So what is the registry? In a nutshell, the Windows Registry is the “engine” that holds all the settings Windows needs to function. Normally, you don't interact directly with the registry; instead, you use Windows utilities (such as those found in the Control Panel) or INI, SYS, BAT files, and so forth. These tools allow you to customize the registry without actually working directly with it. There are, however, features that can only be set by editing the registry directly.

Registry structure The registry is a hierarchical database, like Windows Explorer, where folders are nested within folders. Depending on your Windows version, the Registry comprises four to six subtrees of keys called hives.

Accessing the registry Currently, there are two registry-editing programs, Regedit (16-bit) and Regedt32 (32-bit). Windows 95/98/Me use the 16-bit version, while Windows NT and 2000 use both versions. The 16-bit version offers faster searches, while the 32-bit version allows you to prevent automatic saving. To start either program, click Start | Run and enter the command regedit or regedt32, depending on which one you want to use.

Backing up the registry Backing up the registry is tricky since many of its parts are constantly in use by Windows. Trying to back up the registry while Windows is accessing the registry can cause a sharing violation. To solve this issue, Windows NT and Windows 2000 Resource Kits offer two programs: RegBack.exe to back up the registry and RegRest.exe to restore the registry. A Windows Emergency Repair Disk can also be used as a registry backup, if it was updated recently using the RDISK utility.

The hives To get a better understanding of the inner workings of the registry, let’s take a stroll through the hives (or keys). Figure A shows the various registry hives in Regedit.

HKEY_CLASSES_ROOT This key contains file extension associations. For instance, Windows can recognize a .doc file as a Microsoft Word document because of the settings in this key. Use the Folder Options command from the Tools menu in Windows Explorer instead of adding new extensions to this key.

HKEY_CURRENT_USER This key holds profile information for the user that is currently logged on. Each time a user logs on, the user’s profile is copied from the HKEY_USERS key to the HKEY_CURRENT_USER key. This key cannot be edited.

HKEY_LOCAL_MACHINE This key holds hardware and software information within its five subkeys, which are the following:

    * Hardware
    * Security accounts manager (SAM)
    * Security
    * Software
    * System

The first three (Hardware, SAM, and Security) cannot be modified.

The Hardware subkey stores settings for device drivers, IRQ hooks, and so forth. It is re-created each time your computer boots. The SAM subkey stores information on security settings, user accounts, and group memberships. The Security subkey holds information on local security policies such as password policy, user rights, account lockout, and so forth. The Software subkey, which applies to all local users, stores data about installed software. The System subkey stores information needed to boot Windows.

HKEY_USERS This key contains the default profile as well as profiles for all users who have logged on to the computer. This key can be edited, but exercise care when doing so.

HKEY_CURRENT_CONFIG This key holds hardware information that is currently in use and allows for backwards compatibility with older applications and device drivers. The information stored here cannot be edited.