HKEY_LOCAL_MACHINE\SYSTEM

\CurrentControlSet\Control

[]

"CurrentUser"="USERNAME"
"SystemStartOptions""
 

WaitToKillServiceTimeout	Milliseconds after the logoff/shutdown before displaying the Wait, End Task and Close dialog box.Default: 20000
HangAppTimeout	Milliseconds to wait before displaying the Wait, End Task and Close dialog box after trying to close an application.

[BootVerificationProgram]
    The BootVerificationProgram subkey is used to update the last known good configuration during system startup. This entry describes a program that will be called by the service controller to establish the last known good configuration. Such a program can be written by the system administrator. When the boot is complete, the system executes this boot verification program. You must also specify a value of 1 for the ReportBootOK

[Class]
    Una rama por cada tipo de dispositivo registrado. El nombre de cada rama es el CLSID del dispositivo y puede contener las siguientes claves:
 

@	Cadena asociada al tipo de dispositivo, será la presentada al usuario, p.e.: "Adaptadores de vídeo" "Teclado" ...
Class	Nombre interno del tipo de dispositivo, p.e.: "Display" "Keyboard" ...
Icon	Nº del icono asociado
Installer32	Programa instalador del dispositivo. Tiene dos partes separadas por una coma: la primera es el programa llamado y la segunda la clase dispositivo que se va a instalar. P.e.: Display.Cpl,DisplayClassInstaller SysSetup.Dll,KeyboardClassInstaller...
NoDisplayClass	"1"
LegacyInfOption	"SCSI"

Cada dispositivo registrado puede tener tantas ramas como dispositivos instalados. El nombre de estas ramas sera CLSID\000x, donde x representa el orden de instalación ¿?¿?. En estas ramas habrá claves comunes y otra específicas del tipo de dispositivo.

• InfPath                    Fichero de configuración, p.e. "mga64.inf"
• InfSection                Sección dentro del fichero que se aplica a este dispositivo, p.e.: "mga64"
• ProviderName         Fabricante del dispositivo, p.e.: "Matrox Graphics"
• DriverDesc              Descripción del controlador, p.e.: "Matrox Graphics Millennium"

[Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000]
"AttachedTo"="COM3"
"FriendlyName"="SupraExpress 336i PnP"
"Manufacturer"="Diamond Multimedia"
"Model"="SupraExpress 336i PnP"
"ID"=f2,d7,03,00
"PortSubClass"=02
"ConfigDialog"="modemui.dll"
"InactivityScale"=0a,00,00,00
"Reset"="ATZ<cr>"
"Properties"=c0,01,00...
"DeviceType"=02
"InfPath"="mdmsupr5.inf"
"InfSection"="Modem28"
"ProviderName"="Diamond Multimedia"
"DriverDesc"="SupraExpress 336i PnP"
"ResponsesKeyName"="SupraExpress 336i PnP::Diamond Multimedia::Diamond Multimedia"
"Default"=3c,00...
"DCB"=1c,00,00...
"VoiceSwitchFeatures"=58,00...

[Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\Answer]
"1"="ATA<cr>"

[Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\Hangup]
"1"="ATH<cr>"

[Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\Init]
"1"="AT<cr>"
"2"="AT &F2 E0 V1 Q0 W1 S95=47 S0=0<cr>"

[Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\Monitor]
"1"="ATS0=0<cr>"
"2"="None"

[Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\Settings]
"Prefix"="AT"
"Terminator"="<cr>"
"DialPrefix"="D"
"DialSuffix"=";"
"SpeakerVolume_Low"="L"
"SpeakerVolume_Med"="L2"
"SpeakerVolume_High"="L3"
"SpeakerMode_Off"="M"
"SpeakerMode_Dial"="M1"
"SpeakerMode_On"="M2"
"SpeakerMode_Setup"="M3"
"FlowControl_Off"="&K"
"FlowControl_Hard"="&K3"
"FlowControl_Soft"="&K4"
"ErrorControl_Off"="&Q6\\N"
"ErrorControl_On"="&Q5\\N3"
"ErrorControl_Forced"="&Q5\\N2"
"ErrorControl_Cellular"="\\N3 &Q5 -K1 *H1 )M1 -C1 -Q0"
"ErrorControl_Cellular_Forced"="\\N4 &Q5 -K1 *H1 )M1 -C1 -Q0"
"Compression_Off"="%C"
"Compression_On"="%C3"
"Modulation_CCITT"="B"
"Modulation_Bell"="B1"
"SpeedNegotiation_Off"="N"
"SpeedNegotiation_On"="N1"
"Pulse"="P"
"Tone"="T"
"Blind_Off"="X4"
"Blind_On"="X3"
"CallSetupFailTimer"="S7=<#>"
"InactivityTimeout"="S30=<#>"

[Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\Settings\Init]
"1"="ATS7=60S30=0LM1&Q5\\N3%C3&K3BN1X4"

[ComputerName]

[ComputerName\ComputerName]
"ComputerName"="CABO SANDOVAL"

[ComputerName\ActiveComputerName]
"ComputerName"="CABO SANDOVAL"

[CrashControl]
It is a handy subkey for device driver developers and systems administrators. It contains values that give NT directions for what to do when the machine goes down, including whether to produce a crash dump and whether to immediately reboot. Accesible trough Panel Control /System at Start-Shutdown tab.

• "LogEvent"        =1 Graba un evento en el registro del sistema
• "SendAlert"        =1 Envía una alerta administrativa
• "CrashDumpEnabled"    =1 Hace un volcado de memoria al fichero indicado en DumpFile
• "AutoReboot"    =1 Tras una BSOD el ordenador se inicializa automáticamente
• "DumpFile"                Fichero de volvado de memoria tras BDSO
• "Overwrite"        =1    Tras BDSO sobreescribe el fichero DumpFile

[FileSystem]
"Win95TruncatedExtensions"=01
 

Win31FileSystem	=0, the FAT will allow creation, enumeration, opening, or querying of long file names, and whether extended time stamp information (CreationTime and LastAccessTime) is stored and reported. Set this value to 1 (true) to revert to basic Win3x (and Windows NT 3.5) semantics. Note changing this value does not change any disk structures. It simply changes how the system behaves from now on.
NtfsDisable8dot3NameCreation	=0, NTFS will create a short name for a filename that is not in the format xxxxxxxx.yyy, contains extended characters, or both. Creating short names impacts performance, so some sites may want to set this value to 1 (true) if they do not intend to either use DOS applications on long names, or share disks with different code page machines (i.e., machines in the U.S.). For example, in the Far East, where all native file names generate short names, set this value to 1.
MaximumTunnelEntries	see Tunneling
MaximumTunnelEntryAgeInSeconds

[GraphicsDrivers]

[GraphicsDrivers\DCI]
"Timeout"=07
 

[GroupOrderList]

    The order in which services within a Service Group are loaded. Services in a Service Group are assigned a tag, a unique numeric value within a Service Group which determines the service load order. Each value entry in GroupOrderList represents a Service Group. The value of the entry is a series of tags in a specified order. The first entry in this REG_BINARY value is the number of services in the group, followed by the tags in load sequence. If you look at PointerPort example you can see that there are 3 services in the group and that the service with tag 02 is loaded first, followed by the service with tag 01 and then tag 03.
 

• "Pointer Port"=03,00,00,00,02,00,00,00,01,00,00,00,03,00,00,00

[hivelist]
    The location of the files that contain Registry information is reported under this Registry entry:
"\\REGISTRY\\MACHINE\\HARDWARE"=""
"\\REGISTRY\\MACHINE\\SECURITY"="\\Device\\Harddisk1\\Partition1\\WINNT\\system32\\config\\SECURITY"
"\\REGISTRY\\MACHINE\\SOFTWARE"="\\Device\\Harddisk1\\Partition1\\WINNT\\system32\\config\\software"
"\\REGISTRY\\MACHINE\\SYSTEM"="\\Device\\Harddisk1\\Partition1\\WINNT\\system32\\config\\system"
"\\REGISTRY\\USER\\.DEFAULT"="\\Device\\Harddisk1\\Partition1\\WINNT\\system32\\config\\default"
"\\REGISTRY\\MACHINE\\SAM"="\\Device\\Harddisk1\\Partition1\\WINNT\\system32\\config\\SAM"
"\\REGISTRY\\USER\\S-1-5-21-35803418-38883482-943750798-1002"="\\Device\\Harddisk1\\Partition1\\WINNT\\Profiles\\jose.000\\NTUSER.DAT"

[IDConfigDB]
"CurrentConfig"=01
"PropertyProviders"=(7):70,72,6f...
"UserWaitInterval"=05
"IsPortable"=0

[IDConfigDB\Hardware Profiles]

[IDConfigDB\Hardware Profiles\0001]
"=friendlyName"="Configuración original"
"PreferenceOrder"=0
"DockState"=07
"DockID"=""
"SerialNumber"=""
 

[Keyboard Layout]

[Keyboard Layout\DosKeybCodes]

    Relaciona cada posible código de teclado con la abreviatura de un país. Dos ejemplos:

"=0000040A"="sp"

"=00010426"="us"

[Keyboard Layouts]

[Keyboard Layouts\00000402]
"Layout Text"="Búlgaro"
"Layout File"="KBDBU.DLL"

    ( more keyboard layouts ...)

[Lsa]
"Authentication Packages"=(7):6d,73,76,31,5f,30,00,00"Bounds"=0,30,00,00,00,20,00,00

[Lsa\MSV1_0]

[MediaProperties]

[MediaProperties\PrivateProperties]

[MediaProperties\PrivateProperties\MIDI]

[MediaProperties\PrivateProperties\MIDI\Schemes]

[MediaProperties\PrivateProperties\MIDI\Schemes\Predeterminado]

[MediaProperties\PrivateProperties\MIDI\Schemes\Predeterminado\00]
@="""Channels"=00ffff

[MediaResources]

[MediaResources\mci]

[MediaResources\mci\cdaudio]
"Default Drive"=0,00,00,00

[MediaResources\mci\cdaudio\unit 0]
"Volume Settings"=0,00,00,00,ff,00,00,00

[MediaResources\MIDI]

[MediaResources\MIDI\CS32BA11.DLL<0000>]
"Active"="=0"
"Description"="Salida MIDI de Crystal Audio Sy"
"DeviceID"=""
"DevNode"=
"Driver"="CS32BA11.DLL"
"=friendlyName"="Salida MIDI de Crystal Audio Sy"
"External"="=0"
"PhysDevID"=01
"Port"=0
"MapperConfig"=01
"SOFTWAREKEY"="
"
"Migrated"="1"

[MediaResources\MIDI\CS32BA11.DLL<0000>\Instruments]

[MediaResources\MIDI\CS32BA11.DLL<0001>]
"Active"="1"
"Description"="Salida MIDI de Crystal Audio Sy"
"DeviceID"=""
"DevNode"=
"Driver"="CS32BA11.DLL"
"=friendlyName"="Salida MIDI de Crystal Audio Sy"
"External"="=0"
"PhysDevID"=0
"Port"=0
"MapperConfig"=01
"SOFTWAREKEY"="
"
"Migrated"="1"

[MediaResources\MIDI\CS32BA11.DLL<0001>\Instruments]

[MediaResources\MIDI\mmdrv.dll<0000>]
"Active"="=0"
"Description"="Generic MPU-401"
"DeviceID"=""
"DevNode"=
"Driver"="mmdrv.dll"
"=friendlyName"="Generic MPU-401"
"External"="1"
"PhysDevID"=0
"Port"=0
"MapperConfig"=01
"SOFTWAREKEY"="
"
"Migrated"="1"

[MediaResources\MIDI\mmdrv.dll<0000>\Instruments]

[MediaResources\NonGeneralMIDIDriverList]

[NetworkProvider]
    This subkey provides a list of the available network providers that use the Microsoft network-independent APIs.

[NetworkProvider\Order]
"ProviderOrder"="LanmanWorkstation"
    Specifies the order for accessing available network providers, as defined by choosing the Networks button in the Network dialog box in Control Panel
 

[Nls]
    This subkey contains other subkeys that define information for languages and code pages.
In the Code Page and Language subkeys, all code pages and languages supported under Windows NT are listed, so applications can check these keys to find all "supported" languages. However, only the entries with filenames in the data fields are actually installed in the system. So applications must check the data fields to find out if a specific code page is actually installed in the system.

[Nls\CodePage]
"437"="c_437.nls"
"860"=""
"ACP"="1252"
"OEMCP"="850"
"MACCP"="10000"
"OEMHAL"="vga850.fon"
....
    As shown in the list, 437=C_437.NLS indicates the file for code page 437 and so on. ACP is the default ANSI code page; OEMCP is the default OEM code page; and MACCP is the default Macintosh code page.

[Nls\Language]
"=0409"="l_intl.nls"
"=0411"="l_intl.nls"
....
    These entries identify the files for available languages.

[Nls\OEMLocale]
    This section of the Registry is only checked if a specific locale ID is not found in the default locale file (LOCALE.NLS). If this subkey is present, each entry specifies the locale ID and a filename for the OEM locale.

[Print]
"MajorVersion"=02
"MinorVersion"=0
"PriorityClass"=0
"PortThreadPriority"=0
"SchedulerThreadPriority"=0
"BeepEnabled"=0
"NoRemotePrinterDrivers"="Windows NT Fax Driver"
 

[Print\Environments]

[Print\Environments\Windows 4.0]
"Directory"="WIN40"
 

[Print\Environments\Windows 4.0\Drivers]

[Print\Environments\Windows 4.0\Print Processors]

[Print\Environments\Windows NT Alpha_AXP]
"Directory"="W32ALPHA"

[Print\Environments\Windows NT Alpha_AXP\Drivers]

[Print\Environments\Windows NT Alpha_AXP\Print Processors]

[Print\Environments\Windows NT PowerPC]
"Directory"="W32PPC"
 

[Print\Environments\Windows NT PowerPC\Drivers]

[Print\Environments\Windows NT PowerPC\Print Processors]

[Print\Environments\Windows NT R4000]
"Directory"="W32MIPS"

[Print\Environments\Windows NT R4000\Drivers]

[Print\Environments\Windows NT R4000\Print Processors]

[Print\Environments\Windows NT x86]
"Directory"="W32X86"

[Print\Environments\Windows NT x86\Drivers]

[Print\Environments\Windows NT x86\Drivers\Version-2]
"Directory"="2""MajorVersion"=02"MinorVersion"=0

[Print\Environments\Windows NT x86\Drivers\Version-2\Epson FX-80]
"Configuration File"="RASDDUI.DLL"
"Data File"="EPSON9.DLL"
"Driver"="RASDD.DLL"
"Help File"="RASDDUI.HLP"
"Monitor"=""
"Datatype"=""
"Dependent Files"=(7):45,50,53..
"Version"=02

[Print\Environments\Windows NT x86\Print Processors]

[Print\Environments\Windows NT x86\Print Processors\winprint]
"Driver"="winprint.dll"
 

[Print\Forms]
"Continuo (21,6 x 30,5 cm.)"=5c,4b,03...

[Print\Monitors]

[Print\Monitors\Local Port]
"Driver"="localmon.dll"

[Print\Monitors\PJL Language Monitor]
"Driver"="pjlmon.dll""EOJTimeout"=0

[Print\Printers]
"DefaultSpoolDirectory"="D:\\WINNT\\System32\\spool\\PRINTERS"
    Accesible through open the Printers window in My Computer, select the printer, and
from the File menu, choose Server Properties and click the Advanced tab.

[Print\Printers\Epson FX-80]
"ChangeID"=082e0f
"Status"=080
"Name"="Epson FX-80"
"Share Name"=""
"Print Processor"="winprint"
"Datatype"="RAW"
"Parameters"=""
"Description"=""
"Printer Driver"="Epson FX-80"
"Default DevMode"=45,00,70...
"Priority"=01
"Default Priority"=0
"StartTime"=0
"UntilTime"=0
"Separator File"=""
"Location"=""
"Attributes"=0
"txTimeout"=00afc8
"dnsTimeout"=003a98
"Security"=01,00,04...

• SpoolDirectory                Directorio particular de esta impresora

[Print\Printers\Epson FX-80\PrinterDriverData]
"Country"=022
"Model"="Epson FX-80"
"TrayFormTable"=(7):41,6c,69,6d...
"=freeMem"=ff,ff,ff,ff
"RasddFlags"=0,00
"=fontCart"=(7):30,00,00

[Print\Providers]
"Order"=(7):4c,61,6e,4...
"EventLog"=01b
"NetPopup"=01

[Print\Providers\LanMan Print Services]
"Name"="win32spl.dll"
"DisplayName"="Servicios de impresión LanMan"

[Print\Providers\LanMan Print Services\Servers]
 

• AddPrintDrivers        To limit who can install printer drivers, set the value to 1, which causes the NT Spooler service to restrict this operation to Administrators and Print Operators (NT Server) or Administrators and Power Users (NT Workstation).

[ProductOptions]        Especifica el tipo de software instalado en el ordenador.

• ProductType
• Winnt            Workstation
• Servernt        Server
• Lanmannt      Server Domain Controller
• ProductSuite
• Terminal Server    Windows NT Terminal Server Edition
• Enterprise             Windows NT Enterprise Edition

[SecurePipeServers\winreg]
    Esta rama controla el acceso remoto al registro. Desde regedt32 se pueden dar permisos en esta clave para controlar el acceso remoto de determinados usuarios o grupos al registro.

[SecurePipeServers\winreg\AllowedPaths]
    Aquí figuran las ramas de este registro accesibles desde el exterior.

[SecurityProviders]
"SecurityProviders"="schannel.dll, msnsspc.dll"

[SecurityProviders\SCHANNEL]
"RNGSeed"=1e,60,6e,3d,20...

[SecurityProviders\SCHANNEL\CertificationAuthorities]

•   Una rama por cada autoridad de emsión de certificados

• AT&T Prototype Research CA
• Galería internetMCI
• GTE Cybertrust ROOT
• Keywitness Canada Inc.
• Servicios de certificación de AT&T
• Servicios de directorio de AT&T
• Servidor de seguridad Verisign/RSA
• Thawte Premium Server CA
• Thawte Server CA
• Verisign Class 1 Public Primary CA
• Verisign Class 2 Public Primary CA
• Verisign Class 3 Public Primary CA
• Verisign Class 4 Public Primary CA
• Verisign/RSA Commercial

Cada una contiene estas claves
• CACert         ¿?¿?
• Enabled         ¿?¿?
• Type           ¿?¿?

•   Una rama por cada tipo de cifrado

• NULL 0/128
• RC4 128/128
• RC4 40/128
• RC4 64/128

Cada una contienen una clave que define su estado
• Enabled        0 y fffffffff  son los valores encontrados ¿?¿?

•  Una rama por cada tipo de direccionamiento hash

• MD5
• SHA

Cada una contienen una clave que define su estado
• Enabled        fffffffff  es el valor encontrado ¿?¿?

•   Una rama por cada algoritmo de intercambio de claves

• Diffie-Hellman
• Fortezza
• PKCS

Cada una contienen una clave que define su estado
• Enabled        fffffffff y 030 son valores encontrados ¿?¿?

•   A branch for every protocol

• Multi-Protocol Unified Hello
• PCT 1.0
• SSL 2.0
• SSL 2.0
• SSL 3.0

Each one have two branches:
• Client
• Server

•     List            Los nombres de los grupos de servicios en el orden en el que serán cargados

[ServiceProvider\Order]
"ExcludedProviders"=(7):0"ProviderOrder"=(7):54,63,70,69,70,00,00

[Session Manager]
"ObjectDirectories"=(7):5c,57,69...
""=0
"EnableMCE"=0
"EnableMCA"=01
"HeapSegmentReserve"=0
"HeapSegmentCommit"=0
"HeapDeCommitTotalFreeThreshold"=0
"HeapDeCommitFreeBlockThreshold"=0
"CriticalSectionTimeout"=0278d00
"ResourceTimeoutCount"=09e340
"ExcludeFromKnownDlls"=(7):0,00
"ProcessorControl"=02
"RegisteredProcessors"=02
 

BootExecute	This points at a program that will automatically execute early in the system boot, normally autochk
GlobalFlag	Default = 0 23000 = This value sets the following bits in the global flag: Create user mode stack trace DB Create kernel mode stack trace DB Enable Debugging of Win32 Subsystem
LicensedProcessors	The number of processors that the system's license supports (two for NT Workstation and four for NT Server)
ProtectionMode	If this key has a value of 0, base system object protection isn't enabled and a user can potentially access system files that run in an elevated privilege mode not subject to typical security controls. To enable base system object protection, you must set ProtectionMode to a value of 1.

.

[Session Manager\AppPatches]

[Session Manager\AppPatches\CWD]

[Session Manager\AppPatches\CWD

[Session Manager\AppPatches\CWD\ff060102423da0000407108e0500\1]
"Add1"=02,15,40...
"Change1"=01,1d,50...

[Session Manager\AppPatches\MYST]

[Session Manager\AppPatches\MYST\ff060102423bab000407102e0600]

[Session Manager\AppPatches\MYST\ff060102423bab000407102e0600\1]
"Add1"=02,15,40...
"Change1"=01,1d,50...

[Session Manager\AppPatches\PALED40]

[Session Manager\AppPatches\PALED40\ff060102420032000407401b0100]

[Session Manager\AppPatches\PALED40\ff060102420032000407401b0100\1]
"Change1"=01,07,b7,21,01,d8,0c

[Session Manager\AppPatches\USA]

[Session Manager\AppPatches\USA\ff06010242059b00040710780600]

[Session Manager\AppPatches\USA\ff06010242059b00040710780600\1]
"Change1"=01,1d,95...
"Change2"=01,25,05...

[Session Manager\AppPatches\VB]

[Session Manager\AppPatches\VB\ff060102ec353f00040780c81300]

[Session Manager\AppPatches\VB\ff060102ec353f00040780c81300\12]
"Change1"=01,11,1b,03,06,81,3e,ba,31,34,03,81,3e,ba,31,09,03
 

[Session Manager\AppPatches\VB40016]

[Session Manager\AppPatches\VB40016\ff0702021401ee3e000407d0460e00]

[Session Manager\AppPatches\VB40016\ff0702021401ee3e000407d0460e00\16]
"Change1"=01,11,6d...

[Session Manager\DOS Devices]
"PRN"="\\DosDevices\\LPT1"
"AUX"="\\DosDevices\\COM1"
"NUL"="\\Device\\Null"
"PIPE"="\\Device\\NamedPipe"
"MAILSLOT"="\\Device\\MailSlot"
"UNC"="\\Device\\Mup"

[Session Manager\Environment]
    This contains system-level environment variables
"ComSpec"=(2):25,53,79...
"NUMBER_OF_PROCESSORS"="2"
"OS"="Windows_NT"
"Os2LibPath"=(2):25,53,79...
"Path"=(2):25,53,59...
"PROCESSOR_ARCHITECTURE"="x86"
"PROCESSOR_IDENTIFIER"="x86 Family 5 Model 2 Stepping 12, GenuineIntel"
"PROCESSOR_LEVEL"="5"
"PROCESSOR_REVISION"="=020c"
"windir"=(2):25,53,79...

[Session Manager\Executive]    This holds values that can direct NT to create additional operating system worker threads
"AdditionalCriticalWorkerThreads"=0
"AdditionalDelayedWorkerThreads"=0

• "PriorityQuantumMatrix"=8a,55...         This has an enticing name that implies the ability to fine-tune NT's scheduling algorithm, but the value actually stores encrypted NT beta and release candidate expiration dates.

[Session Manager\FileRenameOperations]

[Session Manager\KnownDLLs]
"DllDirectory"=(2):25,53,79...
"kernel32"="kernel32.dll"
"gdi32"="gdi32.dll"
"user32"="user32.dll"
"rpcrt4"="rpcrt4.dll"
"advapi32"="advapi32.dll"
"comdlg32"="comdlg32.dll"
"crtdll"="crtdll.dll"
"shell32"="shell32.dll"
"lz32"="lz32.dll"
"olecli32"="olecli32.dll"
"olesvr32"="olesvr32.dll"
"version"="version.dll"
"ole32"="ole32.dll"
"oleaut32"="oleaut32.dll"
"olecnv32"="olecnv32.dll"
"olethk32"="olethk32.dll"
"SHDOCVW"="SHDOCVW.Dll"
"SHLWAPI"="SHLWAPI.Dll"

[Session Manager\Memory Management]
"PagedPoolSize"=0
"NonPagedPoolSize"=0
"PagedPoolQuota"=0
"NonPagedPoolQuota"=0
"LargeSystemCache"=0
"SystemPages"=0
 

IoPageLockLimit	Increase the number of pages the system will read or write to the hard disk at one time. 0=512 bytes. Recomendado segun memoria física disponible:   1024-2048(16MB)   2048-4096(32MB)   4096-8192(64MB)   8192-16384(128MB) ... Minimum/Maximum recommended value is MB of RAM x 64  /  MB of RAM x 128
PagingFiles	This directs the system to the location of the paging files and its sizes. The format is driveletter:\pagefile.sys minsize maxsize.
SecondLevelDataCache	Ajusta el rendimiento según la cache de segundo nivel (0=256, poner el tamaño en otro caso)
DisablePagingExecutive	0, permite a los componentes del OS hacer paginación a disco. 1, los componentes del OS siempre trabajan en memoria (esta opción es peligrosa si no hay suficiente memoria para todos los programas cargados.
ClearPageFileAtShutdown	=1, the pagefile cleared when the machine is shutdown

[Session Manager\SubSystems]
   It keeps pointers to the files that the NT environment subsystems (Win32, WOW, OS/2, and Posix) use.
"Required"=(7):44,65,62...
"Optional"=(7):4f,73,32...
"Debug"=(2):0
"Windows"=(2):25,53,79...
"Kmode"=(2):25,53,79...
"Os2"=(2):25,53,79...
"Posix"=(2):25,53,79...

[Setup]
"pointer"="msps2"
"video"="VGA"
"keyboard"="STANDARD"
 

[SystemResources]

[SystemResources\AssignmentOrdering]
"Isa"="PCFlat"
"Eisa"="PCFlat"
"MCA"="PCFlat"
"PCMCIA"="PCFlat"
"PCFlat"=(a):a8,04,00...
"PCI"=(a):e8,08,00,00...
 

[SystemResources\BusValues]
"Internal"=0,00...
"Isa"=01,00...
"Eisa"=02,00...
"MCA"=03,00...
"TurboChannel"=04,00...
"PCI"=05,00...
"VME"=06,00...
"NuBus"=07,00...
"PCMCIA"=08,00...
"CBus"=09,00...
"MPI"=0a,00...
"MPSA"=0b,00...

[SystemResources\ReservedResources]
"Isa"=(8):01,00,00...

[TimeZoneInformation]
"Bias"=ffffffc4
"StandardName"="Románico Hora estándar"
"StandardBias"=0
"StandardStart"=0,00,0a...
"DaylightName"="Románico Horario de verano"
"DaylightBias"=ffffffc4
"DaylightStart"=0,00,03...
"ActiveTimeBias"=ffffff88

[Update]
"UpdateMode"=01

[VirtualDeviceDrivers]
    The VirtualDeviceDriver subkey contains a list of Win32 DLLs that serve as virtual device drivers (VDD). Each VDD entry results in loading that VDD when a virtual MS-DOS machine (VDM) is being created for running an application created for MS-DOS or 16-bit versions of Microsoft Windows. Default: None—the Windows NT VDDs are built into the system.
"VDD"=(7):0,00

[Windows]
"Directory"=(2):25,53,79...
"SystemDirectory"=(2):25,53,79...
"ErrorMode"=0
"NoInteractiveServices"=0
"CSDVersion"=000300
"ShutdownTime"=04,b8,3c,a0,6d,cf,bc,01

[WOW]
    It contains entries related to the execution of command windows, including the path to the command window executable, ntvdm.exe, in the cmdline value.
"cmdline"=(2):25,53,79...
"size"="=0"
"wowcmdline"=(2):25,53,79...
"wowsize"="16"
"DefaultSeparateVDM"="no"
"LPT_timeout"="15"

• KnownDLLs        A list of DLLs separated by spaces