Appendix A - Windows NT Registry
In Windows NT, configuration information is centrally stored in a single database called the registry. The registry replaces the .ini, .sys, and .com configuration files used in Windows for MS-DOS and Microsoft LAN Manager.
This appendix provides an overview of registry structure, describes how Windows NT components use the registry, provides an overview of the Registry Editor and Windows NT Diagnostics, and describes how .ini files are mapped to the registry.
For more detailed information about the registry and specific registry keys, see the Windows NT Workstation Resource Kit version 4.0.
The registry is a database organized in an hierarchical structure. The registry is comprised of subtrees and their keys, hives, and value entries. A key can also contain additional subkeys.
The registry subtrees are divided into per-computer and per-user databases. The per-computer information includes information about hardware and software installed on the specific computer. The per-user information includes the information in user profiles, such as desktop settings, individual preferences for certain software, and personal printer and network settings.
The subtrees in the Windows NT registry
The following table identifies and defines the registry subtrees.
Each root key name begins with HKEY_ to indicate to software developers that this is a handle that can be used by a program. A handle is a value used to uniquely identify a resource so that a program can access it.
Hives and Files
The registry subtree is divided into parts called hives (after their resemblance to the cellular structure of a beehive). A hive is a discrete body of keys, subkeys, and values that is rooted at the top of the registry hierarchy. A hive is backed by a single file and a .log file which are in the %SystemRoot%\system32\config or the %SystemRoot%\profiles\username folders. By default, most hive files (Default, Sam, Security, Software, and System) are stored in the %SystemRoot%\system32\config folder. The Ntuser.dat and Ntuser.dat.log files are stored in the %SystemRoot%\profiles\username folder. The %SystemRoot%\profiles folder contains the user profile for each user of the computer.
Tip By default, when viewing files using Windows NT Explorer, file extensions are hidden.
The following table shows the standard hives for a computer running Windows NT.
Registry Size Limits
The total amount of space that can be consumed by Registry data (hives) is restricted by the registry size limit, which is a kind of universal maximum for registry space that prevents an application from filling the paged pool with registry data. Registry size affects both the amount of paged pool the registry can use and the amount of disk space used by the registry.
To view or set the value for RegistrySizeLimit, first create the key using the following path:
HKEY_LOCAL_MACHINE \SYSTEM \CurrentControlSet \Control \RegistrySizeLimit
The registry size can also be viewed and set using the System option in Control Panel. See the Virtual Memory box in the Performance tab. For information about how to set the registry size using Control Panel, see "Virtual Memory" or "Changing the Virtual-Memory Paging File" in Help.
The registry size should be changed only if the computer is either a primary or backup domain controller for a large network because all user accounts are stored in the registry.
RegistrySizeLimit must have a type of REG_DWORD and a data length of 4 bytes, or it will be ignored. By default, the registry size limit is 25 percent of the size of the paged pool.
Setting a large value for RegistrySizeLimit does not cause the system to use that much space unless it is actually needed by the registry. A large value also does not guarantee that the maximum space will actually be available for use by the registry.
For more details about RegistrySizeLimit, see the Windows NT Workstation Resource Kit version 4.0.
Value Entries in the Registry Keys
Each registry key can also contain data items called value entries. Keys are analogous to directories, and value entries are analogous to files.
A value entry has three parts: the name of the value, the data type of the value, and the value itself, which can be data of any length. The three parts of value entries always appear in the following order.
Data types, such as REG_SZ or REG_EXPAND_SZ, describe the format of the data which can be up to 1 MB. Data types from 0 to 0x7fffffff are reserved for definition by the system, and applications are encouraged to use these types. Data types from 0x80000000 to 0xffffffff are reserved for use by applications.
The following table lists the data types currently defined and used by the system.
How Windows NT Components Use the Registry
The following figure shows how various Windows NT components and applications use the registry.
How components and applications use the registry
Using Registry Editor
You can use the Registry Editor to view registry entries for the various components in Windows NT. You can also use Registry Editor to modify or add registry entries.
Caution When making changes to the system configuration, it is best to use Control Panel or the applications in the Administrative Tools (Common) folder. Otherwise you can impair or disable Windows NT.
The Registry Editor application, Regedt32.exe, does not appear in any default folders It is installed automatically in your %SystemRoot%\system32 folder. Click Run on the Start menu or switch to a command prompt and type regedt32.
For information about how to start Registry Editor, see "Understanding Registry Editor" in Registry Editor Help.
Viewing the Registry
Registry Editor displays the subtrees of the registry. The hierarchical structure that appears in Registry Editor is similar to the hierarchical directory structures of Windows NT Explorer.
Your ability to make changes to the registry using Registry Editor depends on your access permissions. In general, you can make the same kinds of changes in Registry Editor as your permissions allow for Control Panel or other administrative tools.
For information about security and backup measures to take with the registry and other issues, see the Windows NT Workstation Resource Kit version 4.0.
Registry Editor Commands
As shown in the following figure, Registry Editor displays data in two panes. The value entries in the right pane are associated with the selected key in the left pane.
You can use the mouse or commands to manipulate the windows and panes in the Registry Editor in the same way as in the Windows NT Explorer. For example:
The following table shows some keyboard methods for managing the display of data in each Registry Editor window.
The Windows NT Setup program installs two versions of Registry Editor: the Windows NT Registry Editor (Regedt32.exe) and, either the Windows version 3.x version of Registry Editor or the Windows 95 version, which are both named Regedit.exe.
The Windows NT Registry Editor is installed in the %SystemRoot%\system32 directory. The Windows 3.x version (16-bit), or the Windows 95 version (32-bit) of Registry Editor is installed in the %SystemRoot% directory.
Setup installs the Windows 3.x version of Registry Editor if one of the following occurs:
In all other cases, Setup installs the Windows 95 version of Registry Editor in the %SystemRoot% directory.
Systems installed with the Windows 3.x version of Registry Editor can still use the Windows 95 Registry Editor. To use the Windows 95 Registry Editor, copy the following files from the Windows NT Server version 4.0 compact disc: Regedit.exe, Regedit.hlp, and Regedit.cnt.
Caution Do not copy Windows 95 Registry Editor files to the %SystemRoot% directory because they can overwrite the Windows version 3.x Registry Editor files and prevent users from installing applications when running Windows version 3.x. The Windows 95 registry files can be copied to any other directory.
Using Windows NT Diagnostics to View System Configuration Data
You can also use Windows NT Diagnostics to view configuration information stored in the registry. This is the recommended tool to browse for system information. It is located in the Administrative Tools (Common) folder.
Tip You cannot edit value entries using Windows NT Diagnostics, so the registry contents are protected while you browse for information. However, you can create reports and save and print them to use the values in the registry.
Initialization Files and the Registry
The registry is analogous to the initialization (.ini) files used under Windows for MS-DOS, with each key in the registry similar to a bracketed heading in an .ini file and entries under the heading similar to values in the registry. However, registry keys can contain subkeys, whereas .ini files do not support nested headings. Registry values can also consist of executable code rather than the simple strings representing values in .ini files. And unlike .ini files, individual preferences for multiple users of the same computer can be stored in the registry.
Although the registry replaces the .ini files used in versions of Microsoft Windows created for MS-DOS, some .ini files still appear in the Windows NT system directory. Also, applications created for 16-bit Microsoft Windows must still be able to read and write .ini values that were previously stored in the Win.ini or System.ini file.
This section describes how .ini files and other configuration files are used under Windows NT and how these values are stored in the registry.
Note Although Microsoft encourages using registry entries instead of .ini files, some applications (particularly 16-bit Windows-based applications) continue to use .ini files. Windows NT supports .ini files solely for compatibility with 16-bit Windows-based applications and with related tools (such as Setup programs). Some form of the Autoexec.bat and Config.sys files also still exist to provide compatibility with applications created for MS-DOS and Windows 3.1.
For details about how Windows NT uses .ini files in conjunction with the Registry, see the Windows NT Workstation Resource Kit version 4.0.
How Windows NT Uses MS-DOS Configuration Files
Windows NT stores and checks the configuration information in the registry. Windows for MS-DOS involves synchronization between multiple configuration files which start the system, connect to the network, and run applications.
Data in the Windows NT Registry
During system startup, Windows NT adds Path, Prompt, and Set commands from the C:\Autoexec.bat file to the Windows NT environment variables and then ignores the remainder of C:\Autoexec.bat and C:\Config.sys. (If these files are not present when you install Windows NT, the Setup program creates them.)
For a RISC-based computer, default Autoexec.nt and Config.nt files are created.
The path and other Windows NT environment information are stored under the following registry key:
HKEY_LOCAL_MACHINE \SYSTEM \CurrentControlSet \Control \Session Manager\Environment
When an MS-DOS – based application is started, Windows NT runs the files specified in the application's PIF or the Autoexec.nt and Config.nt files in the %SystemRoot%\system32 directory. Changes made to these files take effect as soon as the file is saved and as soon as a new MS-DOS – based application that uses the file is started. You do not need to restart your system after changing the *.nt files.
Use the Windows NT Diagnostics program to view the contents of the Autoexec.nt files and the Config.nt files by clicking Run on the Windows NT Diagnostics File menu. Select View autoexec.nt or View config.nt. You can edit the contents of these files using Notepad.
Windows NT ignores the Autoexec.bat and Config.sys files for starting applications and initializing drivers. To have an application run automatically when you start Windows NT, drag an icon for the application to the Startup folder, as described in Windows NT Server Start Here. For a service or driver, use the Services option in Control Panel to define the startup type. The Services option settings are saved as the Start value in the service's subkey under HKEY_LOCAL_MACHINE \SYSTEM \CurrentControlSet \Services in the registry.
Each MS-DOS–based and 16-bit Windows-based application runs in a Windows NT virtual MS-DOS machine (VDM). Windows NT includes the necessary virtual device drivers (VDDs) for the mouse, keyboard, printer, COM ports, and network support. The VDDs are loaded into every VDM based on values stored in the registry. Information about VDDs is found in the following registry path:
HKEY_LOCAL_MACHINE \SYSTEM \CurrentControlSet \Control \VirtualDeviceDrivers
Changes to the VDD entries are managed automatically by the system when you add a device driver using the options in Control Panel.
Windows for MS-DOS on Windows NT
Windows NT is a 32-bit environment, and Windows 3.x for MS-DOS is a 16-bit environment. For a 16-bit Windows-based application, Windows NT runs the application using a VDM and VDDs. This process is called WOW (for Win16 on Win32). Using a Win16 VDM, Windows NT translates Windows 3.1-based application calls in standard mode for RISC-based computers and in 386 enhanced mode for x86 based-computers.
Control parameters for WOW startup and for the WOW application environment are found under the following registry path:
HKEY_LOCAL_MACHINE \SYSTEM \CurrentControlSet \Control \WOW
The settings in this key are maintained automatically by the system and should not require manual changes.
The environment settings equivalent to the System.ini file for Windows 3.x are found in the following registry path:
HKEY_LOCAL_MACHINE \SOFTWARE \Microsoft \Windows NT\CurrentVersion\WOW
The WOW subkeys have the same names as headings in the System.ini file, and the values are the same items contained in the old System.ini file. For details about these entries, see the Regentry.hlp file on the Windows NT Workstation Resource Guide compact disc.
How .ini Files are Mapped to the Registry
If you install Windows NT as an upgrade over Windows 3.1, all settings from the various initialization files (including Control.ini, Progman.ini, System.ini, Win.ini, Winfile.ini) are copied into the registry. To see where the Windows initialization files are mapped in the registry, view the subkeys and value entries under the following path:
HKEY_Local_Machine \SOFTWARE \Microsoft \Windows NT\CurrentVersion\IniFileMapping
When you install an application created for 16-bit Microsoft Windows, the application's Setup program creates its own .ini file or creates entries for the Win.ini or System.ini file in the same way that it does for any versions of Windows for MS-DOS. These entries are not updated in the registry because these applications do not know how to access the Windows NT registry. For this reason, basic System.ini, Win.ini, and Winfile.ini files appear in the %SystemRoot% directory in Windows NT.
If a Windows-based application tries to write to Win.ini, System.ini, or any other section listed in the IniFileMapping key, and if the application uses the Windows NT registry APIs, the information is stored in the registry. If the application writes to other sections of the .ini file or tries to open the .ini file directly without using the Windows NT registry APIs, the information is saved in an .ini file.
To find mapping information in the HKEY_LOCAL_MACHINE \Software key, the system looks up the filename.ext of the initialization file. If a match is found, the system looks under the mapped key for the specific application name and a variable name. If necessary, the system continues to look for keys whose value entries are the variable names. If no mapping for the application name or file name is found in the registry, the system looks for an .ini file. The system then reads and writes the file contents to the key.
Tables in the following section show where system settings are saved in the registry in comparison to initialization files used with Windows 3.1 for MS-DOS.
In the tables, and in the entries in the IniFileMapping key, the following symbols are used.
Win.ini Settings in the Registry
The following table describes where you can view or edit registry entries equivalent to a Win.ini file.
System.ini Settings in the Registry
When you install Windows NT, entries from a Windows for MS-DOS System.ini file are preserved under the following path:
HKEY_LOCAL_MACHINE \Software \Microsoft \Windows NT\CurrentVersion\WOW
The following table describes where you can view or edit entries for similar purposes in Windows NT. These entries are used by applications that look for values in the System.ini file.
Other Initialization File Settings in the Registry
The following table describes where you can view or edit registry entries equivalent to Control.ini, Progman.ini, and Winfile.ini entries.
Microsoft OS/2 Version 1.x Entries in the Registry
The Microsoft OS/2 version 1.x subsystem starts whenever a user starts an OS/2 character-based application on an x86-based computer. The registry entries for the OS/2 subsystem are found under this path:
HKEY_LOCAL_MACHINE \SYSTEM \CurrentControlSet \Control \Session Manager\SubSystems
The Os2 entry in this subkey describes the path to the executable file used to start the OS/2 subsystem. The directory path for the OS/2 library is the Os2LibPath value defined under the Session Manager\Environment subkey.
If Setup finds a copy of Config.sys for OS/2 when Windows NT is installed, a copy is placed in the %SystemRoot%\system32 directory. This information is used to configure the OS/2 subsystem whenever an OS/2 application is started. If a Config.sys file is not found, a substitute with the following values is created in the Registry:
PROTSHELL=C:\os2\pmshell.exe c:\os2\os2.ini c:\os2\os2sys.ini %SystemRoot%\system32\cmd.exeSET COMSPEC=%SystemRoot%\system32\cmd.exe
The OS/2 Config.sys information is stored in the following registry entry, which appears only after an OS/2 application has been run on the system:
HKEY_LOCAL_MACHINE \SOFTWARE \Microsoft \OS/2 Subsystem for NT\config.sys
The other subkeys under the OS/2 Subsystem key do not contain entries.
If you subsequently edit the C:\Config.sys file using a text editor, LIBPTH=, SET PATH=, and Set WINDIR= entries are appended to the end of the file from the Windows NT environment. Any changes made to the path or environment variables take effect after the system is shut down and restarted.
For details about managing this environment under Windows NT, see Appendix B "Other Application Environments."
You can disable an OS/2 subsystem in Windows NT and still run a bound application under a VDM. Many bound applications run better under a VDM than under the OS/2 subsystem.
To disable the OS/2 subsystem in Windows NT
You can also use Forcedos.exe, a tool supplied in the %SystemRoot%\system32 subdirectory. This tool enables you to run a bound application under a VDM. For information about how to use the ForceDOS tool, type forcedos /? at the command prompt.
POSIX Entries in the Registry
The POSIX subsystem starts whenever a user starts a POSIX application. The registry entries for the POSIX subsystem are found under this path:
HKEY_LOCAL_MACHINE \SYSTEM \CurrentControlSet \Control \Session Manager\SubSystems
The Posix entry in this subkey describes the path to the executable file used to start the POSIX subsystem. The POSIX subsystem does not have any parameters or environmental variables that the user can set.
POSIX utilities and their source code are available on the Windows NT Workstation Resource Kit compact disc.