Chapter 17 · Windows Registry

Knowledge Check

9 min read

Try to answer before you open the answers. Guessing is fine; checking your guess is how you learn.

QUICK REVIEW (5 minutes)

  1. What is the registry, in one sentence?
  2. Name the five root keys that regedit shows. Which two are the real roots?
  3. What is a hive?
  4. In the registry, what do keys and values correspond to in a file system?
  5. Which registry type holds a list of text items, and which holds a path with %SystemRoot% in it?
  6. Where are the main machine hive files stored, and which file holds one user's HKCU?
  7. What are the .LOG1 and .LOG2 files for?
  8. Why can a standard user not write to HKLM?
  9. Which key holds the programs that start for you when you sign in?
  10. Why should you export a key before changing it?

ANSWER KEY — DO NOT READ UNTIL YOU'VE ANSWERED

Click to reveal answers

1. The registry

A tree-shaped database of settings for Windows, its drivers, its services and most programs.

2. Root keys

HKEY_CLASSES_ROOT, HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE, HKEY_USERS, HKEY_CURRENT_CONFIG. The real roots are HKLM and HKU; the other three are links or merged views.

3. Hive

A large part of the registry tree that is stored together as one file (plus its log files), such as SYSTEM or NTUSER.DAT.

4. Keys and values

Keys are like folders (they hold keys and values). Values are like files: a name, a type and some data.

5. Types

REG_MULTI_SZ holds a list of strings. REG_EXPAND_SZ holds text with environment variables that get expanded.

6. Hive locations

Machine hives are in C:\Windows\System32\config. A user's HKCU comes from NTUSER.DAT in C:\Users\<name>.

7. Log files

They are transaction logs. They record changes so that Windows can recover the hive after a crash or power cut.

8. Standard user and HKLM

HKLM controls drivers, services, programs and security for everyone. Its ACLs allow only SYSTEM and Administrators to write, so one user (or one piece of malware running as that user) cannot damage the whole PC.

9. Startup key for you

HKCU\Software\Microsoft\Windows\CurrentVersion\Run.

10. Why export first

The registry has no undo. The exported .reg file lets you put the old values back (remember that import does not delete values added later).

UNDERSTANDING QUESTIONS

Q1. Why is HKEY_CURRENT_USER called a "link" and not a real root?

Answer It does not hold data of its own. At sign-in, Windows loads the user's `NTUSER.DAT` under `HKEY_USERS\` and makes `HKCU` point to that entry. Two users see different data under the same `HKCU` path.

Q2. Why does HKCR show a mix of two places, and which one wins?

Answer `HKCR` merges `HKLM\SOFTWARE\Classes` (defaults for all users) with `HKCU\Software\Classes` (the user's own). It gives programs one simple place to look. If a key exists in both, the user's version wins.

Q3. Explain the difference between WOW64 registry redirection and UAC registry virtualization.

Answer WOW64 redirection gives 32-bit programs on 64-bit Windows a separate view (`HKLM\SOFTWARE\WOW6432Node`) so 32-bit and 64-bit settings do not clash. UAC virtualization is for old programs that write to protected keys without admin rights; Windows redirects those writes to `HKCU\Software\Classes\VirtualStore` so the program does not fail. One is about bit-ness, the other about permissions.

Q4. Why do policy values beat the user's own settings?

Answer Policy values live under protected `Policies` keys that only the Group Policy client and administrators can write. Programs check them first, and the policy client re-applies them at boot, sign-in and about every 90 minutes, so a manual change is overwritten.

Q5. Why does the change you make in regedit take effect without a Save button, even though the hive file is written later?

Answer The Configuration Manager updates the hive in memory at once, and every program reads through that memory copy. The file is updated later by a lazy flush, with the log file as a safety net.

SCENARIO QUESTIONS (Troubleshooting)

S1. After a sudden power cut, Windows signs you in with a temporary profile and your settings are gone. What is the likely cause?

Answer Your `NTUSER.DAT` (the per-user hive) was damaged or could not be loaded. Options: restart and check again, restore from a backup or a restore point, copy a good `NTUSER.DAT` from another source (an expert task), or create a new account and copy your files.

S2. You changed a value in regedit, but the program did nothing different. List things to check.

Answer Right key (`HKCU` vs `HKLM`; 32-bit vs 64-bit view)? A policy overriding it? The program reads the value only at startup (restart it)? UAC virtualization sending it to a VirtualStore copy? Correct type? Does it need a sign-out or restart?

S3. A setting in the Settings app is greyed out with "Some settings are managed by your organization". It is your own PC. What might be happening?

Answer A policy value exists under a `...\Policies` key, possibly left by older software or by a tweak you applied earlier. Look under `HKLM\SOFTWARE\Policies` and `HKCU\SOFTWARE\Policies` (read first, export before changing), and use `gpresult /r` on editions that have Group Policy.

S4. Windows will not boot and reports a damaged SYSTEM file. What recovery options exist?

Answer From the Windows Recovery Environment: Startup Repair, System Restore (if a restore point exists), System Image Recovery (if you made one), or Reset this PC as a last resort. Do not count on `RegBack` being filled, because since Windows 10 version 1803 automatic hive backups are off by default.

S5. A .reg file from a website says it will "speed up Windows". What should you do?

Answer Do **not** double-click it. Open it in Notepad and read every line. If you cannot explain what each change does, do not run it. Double-clicking merges its values into your registry immediately. If you do try something, make a restore point and export the keys first.

INTERVIEW QUESTIONS

I1. Describe the structure of the registry and its root keys.

Answer A hierarchical database made of keys (containers) and values (name, type, data). Two real roots, HKLM and HKU; HKCU links to a subkey of HKU, HKCR merges `HKLM\SOFTWARE\Classes` with `HKCU\Software\Classes`, and HKCC links to the current hardware profile under `HKLM\SYSTEM`. It is stored as hive files loaded by the Configuration Manager.

I2. How are hives stored and loaded?

Answer Machine hives (`SYSTEM`, `SOFTWARE`, `SAM`, `SECURITY`, `DEFAULT`) are files in `C:\Windows\System32\config`; user hives are `NTUSER.DAT` and `UsrClass.dat` in the profile. The boot loader reads `SYSTEM` early; the kernel's Configuration Manager maps it and loads the rest; user hives load at sign-in. Each hive has `.LOG1`/`.LOG2` transaction logs, and `HKLM\HARDWARE` is built in memory every boot.

I3. What happens, from the API call down, when an application sets a registry value?

Answer `RegSetValueEx` (advapi32) leads to `NtSetValueKey` in ntdll, which makes a system call. The kernel's Configuration Manager checks access, changes the in-memory hive, marks it dirty and logs it. A lazy flush writes it to disk later. Watchers registered with `RegNotifyChangeKeyValue` are signalled, and programs re-read the value.

I4. How do you protect against a bad registry edit?

Answer Create a restore point, export the key with `regedit` or `reg export`, note the old value, change one thing at a time, test, and keep the backup. For deeper protection use `reg save` or a full system image. Practise on a test key, and avoid registry cleaners.

I5. Where would you look for software that starts at sign-in, and why is this an attack target?

Answer The `Run` and `RunOnce` keys under `HKCU` and `HKLM` (`...\Software\Microsoft\Windows\CurrentVersion`), plus other places such as services and scheduled tasks. Malware writes there to survive restarts, so security tools and administrators check them first.

PRACTICAL TASK

Build a one-page "map of my registry". Using your lab results, draw the five root keys. Mark which two are real, draw an arrow from each link or merged view to what it points at, and next to each real part write the hive file it comes from (for example HKLM\SYSTEM to C:\Windows\System32\config\SYSTEM, and your HKCU to C:\Users\<you>\NTUSER.DAT). Add the path of the Run key you inspected, and one sentence on how you would back it up.

Why This Matters

Many Windows problems end in the registry: a program that will not start, a setting that keeps resetting, a PC that will not boot. When you can picture the tree, the files behind it, and the safe way to back up, you can look with confidence and change things only when you must.

CHAPTER SUMMARY

  • The registry is a tree of keys (folders) and values (name, type, data) that replaced scattered INI files.
  • Five root keys: HKLM and HKU are real; HKCU, HKCR and HKCC are links or merged views.
  • Hives are stored as files: SYSTEM, SOFTWARE, SAM, SECURITY, DEFAULT, BCD and per-user NTUSER.DAT and UsrClass.dat, with .LOG1/.LOG2 logs, loaded by the kernel's Configuration Manager.
  • Types: REG_SZ, REG_EXPAND_SZ, REG_MULTI_SZ, REG_DWORD, REG_QWORD, REG_BINARY, REG_NONE.
  • ACLs protect keys: standard users write only HKCU; SAM and SECURITY are SYSTEM-only.
  • Virtualization: WOW64 gives 32-bit apps WOW6432Node; UAC virtualization sends legacy writes to the VirtualStore.
  • Policies live under Policies keys, are applied by the Group Policy client, and beat user settings.
  • Apps use the Reg... API (or .NET, PowerShell, reg); startup programs live in Run keys; file types are in HKCR.
  • Back up first: System Restore, .reg exports and reg save. RegBack is no longer filled by default.
  • A change goes regedit, RegSetValueEx, ntdll, system call, Configuration Manager, memory, lazy flush, notification, re-read.