Practical Lab: Control Panel Tracing

Objective

Prove the ideas of this chapter on your own PC: find the applet files, find which file hosts which applet, open applets by name, and follow one setting from the window you click to the registry value Windows saves. Everything is read-only, except one small, optional mouse-speed change that you undo straight away.

Time: 25–30 minutes
You need: A Windows PC. No extra software is required. (One free optional tool is named in Part 5.)

What to Open

Part 1: Find the Applet Files (the .cpl DLLs)

In PowerShell:

Get-ChildItem C:\Windows\System32\*.cpl | Select-Object Name, Length

1. How many .cpl files does your PC have? ________________
2. Is main.cpl in the list? ________________
3. Is desk.cpl in the list? (It is the old Display applet; Display has moved to Settings.) ________________

Part 2: Which File Hosts Which Applet?

Open each by name from the Run box (Win + R) and fill in the table. Close each window after looking. These only open windows.

Now try the "run through a helper" way from Section 2.2. In PowerShell:

rundll32.exe shell32.dll,Control_RunDLL main.cpl

4. Does it open the same Mouse window as typing main.cpl? ________________

Next, try the canonical names (Section 2.3). Each opens a window:

control /name Microsoft.PowerOptions
control /name Microsoft.NetworkAndSharingCenter
control /name Microsoft.ProgramsAndFeatures

5. Do all three open? ________________ (If one opens the Settings app instead, it has been redirected. That is normal.)

Part 3: Which Window Hosts the Applet? (Task Manager)

1. Press Ctrl + Shift + Esc to open Task Manager. Open Details.

2. Open main.cpl from the Run box. Look for new entries such as control.exe or rundll32.exe, or just explorer.exe doing the work.

3. Close the Mouse window and see the entry disappear.

4. Which process name appeared, if any? ________________

What this shows: The applet is not a program of its own. It runs inside a host process, as Section 2.2 explained. Which host you see can depend on how you opened it and on your Windows version. Any answer is fine.

Part 4: Look at the Registry (Applet Registration and a Saved Setting)

4A. The list of modern applets. In regedit go to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace

7. How many GUID keys can you see? ________________

Look only. Do not edit, rename or delete anything.

4B. The saved mouse setting. In PowerShell:

Get-ItemProperty 'HKCU:\Control Panel\Mouse'

8. What is MouseSensitivity? ________________ (10 is the default)
9. What are MouseSpeed, MouseThreshold1 and MouseThreshold2? ________________

4C. Other saved settings in the same style.

Get-ItemProperty 'HKCU:\Control Panel\International' | Select-Object sShortDate, sDecimal, sList, LocaleName
Get-ChildItem Env:TEMP

10. What is your short-date pattern (sShortDate)? ________________
11. Compare it with what Region (intl.cpl) shows under "Short date". Do they match? ________________

Part 5: Trace One Setting End to End (Mouse Speed)

This is the chain from Section 3, done for real. You only change the pointer speed by one notch and put it back.

1. Write down your value from step 8 (for example 10).

2. In PowerShell, read it once more: (Get-ItemProperty 'HKCU:\Control Panel\Mouse').MouseSensitivity

3. Open main.cpl, go to Pointer Options, and move the speed slider one notch to the right. Click Apply.

4. Read the registry value again with the same PowerShell command.

5. What was the value before? ________________ After? ________________

6. Did the pointer feel faster straight away, without restarting? ________________

Now undo it. Move the slider back one notch, click Apply, read the value once more and check that it matches your first number. Click OK.

Optional (free Sysinternals tool from Microsoft): Process Monitor. You can see the write happen. This is optional.

1. Download Process Monitor only from Microsoft's official Sysinternals site. Run it (it needs administrator permission to capture).

2. Press Ctrl + E to pause capturing, then Ctrl + X to clear the list.

3. Set a filter (Ctrl + L): Path contains Control Panel\Mouse, then add Operation is RegSetValue.

4. Press Ctrl + E to start capturing, then click Apply in the Mouse window.

5. Look for a RegSetValue line for MouseSensitivity. Note the Process Name column.

6. Press Ctrl + E to stop. Then restore your speed as above.

7. Which process wrote the value? ________________ (It may be explorer.exe, rundll32.exe or control.exe, depending on how the window was opened.)

What Should Happen

• Part 1 shows a list of .cpl files in System32.
• Part 2 shows that applets can be opened by file name, by rundll32 or by canonical name, and that some now redirect to Settings.
• Part 4 shows a list of GUID keys (modern applets) and saved values under HKCU\Control Panel.
• Part 5 shows MouseSensitivity changing right when you click Apply, then returning when you undo.

Interpretation Guide

Follow-Up Questions

1. Why can the same applet be started in three different ways (file name, rundll32, canonical name) and still show the same window?
2. Which registry hive (HKCU or HKLM) held the mouse setting, and what does that tell you about who the setting belongs to?
3. In Part 2, which of your applets were redirected to Settings? What does this say about the future of the Control Panel?
4. Why did the pointer change speed at once, even though the value is stored in the registry for next time?
5. Name three facts from this lab that you could not have learned just from using the Control Panel's menus.