Registry structure

The registry is organized in a hierarchical structure of subtrees and their keys, subkeys, and value entries

The contents of the registry for one computer may vary widely from that of another, depending on the devices, services, and programs installed on each computer. The following illustration shows an example of a registry, as viewed by a version of Registry Editor (Regedit.exe) provided with Windows 2000.

Keys can have subkeys and subkeys can, in turn, have subkeys. While most information in the registry is stored on disk and is considered permanent, some information, stored in volatile keys, is overwritten each time the operating system starts.

Registry subtrees

Windows 2000 has two registry subtrees: HKEY_LOCAL_MACHINE and HKEY_USERS. However, to make the information in the registry easier to find, the Registry Editor utilities display five subtrees, which are listed and described in the following table.

Root key name	Description
HKEY_LOCAL_MACHINE	Contains information about the local computer system, including hardware and operating system data such as bus type, system memory, device drivers, and startup control data.
HKEY_CLASSES_ROOT	Contains information used by various OLE technologies and file-class association data (equivalent to the registry in Windows for MS-DOS). A particular key or value exists in HKEY_CLASSES_ROOT if a corresponding key or value exists in either HKEY_LOCAL_MACHINE\SOFTWARE\Classes or HKEY_CURRENT_USER\SOFTWARE\Classes. If a key or value exists in both places, the HKEY_CURRENT_USER version is the one that appears in HKEY_CLASSES_ROOT.
HKEY_CURRENT_USER	Contains the user profile for the user who is currently logged on interactively (as opposed to remotely), including environment variables, desktop settings, network connections, printers, and program preferences. This subtree is an alias of the HKEY_USERS subtree and points to HKEY_USERS\security ID of current user.
HKEY_USERS	Contains information about actively loaded user profiles and the default profile. This includes information that also appears in HKEY_CURRENT_USER. Users who are accessing a server remotely do not have profiles under this key on the server; their profiles are loaded into the registry of their own computers.
HKEY_CURRENT_CONFIG	Contains information about the hardware profile used by the local computer system at startup. This information is used to configure settings such as the device drivers to load and the display resolution to use. This subtree is part of the HKEY_LOCAL_MACHINE subtree and points to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\Current.

Each root key name begins with HKEY_ to indicate to software developers that this is a handle that a program can use. A handle is a value used to identify a resource so that a program can access it.

note Note

One version of Registry Editor, Regedit.exe, displays a sixth subtree, HKEY_DYN_DATA. This is a subtree of the Windows 95 and Windows 98 registries, but it is not used by Windows 2000. For more information about Registry Editor, see Using Regedt32.exe and Regedit.exe
The behavior of HKEY_CLASSES_ROOT is different from previous versions of Windows. In Windows 2000, a feature called per-user class registration provides a view of HKEY_CLASSES_ROOT that contains both user-specific class registrations and computer-specific class registration. With this feature, different users can have different sets of class registrations (including those for file associations, COM components, and MIME types). Previously, all users shared registrations, so that one user could alter registrations for other users. Per-user class registration isolates each user's registrations and allows the administrator to increase security on HKEY_LOCAL_MACHINE\Software\Classes.

Registry hives and files

The term hive describes a body of keys, subkeys, and values that is rooted at the top of the registry hierarchy. A hive is backed by a single file and a .log file that are in the systemroot\System32\Config or the systemdrive\Documents and Settings\username folders. The string systemroot is a placeholder for the directory name that contains the Windows 2000 system files; the string systemdrive is a placeholder for the partition that contains the Windows 2000 system files. For example, if the Windows 2000 system files for a user named Annie are in a directory called Winnt in the C: partition, the hive files are stored in the C:\Winnt\System32\Config and C:\Documents and Settings\Annie folders. Hives may also be called registry files or registry log files.

By default, most hive files (DEFAULT, SAM, SECURITY, SOFTWARE, and SYSTEM) are stored in the systemroot\System32\Config folder. In Windows 2000, the location of user profile information for each user of a computer, including the Ntuser.dat and Ntuser.dat.log, may depend on whether the installation of the operating system was a fresh installation or whether it was installed as an upgrade from Windows 95, Windows 98, or Windows NT. In fresh installations and upgrades from Windows 95 and Windows 98, the Ntuser.dat and Ntuser.dat.log files are stored in the systemdrive\Documents and Settings\username folder. In installations that are upgrades from Windows NT, the Ntuser.dat and Ntuser.dat.log files are stored in the systemroot\Profiles\username folder.

Each hive in the Windows 2000 registry is associated with a set of standard files. The following table shows the standard hives and files for a computer running Windows 2000.

Registry hive	File names
HKEY_LOCAL_MACHINE\SAM	Sam and Sam.log
HKEY_LOCAL_MACHINE\SECURITY	Security and Security.log
HKEY_LOCAL_MACHINE\SOFTWARE	Software and Software.log
HKEY_LOCAL_MACHINE\SYSTEM	System and System.log
HKEY_CURRENT_CONFIG	System and System.log
HKEY_CURRENT_USER	Ntuser.dat and Ntuser.dat.log
HKEY_USERS\.DEFAULT	Default and Default.log

Value entries in the registry keys

Each registry key or subkey can contain data called value entries. Some value entries store information that is specific to each user, while others store information that applies to all users of a computer. A value entry has three parts: the name of the value, the data type of the value, and the value itself. The three parts of value entries always appear in the following order.

Data types describe the format of the data. Data types from 0 through 0x7FFFFFFF are reserved for definition by the system. Programs are encouraged to use these data types, but data types from 0x80000000 through 0xFFFFFFFF are also reserved for use by programs.

The following table lists the data types currently defined and used by the system.

Data type	Description
REG_BINARY	Raw binary data. Most hardware component information is stored as binary data and is displayed in Registry Editor in hexadecimal format.
REG_DWORD	Data represented by a number that is 4 bytes long. Many parameters for device drivers and services are this type and are displayed in Registry Editor in binary, hexadecimal, or decimal format.
REG_EXPAND_SZ	A variable-length data string. This data type includes variables that are resolved when a program or service uses the data.
REG_MULTI_SZ	A multiple string. Values that contain lists or multiple values in a form that people can read are usually this type. Entries are separated by spaces, commas, or other marks.
REG_SZ	A fixed-length text string.
REG_FULL_RESOURCE_DESCRIPTOR	A series of nested arrays designed to store a resource list for a hardware component or driver.

Registry size limits

Registry data is stored in the paged pool, a portion of virtual memory that is written to a physical disk when not in use. A value called the registry size limit prevents programs from completely filling the paged pool with registry data.

You can view and set the size of the registry by using System in Control Panel. On the Advanced tab, click Performance Options, and then click Change. For more information about setting the registry size, see To change the maximum size of the computer's registry and To change the size of the virtual memory paging file

By default, the registry size limit is 33 percent of the size of the paged pool. A registry size limit of up to 80 percent of the size of the paged pool is allowed. The minimum registry size is 16 megabytes (MB). If you attempt to set the registry size to anything smaller, the system resets this value to 16 MB.

You should change the registry size only if the computer is a domain controller for a large network or if you receive an error message warning you that the registry is too small. Note that setting a large value for the registry size limit does not cause the system to use that much space unless it is actually needed by the registry. In addition, a large value does not guarantee that the maximum space is actually available for use by the registry.