• The registry
• HKEY_LOCAL MACHINE
• HARDWARE
• SAM
• SOFTWARE
• CLASSES
• CLSID
• SOFTWARE
• CLIENTS
• MICROSOFT
• NCPA
• WINDOWS CURRENT
• SYSTEM
• CURRENTCONTROLSET
• CONTROL
• ENUM
• SERVICES
• SELECT & SETUP
• HKEY_USERS
• Sxxx
• SOFTWARE
• HKEY_CURRENT_CONFIG
• HKEY_CLASSES_ROOT
• HKEY_CURRENT_USER
• HKEY_DYN_DATA

Under versions of Windows for MS-DOS, starting the system, connecting to the network, and running applications involves multiple configuration files with some form of synchronization between them. With Windows NT, the operating system stores and checks the configuration information at only one location: the Registry.
 

The following figure shows how various Windows NT components and applications use the Registry. The numbered explanations below this illustration provide details.
 

• Setup.

Whenever you run the Windows NT Setup program or other setup programs for applications or hardware, the Setup program adds new configuration data to the Registry. For example, new information is added when you install a new SCSI adapter or change the settings for your video display.
• Recognizer.

Each time you start a computer running Windows NT, the Hardware Recognizer places hardware configuration data in the Registry. This information includes a list of hardware detected in your system. On x86-based computers, this is done by a program called NTDETECT.COM and the Windows NT Kernel (NTOSKRNL.EXE). On RISC-based computers, this information is extracted from the ARC firmware.
• Windows NT kernel.

During system startup, the Windows NT Kernel extracts information from the Registry, such as the device drivers to load and their load order. The NTOSKRNL.EXE program also passes information about itself to the Registry, such as its version number.
• Device drivers.

Device drivers send and receive load parameters and configuration data from the Registry. This data is similar to what you might find on the DEVICE= lines in the CONFIG.SYS file under MS-DOS. A device driver must report system resources that it uses, such as hardware interrupts and DMA channels, so that the system can add this information to the Registry. Applications and device drivers can read this Registry information to provide users with smart installation and configuration programs.
• Administrative tools.

The administrative tools in Windows NT, such as those provided in Control Panel and in the Administrative Tools program group, can be used to modify configuration data. The Registry Editor is helpful for viewing and occasionally making detailed changes to the system configuration. You can also use the Windows NT Diagnostics program (WINMSD.EXE) to view configuration information stored in the Registry. For details, see Chapter 11, "Registry Editor and Registry Administration."

Although Microsoft discourages using .INI files in favor of using Registry entries, some applications (particularly 16-bit Windows-based applications) will continue using .INI files for the time being. Windows NT supports .INI files solely for compatibility with those applications and related tools (such as setup programs). Some form of the files AUTOEXEC.BAT and CONFIG.SYS also still exist to provide compatibility with applications created for MS-DOS and Windows 3.1. For details about how Windows NT uses such files in conjunction with the Registry, see Chapter 14, "Initialization Files and the Registry."
 

First, a discussion of basic terminology and structure of the Windows NT Registry is in order.  As viewed with REGEDT32.EXE , the diagram above illustrates a simplified outline of the NT Registry as it would be presented to the user.  Displayed in the left pane is the subtree (tree) and associated keys / subkeys.

The Registry Editor uses a display function similar to NT Explorer or File Manager, where a double-click of the mouse will either expand the selected key to display its subkeys or collapse the display to hide them.  Displayed in the right pane is the value entry, or entries, associated with the selected key in the left pane.

Possible Data Types are:
 
 

REG_NONE	No value type
REG_SZ	Unicode NULL terminated string
REG_EXPAND_SZ	Unicode NULL terminated string that can have embedded environment variables
REG_BINARY	Arbitrary length binary data
REG_DWORD	32-bit number
REG_DWORD_BIG_ENDIAN	32-bit number, high byte first
REG_LINK	Unicode symbolic link
REG_MULTI_SZ	Array of Unicode strings
REG_RESOURCE_LIST	Hardware resource description
REG_FULL_RESOURCE_DESCRIPTOR	Hardware resource description
REG_RESOURCE_REQUIREMENTS_LIST	Resource requirements

The NT Registry is composed of up to six subtrees of keys.  Where appropriate, two of these are mapped to other subtrees contained in the other four.
 

Note that the number of subtrees may vary, depending on the version of NT.  The six subtrees are as follows:
 
 
 

HKEY_LOCAL_MACHINE Information about hard and soft of this machine HKEY_USERS Information about all the accounts on the machine  KEY_CURRENT_CONFIG Some information about the current hardware profile. Points to the current hardware configuration at HKEY_LOCAL_MACHINE  HKEY_CLASSES_ROOT File association and Object Linking and Embedding (OLE) registration information. Points to HKEY_LOCAL_MACHINE\SOFTWARE\Classes HKEY_CURRENT_USER Data associated with the currently logged-on user. Points to the HKEY_USERS appropiate for the current user  HKEY_DYN_DATA Performance data. Points to a branch of HKEY_LOCAL_MACHINE that contains the dynamic status information for use with the P&P feature

Each value entry in the right pane is generally made up of three parts:  the Value Name, the Data Type, and the Data.  The Value Name is a variable, of sorts, associated with the selected key.  The Data Type specifies the nature of data associated with the Value Name.  The Data is the value assigned to the Value Name and will take the form of the Data Type.
 
 

Referencias