Section 7: Registry Virtualization

The Big Picture: Two Different Tricks

"Virtualization" means Windows quietly sends a program somewhere other than where it asked, so the program works without knowing. There are two separate registry tricks, and beginners often mix them up. Keep them apart:

TRICK 1: 32-bit program asks for       HKLM\SOFTWARE\MyApp
                          Windows gives  HKLM\SOFTWARE\WOW6432Node\MyApp

TRICK 2: old program writes to         HKLM\SOFTWARE\OldApp
                          Windows saves  HKCU\Software\Classes\VirtualStore\
                                         MACHINE\SOFTWARE\OldApp

This section first explains Trick 2 (the one the topic list is about), then Trick 1 so you do not confuse them.

7.1 UAC Registry Redirection for Legacy Apps

What it is: UAC virtualization is a compatibility feature. It exists for legacy apps: programs written for older Windows versions (such as Windows XP), when every user was an administrator and programs freely wrote to HKLM and to C:\Program Files.

The problem. Today, a standard user cannot write to HKLM (Section 6). An old program that tries to save a setting there would get "access denied" and may simply crash.

The fix. If the program is a 32-bit program, not marked as UAC-aware, and not run as administrator, Windows may quietly redirect its write to a safe place the user can write to. The program thinks the write worked. Later, when it reads the value back, Windows serves it from the safe place.

Old program: "Write ScreenSize=800 to HKLM\SOFTWARE\OldApp"

        Standard user, program not elevated:
        the real HKLM is protected, so the write is redirected.

        Value goes to the user's private store instead.

        The program reads it back: finds it. All happy.

Important facts (some details vary by Windows version; check Microsoft's documentation for exact rules):

• It applies only to certain places, mainly under HKLM\SOFTWARE. Writes to other parts of HKLM, such as HKLM\SYSTEM, are normally not redirected: they simply fail.
• It affects writes and the reads that follow them.
• It does not apply to 64-bit programs, to programs that include a manifest saying they understand UAC, or to programs running as administrator.
• It is per user. Each user gets their own private copy, so one user cannot see another's "virtualized" settings.
• It was meant as a bridge for old software, not as a feature for new software. Microsoft says to fix the program instead.

What is a manifest? A small XML description embedded in (or beside) a program. It states things such as "I need administrator rights" or "I do not need virtualization". Programs written for modern Windows include one.

7.2 VirtualStore Mechanism

What it is: The VirtualStore is the private place where redirected writes land. For the registry it is a key inside the user's own hive:

HKCU\Software\Classes\VirtualStore\MACHINE\SOFTWARE\...

MACHINE is the VirtualStore's name for HKLM. So a write meant for HKLM\SOFTWARE\OldApp ends up at:

HKCU\Software\Classes\VirtualStore\MACHINE\SOFTWARE\OldApp

(Recall from Section 2 that HKCU\Software\Classes is stored in UsrClass.dat.)

How a read works. When the legacy program reads HKLM\SOFTWARE\OldApp, Windows first looks in the VirtualStore for this user. If a copy is there, it returns that. If not, it reads the real HKLM.

READ from HKLM\SOFTWARE\OldApp
   │
   ├── Is there a copy in this user's VirtualStore?  ── yes ──► return it
   │
   └── no ──► return the value from the real HKLM

The same idea exists for files: writes to C:\Program Files may be redirected to C:\Users\<name>\AppData\Local\VirtualStore.

Why you should know this.

Checking what is being virtualized. In Task Manager, open the Details tab, right-click the column header, choose Select columns, and tick UAC virtualization. A process shows Enabled, Disabled or Not allowed.

Now Trick 1: WOW64 registry redirection (not UAC).

Windows 10 and 11 are usually 64-bit and can still run 32-bit programs through a layer called WOW64 (Windows 32-bit on Windows 64-bit). A 32-bit program expects a 32-bit view of the registry. If both a 32-bit and a 64-bit version of the same program stored settings at the same path, they would collide.

So Windows gives 32-bit programs a separate copy of some keys:

This is often called registry redirection, and there is also registry reflection, which in older Windows copied some changes between the two views for a few shared keys (details changed across versions, so treat it as a background fact).

How the two tricks differ:

Windows tip. The 64-bit regedit shows WOW6432Node as a normal key. A 32-bit program sees that node's contents as its normal SOFTWARE. If a program "cannot find its key", check both places.

Summary