Section 7: Registry (Configuration Manager)

The Big Picture: Windows' Settings Database

Every program needs to remember settings: which theme, which printer, which services start at boot. Early Windows used many small text files (.ini files) scattered everywhere. NT replaced them with one central database: the registry. The part of the kernel that looks after it is the Configuration Manager (Section 3.5).

Think of the registry as a giant filing cabinet: drawers (hives), folders inside drawers (keys), and sheets in folders (values).

7.1 Central Configuration Database

What it is: The registry is a hierarchical (tree-shaped) database that holds the settings of Windows, drivers, services, programs and users.

The vocabulary:

Value types:

The five root keys (what you see in regedit):

Only two are "real". Strictly speaking, HKLM and HKU are the real top-level keys. The other three are shortcuts or merged views: HKCU points to the current user's branch inside HKU, HKCR combines parts of HKLM and HKCU, and HKCC points to a branch inside HKLM.

Who uses it?

• The kernel reads it at boot (for example, which drivers to load).
• Services: each service's settings are under HKLM\SYSTEM\CurrentControlSet\Services\<name>.
• Applications: store options under HKCU\Software\<company> or HKLM\SOFTWARE\<company>.
• Windows itself: file associations, startup items, UI settings.

A few well-known places (look, do not touch):

7.2 Hives

What it is: A hive is a large branch of the registry that is stored as a single file on disk. The registry you see in regedit is built from several hives loaded into memory.

 What you see in regedit            Where it is stored on disk
 ─────────────────────────          ────────────────────────────────────
 HKLM\SYSTEM        ───────────►    C:\Windows\System32\config\SYSTEM
 HKLM\SOFTWARE      ───────────►    C:\Windows\System32\config\SOFTWARE
 HKLM\SAM           ───────────►    C:\Windows\System32\config\SAM
 HKLM\SECURITY      ───────────►    C:\Windows\System32\config\SECURITY
 HKU\.DEFAULT       ───────────►    C:\Windows\System32\config\DEFAULT
 HKCU (your user)   ───────────►    C:\Users\<name>\NTUSER.DAT
 HKCU\Software\Classes ────────►    C:\Users\<name>\AppData\Local\
                                      Microsoft\Windows\UsrClass.dat

The main system hives:

Special case: the boot configuration. The boot loader's settings (Chapter 5) are stored in a hive too, the BCD (Boot Configuration Data), in the system's boot files area. You edit it with bcdedit, not regedit.

Volatile parts. Not all of the registry is saved to disk. For example, the hardware branch HKLM\HARDWARE is built fresh at every boot from what the firmware and PnP Manager find. It lives only in memory.

Safety files. Next to each hive file are .LOG1 and .LOG2 files. They record changes before they are written to the main file, so a power cut in the middle of a write does not corrupt the registry. Old Windows versions also kept a RegBack folder of backups, but the automatic backups are off by default in modern Windows. System Restore and backups are the safe way back.

When are hives loaded?

• System hives (SYSTEM, SOFTWARE, SAM, SECURITY, DEFAULT): loaded at boot. The SYSTEM hive is loaded very early, by the boot loader, because the kernel needs it.
• User hives (NTUSER.DAT): loaded when the user logs on (winlogon.exe, Section 5.8) and unloaded when they log off.

Because a hive is a normal file at rest, you can copy NTUSER.DAT only when that user is not logged on. Windows keeps a hive file open and locked while it is in use.

7.3 Registry Access

What it is: The ways you and programs read and change the registry.

1. Registry Editor (regedit). Press Win + R, type regedit. The left pane is the key tree, the right pane shows values. To look safely:

• Look, do not edit. Browsing changes nothing.
• Before any change, right-click the key → Export to save a .reg backup.
• Admin rights are needed for most HKLM changes.
• Never delete keys you do not understand.

2. The command line.

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run

3. PowerShell. PowerShell treats the registry like a drive:

Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" | Select-Object ProductName, CurrentBuild
Get-ChildItem "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"

4. Programs (the API). Applications call Win32 functions in advapi32.dll / kernelbase.dll:

What happens inside. Each call goes down through ntdll.dll to a system call (NtOpenKey, NtQueryValueKey...). The Configuration Manager in the kernel finds the key in the hive in memory. The Security Reference Monitor checks the key's ACL first, which is why a normal user cannot edit HKLM.

Registry and the 32-bit/64-bit split. On 64-bit Windows, 32-bit programs are shown a separate copy of some keys (HKLM\SOFTWARE\WOW6432Node) so the two worlds do not overwrite each other.

The risks.

Summary