Section 3: Keys and Values

The Big Picture: Folders and Cards

In the filing-cabinet picture from Section 1, there are only two kinds of things:

• Keys are the folders. A key can hold other keys (subkeys) and values.
• Values are the cards. A value holds one actual piece of data.

That is the whole structure. Everything else in this chapter is a detail on top of these two ideas.

KEY  (folder)        :  HKCU\Control Panel\Mouse
 ├── VALUE (card)    :  MouseSpeed          = "1"        (type REG_SZ)
 ├── VALUE (card)    :  DoubleClickSpeed    = "500"      (type REG_SZ)
 └── VALUE (card)    :  SwapMouseButtons    = "0"        (type REG_SZ)

In regedit, keys appear in the left pane (the tree). The values of the selected key appear in the right pane, as a table with three columns: Name, Type and Data.

3.1 Key Structure (Folder-Like Hierarchy)

What it is: A key is a container with a name. It can hold:

1. Subkeys (more keys, which makes the tree deeper)
2. Values (the data)
3. A little extra information, such as a last write time (when the key was last changed) and the security rules (Section 6)

A path names a key by listing every key from the top down, separated by backslashes:

HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run
 root key             hive      company     product    feature        key

How it compares to folders and files:

Differences from a file system that surprise people:

• A key has no data of its own except through its values. A key is just a container.
• Key names cannot contain a backslash (\), because the backslash separates levels.
• Key names are not case-sensitive: Software and SOFTWARE are the same key.
• There are limits, which are generous but real. As a rule of thumb (check Microsoft's current documentation for exact numbers): a key name can be a few hundred characters long (255 is the commonly quoted limit), and the tree can be many levels deep. A single value can be large, but it is meant for small data; storing big blobs is discouraged.
• Some keys are volatile: they exist only while Windows runs and are never saved to disk (for example, HKLM\HARDWARE).
• Some keys are symbolic links that point to other keys. For example, CurrentControlSet is a link (see below).

A real example: ControlSet. Open HKLM\SYSTEM and you will see keys named ControlSet001, and sometimes ControlSet002, and one called CurrentControlSet:

HKLM\SYSTEM
 ├── ControlSet001        (a real copy of the boot settings)
 ├── ControlSet002        (may exist; an older "last known good" copy)
 ├── CurrentControlSet ──► (a link to the set in use right now, e.g. ControlSet001)
 └── Select               (says which set is current)

Programs always use CurrentControlSet, so they do not need to know which numbered set is active. This design came from the days when Windows kept a "Last Known Good Configuration" to boot from if you broke the settings.

Windows tip: copy a key path. In regedit, right-click a key and choose Copy Key Name. In newer builds, the address bar at the top of regedit shows the full path and lets you paste a path to jump straight there. This is much faster than clicking down the tree.

Reading from the command line:

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName

• reg query means "show me what is stored".
• /v ProductName means "only this value".
• The output shows the name, the type and the data.

3.2 Value Names and Default Values

What it is: A value has three parts:

Value names:

• Must be unique inside one key (two different keys can both hold a value called Version).
• Are also not case-sensitive.
• May contain a backslash, unlike key names (but it is rare to see this).
• Can be quite long, with a limit larger than key names (a limit of 16,383 characters is often quoted; treat this as a rough guide).

The default value: the nameless one. Every key has one special value that always exists and has no name. In regedit it shows up as (Default). Its type is normally REG_SZ.

Key:  HKCR\.txt
 ┌─────────────────┬──────────┬────────────────────────┐
 │ Name            │ Type     │ Data                   │
 ├─────────────────┼──────────┼────────────────────────┤
 │ (Default)       │ REG_SZ   │ txtfile                │
 │ Content Type    │ REG_SZ   │ text/plain             │
 │ PerceivedType   │ REG_SZ   │ text                   │
 └─────────────────┴──────────┴────────────────────────┘

If a value was never set, regedit shows (value not set) next to (Default). That means the nameless value exists but has no data yet.

Why have a default value? It was a way for a key to say "my main meaning is this", without having to invent a name. It is used all over HKCR: the (Default) of .txt says "this type is called txtfile". The (Default) of a command key holds the actual command line to run.

Windows tip: the three types of "nothing".

A program may treat these three differently. For example, a missing value often means "use the built-in default", but an empty string may mean "I chose nothing".

Reading values in PowerShell:

Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" |
    Select-Object ProductName, CurrentBuild

• HKLM: is a drive that PowerShell provides, so the registry looks like a folder tree. HKCU: works the same way.
• Get-ItemProperty reads the values of a key.

Summary