Section 9: How Applications Use the Registry

The Big Picture: The Program's Notebook

A program does not carry its memory from one run to the next. When you close it, everything in RAM is lost. If the program wants to remember that you picked the dark theme, it must write that fact somewhere permanent. The registry is one of the places it can use.

Every program follows the same three-step habit:

1. OPEN   the key it wants        (like opening a folder)
2. READ or WRITE the value        (like reading or writing a card)
3. CLOSE  the key                 (like putting the folder back)

9.1 Reading Configuration at Startup

What it is: Many programs, and Windows itself, read settings from the registry when they start. This tells them how to behave before the first window appears.

How a program talks to the registry. Programs call functions in the Windows API (the set of functions Windows offers to programs, see Chapter 8). The main ones:

(Ex means "extended": these are the modern versions of older functions.)

A short example in plain words. Here is what a program does to read a value, shown as simple steps:

RegOpenKeyEx(HKEY_CURRENT_USER, "Software\MyApp", ...)   -> handle
RegQueryValueEx(handle, "Volume", ...)                    -> 50
RegCloseKey(handle)

Other languages use the same functions underneath.

Whatever the language, the request ends up in the same place, the Configuration Manager in the kernel (Section 11).

Expanding variables. If the value is REG_EXPAND_SZ (Section 4.6), a program must ask Windows to expand it. The API function is ExpandEnvironmentStrings. (Some helper libraries do it automatically.)

Who reads the registry at startup?

Startup programs: the Run keys. The registry also decides which programs start when you sign in. These keys hold one value per program; each value's data is the command line to run:

Example (view only):

reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run

You may see entries such as a cloud-storage app or a chat program. The Startup apps page in Windows Settings (and the Startup tab of Task Manager) is the safe way to turn them off. The Run keys are also a favourite place for malware to hide, so security tools look here first.

Note: Windows also keeps an "approved/disabled" record for these items elsewhere in the registry (mostly as REG_BINARY data). This is why Task Manager can disable an entry without deleting the Run value. Do not edit it by hand.

9.2 Storing User Preferences

What it is: When you change an option in a program ("Remember my window position", "Use metric units"), the program often stores it under HKCU\Software\<Company>\<Product>. This is the standard home for per-user preferences.

HKCU\Software
 ├── Microsoft
 │    └── Windows ...        (many Windows settings)
 ├── ExampleCompany
 │    └── ExampleApp
 │         ├── WindowLeft   = 120     (REG_DWORD)
 │         ├── WindowTop    = 80      (REG_DWORD)
 │         ├── LastFolder   = C:\Docs (REG_SZ)
 │         └── Theme        = dark    (REG_SZ)
 └── ...

Why HKCU and not HKLM?

Which settings belong in HKLM? Things that are the same for all users and that only an installer should set: the install folder, the product version, a license, a service's settings.

Good habits for program makers (and useful to know as a user):

• Store small values only: numbers, short text, short lists.
• Keep everything under a key named after the company and the product.
• Do not write to HKLM while running as a normal user (Section 7).
• Use the correct type for each value.
• Remove the keys on uninstall. Many programs forget, which is why old keys pile up in the registry. Cleaning tools that promise "faster Windows" by deleting unused keys rarely help and can do harm; leftover keys are tiny and have almost no effect on speed.

Programs that avoid the registry. Many modern apps keep their settings in their own files (JSON, XML, or a small database) in %APPDATA%. Windows "Store" apps (UWP) keep settings in a private store with its own hive that Windows manages. The registry is not the only way, but it is still the standard for Windows itself.

9.3 File Associations (HKCR)

What it is: A file association says "when you double-click a .txt file, open it with Notepad". It is a good example of the registry at work, and it uses the HKEY_CLASSES_ROOT (HKCR) root key from Section 2.

The chain of lookups. Windows follows keys, one pointing to the next:

You double-click  report.docx

STEP 1   HKCR\.docx
            (Default) = Word.Document.12        ← "this extension's type name"
                  │
                  ▼
STEP 2   HKCR\Word.Document.12                   ← the type's description
            (Default) = Microsoft Word Document
            DefaultIcon\(Default) = ...icon...   ← which icon to show
                  │
                  ▼
STEP 3   HKCR\Word.Document.12\shell\open\command
            (Default) = "...\WINWORD.EXE" "%1"   ← what to run
                                       │
                                       ▼
STEP 4   Windows starts the program and replaces %1 with the file's full path

(Names of the type keys differ between PCs and versions of Office. Use this as a model, not as exact text.)

The pieces:

Per-user choice. Which program you chose as default is stored under your own hive:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ext\UserChoice. In Windows 8 and later this key is protected by a hash that Windows checks, so that programs cannot change your default silently. Change it through Settings → Apps → Default apps.

Merged view reminder. Because HKCR merges HKLM\SOFTWARE\Classes and HKCU\Software\Classes (Section 2), a program installed for you only can add its associations to HKCU without needing administrator rights, and these override the all-users ones.

Context menu entries. The right-click menu entries you see on files and folders (for example "Open with ...") come from shell keys here and from extra "handlers" registered by programs. Messy or broken entries here are a common reason for a slow right-click menu.

Windows tip: see the whole chain for .txt.

reg query HKCR\.txt
reg query HKCR\txtfile\shell\open\command

Both commands only read.

Summary