Practical Lab: Safe Registry Exploration

WARNING: READ THIS BEFORE YOU START

• Back up first. Part 5 makes a restore point and an export before anything is written.
• Never edit unfamiliar keys. In this lab you only look at real keys. You write only inside one test key that you create yourself: HKCU\Software\LearningLab.
• Do not touch HKLM except to read it. A mistake in HKLM can stop Windows from booting.
• There is no Undo in regedit. A deleted key is gone at once.
• At the end, delete the test key (Part 8).
• If any command is not on this page, do not run it.

Objective

Explore the registry with your own eyes and your own hands, safely. You will read keys, see the five root keys and the types, look at the startup (Run) keys, create a test key, change it, export it, and remove it. You will see the chain from Section 11 happen on a small scale.

Time: 30–40 minutes
You need: A Windows PC. No extra software. A normal (non-admin) window is enough for everything here.

What to Open

Part 1: Look Around (Read Only)

Open regedit. Click Computer at the top of the left pane.

1. How many root keys do you see? ________________
2. Which two are the real roots (Section 2)? ________________
3. Which root key is a merged view of two places? ________________

Now go to this key. (Paste the path into the address bar at the top of regedit, then press Enter.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion

Read, but do not double-click any value:

4. ProductName: ________________
5. CurrentBuild: ________________
6. Type column for ProductName (the type from Section 4): ________________
7. Type column for InstallDate or UBR (a number): ________________

Part 2: Ask the Command Line (Read Only)

In Command Prompt:

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
reg query "HKCU\Control Panel\Desktop" /v WallPaper

In PowerShell, the same facts a different way:

Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" | Select-Object ProductName, CurrentBuild
Get-ChildItem HKLM:\SOFTWARE | Select-Object -First 10 Name

8. Does the first reg query show the same name you read in regedit? ________________
9. Which commands needed no administrator rights? ________________

Part 3: Startup Programs (Run Keys, Read Only)

Section 9 told you the Run keys decide what starts at sign-in. Look at them:

reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run

In regedit, visit both keys and see the names and the data (the command line):

10. How many values are in the HKCU Run key? ________________
11. How many in the HKLM Run key? ________________
12. Pick one entry. Which program does it start? ________________

You are allowed to look. To turn a startup app off, use Settings → Apps → Startup or Task Manager's Startup apps tab. Do not delete values here.

Part 4: See the Hive Files (Read Only)

Get-ChildItem $env:USERPROFILE -Force -Filter "NTUSER.DAT*" | Select-Object Name, Length
Get-ChildItem C:\Windows\System32\config -Force | Select-Object Name, Length

13. Do you see NTUSER.DAT and its .LOG1 and .LOG2 files? ________________
14. The second command may say access denied for a normal user. Why (Section 6)? ________________

Part 5: Make a Safety Net

Before any write, do two things.

5A. Create a restore point (Section 10.2): press Win, type Create a restore point, choose your C: drive, make sure protection is On (otherwise click Configure and turn it on), click Create, name it Before registry lab.

5B. Export the parent key to a temporary folder. We export HKCU\Software so there is a copy of the area we will work in:

reg export "HKCU\Software" "%TEMP%\HKCU-Software-backup.reg" /y

15. Open %TEMP%\HKCU-Software-backup.reg in Notepad (just read). Is it plain text? ________________

(It may be large. Close Notepad when done.)

Part 6: Create and Use a Test Key

Everything below happens in HKCU\Software\LearningLab, which does not exist yet and which nothing else uses.

6A. Create it with reg add:

reg add "HKCU\Software\LearningLab" /v UserName /t REG_SZ /d "Rover" /f
reg add "HKCU\Software\LearningLab" /v Volume /t REG_DWORD /d 50 /f
reg query "HKCU\Software\LearningLab"

• /v is the value name, /t is the type, /d is the data, /f means "do not ask".

16. What does the query show for Volume (hex and decimal)? ________________

6B. Look at it in regedit. Go to HKEY_CURRENT_USER\Software\LearningLab. Press F5 to refresh. Double-click Volume. Notice the Base choice (Hexadecimal or Decimal). Click Cancel.

6C. Change a value with PowerShell:

Get-ItemProperty HKCU:\Software\LearningLab
Set-ItemProperty HKCU:\Software\LearningLab -Name Volume -Value 80
Get-ItemProperty HKCU:\Software\LearningLab

17. What was the value before and after? ________________

6D. Add a second key and a list value with PowerShell:

New-Item HKCU:\Software\LearningLab\Settings
New-ItemProperty HKCU:\Software\LearningLab\Settings -Name Colors -PropertyType MultiString -Value @("red","blue","green")
Get-ChildItem HKCU:\Software\LearningLab

18. In regedit, what type does Colors have? ________________ How do the three items show when you open it? ________________

6E. Prove the "no Save button" rule (Section 11.2). Keep regedit open on LearningLab. In a terminal run:

reg add "HKCU\Software\LearningLab" /v Volume /t REG_DWORD /d 25 /f

Look at regedit before pressing F5, then press F5.

19. Did the value change on its own, or only after refresh? ________________ (Programs can ask to be notified, Section 11.3; regedit does not always repaint at once.)

Part 7: Export the Test Key

reg export "HKCU\Software\LearningLab" "%TEMP%\LearningLab.reg" /y

Open %TEMP%\LearningLab.reg in Notepad.

20. Find the "Volume"=dword:... line. What number is written, and is it hex or decimal? ________________

Now simulate a mistake and a repair:

reg add "HKCU\Software\LearningLab" /v Volume /t REG_DWORD /d 99 /f
reg import "%TEMP%\LearningLab.reg"
reg query "HKCU\Software\LearningLab" /v Volume

21. What is Volume after the import? ________________ (This is why you export first.)

Part 8: Clean Up (Important)

Delete only the test key, using either method:

reg delete "HKCU\Software\LearningLab" /f

or

Remove-Item HKCU:\Software\LearningLab -Recurse

Then confirm it is gone, and remove the temporary files:

reg query "HKCU\Software\LearningLab"
del "%TEMP%\LearningLab.reg"
del "%TEMP%\HKCU-Software-backup.reg"

22. What does the final reg query say? ________________ (Expected: the system cannot find the key.)

What Should Happen

• Part 1 and 2 show the same Windows facts through regedit, reg, and PowerShell.
• Part 3 shows what starts at sign-in.
• Part 4 shows that hive files exist but are protected.
• Part 6 and 7 show create, read, change, export, mistake, and repair on a safe key.
• Part 8 leaves your registry as you found it.

Interpretation Guide

Follow-Up Questions

1. Why did this lab write only to HKCU and never to HKLM?
2. In Part 6E, which steps of the Section 11 chain happened when reg add ran?
3. After the lazy flush (Section 11.2), where is Volume stored on disk? Which file?
4. If you had changed a value that a running program reads only at startup, what would you do to see the change?
5. Name two things that could go wrong if you edited an unfamiliar key in HKLM\SYSTEM.