Usually when you get a system crash when accessing the registry (i.e. user.dat or system.dat) it's because the registry has become corrupted somewhere. It's not always enough to trash Windows because doesn't necessarily read through all of the registry
when you boot it up.
Trying to backup user.dat, however, will force Windows to traverse down through the entire hierarchy of the registry data. If there is a bad node, you have big problems. The best course of action is to do the following:

1. Shut down Windows and then reboot to the MSDOS command line

2. Make the Registry Files to .txt:
regedit /l:c:\windows\System.dat /e c:\system.txt
regedit /l:c:\windows\User.dat /e c:\user.txt

3. Open the Registry File
attrib -s -r -h c:\windows\System.dat
attrib -s -r -h c:\windows\User.dat

4. Make backup copies:
mkdir c:\save
copy c:\system\system.dat c:\save\system.dat
copy c:\system\user.dat c:\save\user.dat

5. Delete the registry files:
del c:\system\system.dat
del c:\system\user.dat

6. Re-create the registry files:
regedit /l:c:\windows\System.dat c:\system.txt
regedit /l:c:\windows\User.dat c:\user.txt

7. Reboot

The icons that windows95 uses on the desktop and elsewhere are stored in a file named shelliconcache.  The default limit which MS uses is too low.  Hence, when you introduce a new icon to the system by opening a new folder, etc., the cache is dumped and rebuilt.  You can test this yourself by opening several instances of explorer at different folders.  The desktop will refresh when the limit is reached. To solve the problem, edit the registry to increase the default maximum number of icons stored in the cache.  Here is my Registry Export file to accomplish this.  It increases the default to 8000 icons. You can experiment with that "8000" value.
=========
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\explorer]
"Max Cached Icons"="8000"

=========

For Truncated File and Icon Names
[HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics]
"MinAnimate"="0"
"IconTitleWrap"="1"

Once you've installed Windows95, you can change the Registered Owner, Registered
Organization, or Product ID to anything you want. Here's how you do it:

Using the Registry Editor:
Run the Registry Editor (REGEDIT.EXE).
Open HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion.
To change the values of the RegisteredOrganization, RegisteredOwner, or ProductvId, simply double-click on them.
Note: This will only change the registered user information for Windows95, not for the applications on your system.

Removing Sound Events from Control Panel\Sounds When you view what events you can assign sounds to from Control Panel\Sounds, you cannot delete the events themselves. In order to do that:

Start Regedit Go to HKEY_CURRENT_USER\AppEvents\Schemes\Apps
From here you can delete any items you don't want to show or no longer need.

1.Start the REGEDIT program
2. Go to [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
And
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
3. Delete the programs or TSR's you don't want
4. Close and restart windows.

Add or Edit the following Registry Keys
[HKEY_CLASSES_ROOT\Directory\shell\opennew]
@="Dos Prompt in that Directory"

[HKEY_CLASSES_ROOT\Directory\shell\opennew\command]
@="command.com /k cd %1"

[HKEY_CLASSES_ROOT\Drive\shell\opennew]
@="Dos Prompt in that Drive"

[HKEY_CLASSES_ROOT\Drive\shell\opennew\command]
@="command.com /k cd %1"

These will allow you to right click on either the drive or the directory and the option of starting the dos prompt there will pop up.

Step1: Copy all Windows .dat files To a Temp directory.
System.dat and User.dat FOR SURE.
Step2: Be sure to have a reg backup already.
Step3: Open reg editor and export "all entries" to a reg file(MyReg.reg).
Step4: Power off for 10 seconds then Boot to REAL DOS MODE.
Go to Windows directory.
Step5: Type ATTRIB -H -S -R SYSTEM.DAT and
ATTRIB -H -S -R USER.DAT.
Step6: Delete .dat files, e.g. del *.dat /y
Step7: At C:\Windows>type "regedit /c MyReg.reg", No Quotes.
EXAMPLE: C:\Windows>REGEDIT /c MyReg.reg [enter]
NOTE. If your computer locks up before the import is 100% done,
Simply re-boot and Import from C:\Windows>Regedit Myreg.reg; OR
CD to WRP and type restore.
Everybodys 95 is different, that's why the warning. Works great for me, and many others. Still, check you system out, keyboard, applications, modem; everything! FELL SAFE! You have three backups:
1. MrReg.reg
2. WRP Backup
3. You System.dat and User.dat that you saved in step 1.
In one case this method shrunk system.dat from 5.5 to 2.4 MB.
You can only imagine how windows responded to that.. They fly:)
NOTE: IF YOU HAVE MULTIPLE USER PROFILES.
Only thing I have to WARN people of is if they use multiple user profiles when regedit rebuilds new registry it sets default user.dat in windows directory belonging to the user which had made MyReg.reg backup.
So it is necessary to copy the original default; C:\WINDOWS\USER.DAT back to the windows directory.
After the process, please exam your system thoroughly and put it through it paces. Also keep the backup for a while before updating it.

CT Software's "shareware" Safetynet Pro is "the" program of choice for backing up critical Registry/INI files fast and clean. NONE better, IMHO.
AT:  http://members.aol.com/ron2222/index.html

However, you can "detangle" (i.e. parse) the registry and then compress it using Win95's REGEDIT.

1. Backup your User.dat & System.dat to another directory (CRITICAL)
2. Create two bat files containing the following commands and place them in your root Windows directory.
3. Reboot to MSDOS level, safety level (important).
4. Execute RE.bat to parse the registry to text.
5. Execute RC.bat to compress registry.
6. Registry is now parsed and compressed.
7. If anything goes wrong, drop to MSDOS and replace USER & SYSTEM DAT files with backups.
-----
RE.bat

regedit /l:system.dat /R:user.dat /E Mainbak.reg
-----
RC.bat

regedit /l:system.dat /R:user.dat /C Mainbak.reg
-----

If you still have problems, you can also "export" the Registry in Win95 with Regedit and try again.  If you also have CR LF (carriage return, line feed) problems, get Walbeehm's "FixREG" from http://www.walbeehm.com/win95upd.html.
I think this should do it.  Enjoy!

He recomends Remove-It! from http://www.quarterdeck.com/

Bill Sorciere   sorciere@monmouth.com

When you view what events you can assign sounds to from Control Panel / Sounds, you cannot delete the events themselves.
In order to do that:
1.Start Regedit
2.Go to HKEY_CURRENT_USER\AppEvents\Schemes\Apps
3.From here you can delete any items you don't want to show or no longer need.

1.Start Regedit
2.Go to HKEY_CLASSES_ROOT\Folder\shell
3.Add a key rootexplore
4.Give it a default value of E&xplore From Here
5.Go to HKEY_CLASSES_ROOT\Folder\shell\rootexplore
6.Add a key command
7.Give it a default value of Explorer.exe /e,/root,/idlist,%i
Now when you right click on any folder, you can open up an Explorer window of that folder.
This will work for both Windows95 and NT 4.0

When I would go to Control Panel or Start Menu Programs, or any other Desktop window setting; meaning size, position, icon arrangement, they would never be as I set them.
Here's how to fix that!
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
There is a "NoSaveSettings" key. I deleted it and now my all my stuff stays where I tell it.
The same key shows up at:
[HKEY_USERS\john\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer](where john is your password profile)

Remember those "Tips of the day" that appeared when you first install Win95?
If you don't want them any longer and want to clear yet more Clutter, approximately 5K, you can delete them at:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion \explorer\Tips

When you right click on your desktop and pick properties your Display Properties screen appears.
Under Appearance tab\Schemes, determine if you want all those wild schemes.
If not they can be deleted and clear approximately 45K.
Before you delete them, choose or create at least 1 Scheme and "Save As" (in my case Bud 1).
1.Open Regedit
2.Go to HKEY_CURRENT_USER\Control Panel\Appearance\Schemes
3.Highlight every String and Value on the right side and delete. DO NOT DELETE "Default"

If you need to change the drive and or path where Windows95 will look for it's installation files:
1.Start Regedit
2.Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\SourcePath
3.Change the location from there

If you want to create a Network Logon Banner:
1.Start Regedit
2.Go To
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Winlogon
3.Create a new String called LegalNoticeCaption
4.Enter the text for your banner.

If you have a un-registered file type and want to view it with Explorer's Right-click you can add your program to the right-click options by:
1.Starting Regedit
2.Go to HKEY_CLASS_ROOT\Unknown
3.Highlight the Shell Folder below it
4.Right click on Shell and create a New Key
5.Name it anything you want (For example NOTEPAD)
6.Create a New Key under that named command
7.Highlight the Command key
8.Double click on the Default value in the right hand panel
9.In Value Data, enter the path and filename of the program you want to use to open the file type
10.For example: C:\WINDOWS\NOTEPAD.EXE %1
11.Click on OK
In this example, when you right click on a file in Explorer, NOTEPAD will show up as an option.

With the OEM Version of Windows95, a new switch, /D, is added to Regedit.
This enables you to delete items from Registry.
The syntax is: REGEDIT /L:system.dat_location /R:user.dat_location /D Reg_Key where Reg_Key is the key you want to delete
There are two requirements:
1. That you have to boot to the same OEM version of Windows95 as the REGEDIT.EXE file.
2. You cannot be in Win95 at the time you use this switch.

If you want to make restrictions to what users can do without having to
running Poledit, changes can be made directly to the registry.
This will allow you to make a REG file with the specific restrictions you want
and importing them all at once.
1.Start Regedit
2.Go to HKEY_Current_User\Software\Microsoft\CurrentVersion\Policies
3.There should already be at least a Explorer
4.Additional keys that can be created under Policies are System, Network
   and WinOldApp
5.You can then add DWORD values set to 1 in the appropriate keys
6.In the Explorer key you can add:
NoDeletePrinter - Disables Deletion of Printers
NoAddPrinter - Disables Addition of Printers
NoRun - Disables Run Command
NoSetFolders - Removes Folders from Settings on Start Menu
NoSetTaskbar - Removes Taskbar from Settings on Start Menu
NoFind - Removes the Find Command
NoDrives - Hides Drives in My Computers
NoNetHood - Hides the Network Neighborhood
NoDesktop - Hides all items on the Desktop
NoClose - Disables Shutdown
NoSaveSettings - Don't save settings on exit
DisableRegistryTools - Disable Registry Editing Tools - NOTE: Be Careful of this one
7.In the System key you can enter:
NoDispCPL - Disable Display Control Panel
NoDispBackgroundPage - Hide Background Page
NoDispScrSavPage - Hide Screen Saver Page
NoDispAppearancePage - Hide Appearance Page
NoDispSettingsPage - Hide Settings Page
NoSecCPL - Disable Password Control Panel
NoPwdPage - Hide Password Change Page
NoAdminPage - Hide Remote Administration Page
NoProfilePage - Hide User Profiles Page
NoDevMgrPage - Hide Device Manager Page
NoConfigPage - Hide Hardware Profiles Page
NoFileSysPage - Hide File System Button
NoVirtMemPage - Hide Virtual Memory Button
8.In the Network key you can enter:
NoNetSetupSecurityPage - H
NoNetSetup - Disable the Network Control Panel
NoNetSetupIDPage - Hide Identification Page
NoNetSetupSecurityPage - Hide Access Control Page
NoFileSharingControl - Disable File Sharing Controls
NoPrintSharing - Disable Print Sharing Controls
9.In the WinOldApp key you can enter:
Disabled - Disable MS-DOS Prompt
NoRealMode - Disables Single-Mode MS-DOS

When you make changes to your hard drive and use Explorer, the changes are not usually displayed until you press the F5 key
To make the updates automatic:
1.Start Regedit
2.Go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\UpdateMode
3.Edit the DWORD value to be between 1 and 7
4.Restart Windows

As in Windows for Workgroups, when logging on to an NT Domain, it is preferable to disable password caching.
This allows for the single NT Domain login and eliminates the secondary Windows logon screen.
It also eliminates the possibility of the respective passwords to get out of sync.

To disable password caching on the workstation, a one-line addition to the registry needs to be made.
To make the change, create a ASCII text file called DISABLE.REG with the following lines:
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Policies\Network]
"DisablePwdCaching"=dword:00000001
Open up a DOS box and type REGEDIT DISABLE.REG
You can also download the DISABLE.REG file.
If you need to re-enable password caching, download ENABLE.REG and repeat the process just with the different file name

There are four network settings that can be configured so when dialing to an ISP, you should get somewhat greater throughput.
They are the MaxMTU, MaxMSS and DefaultRcvWindow, and DefaultTTL MaxMTU and MaxMSS
1.Start REGEDIT
2.Go to Hkey_Local_Machine\System\CurrentControlset\Services\Class\netTrans\000n
(where n is your particular network adapter binding.)
3.Right click on the right panel
4.Select New\String Value
5.Type in MaxMTU
6.Double click on it and enter then the number you want. The usual change is to 576
7.Similarly, you can add MaxMSS and give it a value of 536

1.Start REGEDIT
2.Go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\MSTCP
3.Add a new string DefaultRcvWindow and give it a value of 2144
4.Add a new string DefaultTTL and give it a value of 60-64

To add items when you right-click on the Start Button:
1.Start Regedit
2.Go to HKey_Classes_Root\Directory\Shell
3.Right-click on Shell and select New\Key
4.Type in the name of the key and press the Enter key
5.In the Default name that shows in the right hand panel, you can add a title with a & character in front of the letter for a shortcut
6.Right-click on the key you just created and create another key under it called command
7.For the value of this command, enter the full path and program you want to execute
8.Now when you right click on the Start Button, your new program will show up. You do not need to reboot first.
9.For example, if you wanted WinWord, you would add that as the first key, the default in the right panel would be &WinWord so when you right click on the Start Button, the W would be underlined and you could just press that key. The command would be something like
C:\MSOFFICE\WINWORD\WINWORD.EXE

NOTE 2
I don't recoment this hack at all.

When you right-click on the desktop and select New, a list of default templates you can open up are listed.
To remove items from that list:
1.Start Regedit
2.Search for the string ShellNew
3.This should bring you to HKey_Classes_Root
4.For the items you want to remove, simply rename the ShellNew command
5.Renaming is safer that deleting it
6.Continue searching for the items you want to remove
7.You do not need to reboot for the change to take effect

By default, the Telnet session has a window size of 25 lines. To increase this so you can scroll back and look at a larger number on lines:
1.Start Regedit
2.Go to HKEY_CURRENT_USER\Software\Microsoft\Telnet
3.Double-click on the entry Rows in the right hand panel
4.Increase the decimal value to one that suits your needs.

You can edit the Tips of the day in the Registry by going to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Tips

The Path to this Key is:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Policies\Explorer]

Or you can copy everything between the lines and paste it to notepad, then save as "Save.reg". Then just double click on it and it will put that key and value in for you: You should reboot to make sure the change takes effect.
=================
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Policies\Explorer]

"NoSaveSettings"=hex:00,00,00,00

================

Consequences of hiding Network Neighborhood

Since shell support for the Universal Naming Convention (UNC) notation is handled by the Network Neighborhood, hiding the Network Neighborhood icon will prevent Explorer from accessing resources via UNCs.  In order to access network resources from Explorer, you need to map them to a drive letter.  Note that the MS-DOS command prompt and other applications are not affected by this setting, because they do not use the Network Neighborhood to resolve UNCs.

In particular, hiding the Network Neighborhood prevents Direct Cable Connection from displaying the contents of the host computer. Aside from this, Direct Cable Connection functions normally.

See UNC

[HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Policies\Explorer]
"NoDesktop"=dword:00000001

==================To restore
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Policies\Explorer]
"NoDesktop"=dword:00000000

==================

If you want to start programs every time Windows95 runs, but would like to hide them from users by not having the listed in the Startup folder or the WIN.INI file, you can have them load through the registry.
1.Start Regedit
2.Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
\Run or RunOnce
3.Right click on the right panel
4.Select New\String Value
5.Type in any name
6.For the value, enter the path and executable for the program you want to run.

You can shut off the animation displayed when you minimize and maximize windows.
1.Open Regedit
2.HKEY_CURRENT_USER
3.Control panel
4.Desktop
5.WindowMetrics
6.Right Mouse Click an empty space in the right pane.
7.Select new/string value.
8.Name the new value MinAnimate.
9.Doubleclick on the new string value (MinAnimate) and click on "Modify"
10.Enter a value of 0 for Off or 1 for On then hit
11.Close Regedit and all programs then reboot.

1.Start REGEDIT
2.Go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Class\Modem\0000\Init
3.Change the settings to the new values

If your modem it timing out during file transfers or loading Web Pages, you might try increasing the timeout period.
To change it:
1.Start Regedit
2.Go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Class\Modem\XXXX\Settings
Where XXXX is the number of your modem
3.Move to the right panel and double click on Inactivity Timeout
4.The number of minutes for a timeout should be entered between the brackets.
5.For example, a US Robotics Sportster could have S19=<30> to set it to 30 minutes.

If you remove an installed program and its files by deleting the files, it may still show up in the Add/Remove programs list through the control panel.
In order to remove it from the list (so you don't need to re-install in order to just remove it again).
1.Start the Registry Editor
2.Open HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
3.Delete any programs here.

HKEY_CLASSES_ROOT: Contains software settings about drag-and-drop operations, handles shortcut information, and other user interface information. There will be a subkey for every file association you have defined.

HKEY_CURRENT_USER: Information regarding the currently logged-on user (see HKEY_USERS below).
- AppEvents: contains the settings for which sounds to play for system sound events
- Control Panel: Control Panel settings are stored here, similar to system.ini and win.ini in Win 3.x.
- InstallLocationsMRU: appears to contain paths for Startup folder programs
- Keyboard layout: specifies current keyboard layout
- Network: Network connection information
- RemoteAccess: Contains information about the current log-on location if using Dial-Up Networking
- Software: Software configuration settings for the currently logged-on user.

HKEY_LOCAL_MACHINE: Contains information about the hardware and software settings that are generic to all users of this computer. Subkeys include:
- Config: Configuration information
- Enum: Hardware device information, such as monitor settings
- Hardware: Serial communication port information and settings.
- Network: information about networks the user is currently logged onto.
- Security: network security settings.
- Software: Software-specific information and settings
- System: System startup and device driver information, and operating system settings.

HKEY_USERS: Information about desktop and user settings for each user that logs onto this computer. Each user will have a subkey under this heading. if there is only one user, the subkey will be ".default"

HKEY_CURRENT_CONFIG: Contains info about the current hardware configuration, pointing to HKEY_LOCAL_MACHINE.

HKEY_DYN_DATA: This key contains dynamic information about plug-n-play devices. The data here changes if devices are added or removed on-the-fly (i.e., hot-docking).

Type:
attrib -s -h -r System.dat
attrib -s -h -r System.da0
attrib -s -h -r User.dat
attrib -s -h -r User.da0

Then copy the .da0 files over the .dat files.

At the same prompt, type:

copy System.da0 System.dat
copy User.da0 User.dat

Then restore the attributes by typing:

attrib +s +h +r System.dat
attrib +s +h +r System.da0
attrib +s +h +r User.dat
attrib +s +h +r User.da0

That will restore your registry.

Using System.da0

Restore the registry to its state when you last successfully started Windows 95. To do so, follow these steps:

1. Restart the computer. When you see the "Starting Windows 95" message, press the F8 key, then choose "Safe mode command prompt only" from the Startup menu.
2. Type the following command to move to the Windows folder

cd\<windows>

where <windows> is the Windows 95 folder. For example, if Windows 95 is installed in the Windows folder, type the following line:

cd\windows

3. Type the following line:

attrib -s -h -r system.dat

4. Type the following line:

ren system.dat system.bad

5. Restart your computer. Windows 95 uses the System.da0 file when it cannot find the System.dat file. If this file works, Windows 95 renames it to System.dat.

If the error continues to occur after you follow the steps in this section, please see the next section.

Using System.1st

Restore the registry to its state when you first started Windows 95 successfully. To do so, follow these steps:

1. Restart the computer. When you see the "Starting Windows 95" message, press the F8 key, then choose "Safe mode command prompt only" from the Startup menu. Type the following command to move to the Windows folder

cd\<windows>

where <windows> is the Windows 95 folder. For example, if Windows 95 is installed in the Windows folder, type the following line:

cd\windows

2. Type the following line:

attrib -s -h -r system.dat

3. Type the following line:

ren system.dat system.xxx

4. Type the following line:

cd\

5. Type the following line:

attrib -s -h -r system.1st

6. Type the following line

copy system.1st c:\<windows>\system.dat

where <windows> is your Windows 95 folder.

7. Type the following line:

attrib +s +h +r system.1st

8. Restart your computer.

The File Types tab in Explorer's View | Options menu lets you edit most of your file types, but certain settings cannot be changed. The default action for a batch file, for instance, runs the batch file instead of opening it via Notepad or Wordpad. Thus, when you double-click on AUTOEXEC.BAT, a DOS window opens, and the file executes. If you want to change this default action and edit a batch file when you double-click on it, however, the File Types tab does not let you do so; the Set Default button for the file type called MS-DOS Batch File is always grayed out.

The button is grayed out because HKCR's batfile key contains an EditFlag value entry. Such entries are used throughout the Registry to prevent novice users from altering certain system settings. The binary data in batfile's EditFlag reads d0 04 00 00. If you change this value to 00 00 00 00, you can then change any of the batch file settings. Do not, however, indiscriminately zero out EditFlag; if you do so in a system ProgID such as Drive or AudioCD, it completely disappears from the File Types list. For ProgIDs that are linked to extensions, set all EditFlags to 00 00 00 00. For system ProgIDs, replace EditFlag data with 02 00 00 00.

If you wish to have access to some buttons while leaving others grayed out, you must know the function of each EditFlag bit. The last two bytes of data are always zero, but most bits within the first two bytes have a specific effect:

* Byte 1, bit 1: Removes the file type from the master list in the File Types tab (select View | Options under Explorer) if it has an associated extension.

* Byte 1, bit 2: Adds the file type to the File Types tab if it does not have an associated extension.

* Byte 1, bit 3: Identifies a type with no associated extension.

* Byte 1, bit 4: Grays out the Edit button in the File Types tab.

* Byte 1, bit 5: Grays out the Remove button in the File Types tab.

* Byte 1, bit 6: Grays out the New button in the Edit File Type dialog (select the Edit button in the File Types tab).

* Byte 1, bit 7: Grays out the Edit button in the Edit File Type dialog.

* Byte 1, bit 8: Grays out the Remove button in the Edit File Type dialog.

* Byte 2, bit 1: Prevents you from editing a file type's description in the Edit File Type dialog.

* Byte 2, bit 2: Grays out the Change Icon button in the Edit File Type dialog.

* Byte 2, bit 3: Grays out the SetDefault button in the Edit File Type dialog.

* Byte 2, bit 4: Prevents you from editing an action's description in the Edit Action dialog (select the Edit button in the Edit File Type dialog).

* Byte 2, bit 5: Prevents you from editing the command line in the Edit Action dialog.

* Byte 2, bit 6: Prevents you from setting DDE (Dynamic Data Exchange) fields in the Edit Action dialog.

The EditFlags value for Drive, for instance, is d2 01 00 00 in Hex (1101 0010 0000 0001 in binary). Bits 2, 5, 7, and 8 are on in byte 1, and bit 1 is on in byte 2. The EditFlag for batfile is d0 04 00 00 in Hex or 1101 0000 0000 0100 in binary. In this case, bits 5, 7, and 8 are on in byte 1, and bit 3 is on in byte 2.

Bits 4, 5, and 6 of byte 2 apply only to actions that are protected. EditFlags with action keys (such as HKCR\batfile\shell\open) determine protection. If byte 1, bit 1 of such an EditFlag is 0 (or if there is no EditFlag), then the action is protected. If byte 1, bit 1 is 1, then the action is unprotected.

Before you change system EditFlags, be very careful. These values are internal to the operating system, are not officially documented, and may change in subsequent versions.

Protection on system base objects ie; KnownDLLs

To enable stronger protection on system base objects such as the KnownDLLs list, add the  following value to the registry key
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SessionManager:

Name: ProtectionMode
Type: REG_DWORD
Value: 1

NOTE: Incorrectly changing the system registry can damage your system or render it inoperable,  and users undertake these changes at their own risk. If you require assistance in making this  change, see Obtaining Support on this Issue below.

Hide The Virtual Memory Button

Use this Registry setting to hide the Virtual Memory button on the Performance tab under Control Panel > System.  By hiding this button, you can prevent users from changing or disabling the machine's Virtual Memory setting, which can adversely effect the machine's performance.  To set this option, open the Registry Editor and go to:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ Policies\System

Edit/create the value "NoVirtMemPage" (String Value) and set the value to "1" (without quotes) to hide the Virtual Memory button, or "0" to display the button.  The setting will take effect immediately and does not require a reboot.