.

For more information about Backup, see Windows Backup overview.

For more information about backing up the registry, see To back up System State data.

For more information about creating an ERD, see To create an Emergency Repair Disk.


Troubleshooting

What problem are you having?

After editing the registry, one or more of the following occurs: files are missing, components are not behaving as expected, error messages or stop errors are displayed, or the operating system does not start.

Cause: A corrupt or damaged registry.

Solution: Before reinstalling Windows 2000 to fix the problem, try the following:

  • If you have kept a record of the changes that you have made to the registry, try undoing the most recent change.
  • If you know which components have been affected, determine what the correct registry settings are for those components. For more information about specific registry settings, refer to the online documentation for that component or the Windows 2000 Resource Kit.
  • Try using the last known good configuration for your computer. For more information, see To start Windows 2000 using the last known good configuration.
  • If you have a backup copy of the registry (as part of your backup of System State data), and you can open Backup, try to restore your registry settings. For more information, see To restore the System State data.
  • If you cannot start Windows 2000, try repairing the operating system with your Emergency Repair Disk (ERD). For more information, see To repair a system that will not start.
  • If your operating system is damaged beyond repair (or if you must replace your hard drive), see the Windows 2000 Server Getting Started book that came with your Windows 2000 CD for instructions on reinstalling the operating system.


The Windows 2000 registry

The Windows 2000 registry is a database that contains system configuration information for the Windows 2000 operating system.

  • For tips about using the registry and Registry Editor, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.