In the first part of this series we looked at the purpose and structure of the Registry. This month, we'll take a look inside the Registry using Microsoft's Registry Editor, aka Regedit.
No doubt you've come across dire warnings about the bad things which can happen if you screw things up when working with the Registry. They are all true. Remember, the Registry contains all the configuration and control information about your system. Mess it up and applications will start to misbehave, programs won't open, your system will crash and, worst case, you may lock yourself out of Windows completely.
On the other hand, if you want to know more about your computer's operation and want your system to behave as you wish it to and not simply as Microsoft has deemed fit, then nothing beats playing around in the Registry. And for those of us who get as much fun from tinkering with our PCs as we do using them for real work, the Registry is a digital sandpit.
So, by all means use Regedit, but make sure you recognise the risks and take precautionary measures before you proceed. Always back up the Registry before you fiddle with it and know how to restore the Registry if things go wrong. You may wish to read my article on Backing Up and Restoring the Registry before you proceed.
Using Regedit
To open the Registry in the Registry Editor click Start -> Run, type regedit in the Open box and click OK. Regedit will open, displaying the six root keys branching from My Computer in the key pane.
The layout is a lot like Windows Explorer. There's a hierarchical listing of the keys, displayed as folders, on the left: Click a key or subkey to see its values displayed in the contents pane on the right; double-click a key or click the + sign beside its name to expand the branch and show the subkeys; click the - sign beside a key's name to collapse the branch.
The Windows Registry displayed in the Registry Editor. (Click the picture to see a full-sized screenshot.)
People use a sort of shorthand to describe moving around the Registry. For example, if you're told to navigate to the key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\AboutURLS
it means double-click HKEY_LOCAL_MACHINE, then Software, then Microsoft, then Internet Explorer, then click AboutURLS to select it.
When you select a key all the values it contains are displayed in the contents pane, with the value names on the left and the value data on the right. String values (values which contain text) are represented by an icon displaying letters; binary values are represented by an icon displaying zeroes and ones.
Along the bottom of the Registry Editor window is the status line, which displays the full path of the selected Registry key. Along the top are menus. From the Registry Menu you can import and export Registry files. This provides an alternative way to backup and restore the Registry, although it's most useful for backing up individual Registry keys and branches, rather than the whole Registry.
The most important thing to keep in mind when using Regedit is that it is an extremely unforgiving program. There is no Undo command and no Save command. When making changes to the Registry, take note of the original values before you make your changes, so you can undo them if necessary. When you edit a value in HKEY_USERS (or an alias) the change is saved immediately to the file User.dat; when you edit a value in HKEY_LOCAL_MACHINE (or an alias) the change is immediately stored in System.dat.
Safer alternatives to Regedit
Before we go any further, you may want to consider using a different editor to work with the Registry. Regedit's only virtues are that it's supplied free with Windows and that most Registry editing instructions assume you are using it. There are, however, much better editors available which provide more safety, more speed (Regedit is horribly slow when it comes to searching the Registry for a particular value) and many more features. One of the best is Resplendent Registrar, but as it's a little pricey you'll only want to consider it if you intend to make a habit of editing the Registry.
Symantec makes the Norton Registry Editor. It's supplied with Norton Utilities, and thus is part of Norton SystemWorks, so if you have either of those programs you already have it on hand.
The really attractive feature of both these editors is they have a multi-level, selective Undo command. (Resplendence has a free Lite version of its editor, but unfortunately it lacks the Undo feature). Click Undo in Resplendence Registrar, for example, and up pops a window listing all the changes you've made in the current and previous sessions. Select any of the items in the list and click Undo to reverse the change, or select them all to undo all changes you've made.
Resplendent Registrar's multi-level Undo feature makes it an attractive and safe alternative to the fly-by-your-pants Regedit. (Click the image to see a full-size screenshot.)
Searching the Registry
When you first open the Registry it can be a little overwhelming. There are thousands upon thousands of items in it, most with not very helpful names. Finding your way around takes practice.
Fortunately, Regedit lets you search for a specific string contained in a key name, a value name or within value data, so if you know the key you need to edit or the value you wish to change you can usually jump straight to it.
To find a value, press Ctrl+F (or click Edit Menu -> Find), type the string you're looking for in the Find What box, tell Regedit what type of info you're looking for (key, value name or data) and click Find Next. If the first match isn't what you want, press F3 to locate the next match.
Regedit's search is hideously slow, so it's a good idea to use the Look At options to narrow the search whenever possible. Another way to speed things up is to start the search as close to the most likely location as possible. For example, if you know the key you want is located in HKEY_LOCAL_MACHINE, click that root key before starting the search.
Adding a key or value
To add a key to the Registry, locate the key under which the new key should go and right-click the key. From the pop-up menu choose New -> Key, then type a name for the new key. Note that case matters when typing Registry key names and values. The new key will be created branching from the selected key.
To add a value to a key, right-click the key and choose New -> String Value, New -> Binary Value or New -> DWORD Value from the pop-up menu. Name the new value then double-click it to edit the value data.
A practical example of adding a key
Try a practical example. When you click the Start Menu there's a noticeable delay before it springs open. The length of the delay is determined by a value called MenuShowDelay. Unless you've already edited this value (you can do so using Microsoft's TweakUI utility as well as by directly editing the Registry) it should not yet exist in the Registry. Here's how to add the value and edit it:
- Open Regedit and navigate to:
HKEY_CURRENT_USER\Control Panel\desktop
- Right-click the desktop subkey and select New -> String Value from the pop-up menu.
- Name the new value MenuShowDelay.
- Double-click the new value to edit it and type in a value from 0 to 32767. The default value is 400 milliseconds (500 milliseconds is half a second); setting it to 0 will eliminate the delay; setting it to anything over 10,000 will make it excruciatingly slow.
- Click OK, close the Registry and restart your computer to make the new setting come into effect.
To print a part of the Registry, select a key or subkey then select Print from the Registry Menu. Be careful which key you select or you may end up using half a forest.
Safely deleting keys and values
To delete a key:
- First, backup the key by selecting it and then selecting Export Registry File from the Registry Menu. Choose Selected Branch in the Export Range section, name the file and click Save. The key (and its subkeys and values) will be saved in a .reg file.
- Right-click the key and select Delete from the pop-up menu.
- Click Yes when prompted to confirm the delete. Regedit will delete the key and all its subkeys and values.
If anything goes wrong and you want to resurrect the deleted key, exit Regedit, locate the .reg file you created in step 1, double-click the file and, when prompted, allow it to be added to the Registry.
To delete a value, right-click the value name, select Delete from the pop-up menu and answer Yes when asked to confirm the deletion.
Renaming keys and values
To rename a key or value, right-click it, select Rename from the pop-up menu, type in the new name and press Enter. Take care, though: Renaming an essential key can have far reaching consequences.
| Geekgirl.technote: Beware Registry defraggers |
|
Over time, the Registry becomes bloated and clogged with old and invalid entries. There are a number of utilities available to defrag, optimise and clean the Registry. Be very, very careful before using any of these programs. We've had major disasters with the Registry defraggers supplied in all the major utility suites (including Norton SystemWorks) and in third-party Registry editors, such as Resplendence Registrar. The one tool which appears to work well without causing problems is Microsoft's unsupported (but well tested) RegClean. RegClean doesn't attempt to do the sort of deep cleaning offered by other Registry cleaners and defraggers, but it certainly clears out some of the junk. |
Valid values
You've now seen how to add, edit and delete values in the Registry, but we haven't touched on what types of values you'll find in Registry keys.
Most values in the Registry are stored as string, binary or DWORD data types. There are, in fact, other ways to store data, but those other types are only accessible to programmers and not via Regedit.
String values consist of text including spaces and numbers. Each string value is enclosed in quotation marks, although when you edit data you do not include the quotes.
Binary values are numeric values, up to 16 kilobytes in size, represented by a sequence of hexadecimal characters. Hexadecimal is counting to the base 16 and hexadecimal digits consist of the numbers 0 to 9 and the letters A to F.
DWORD values are 32-bit binary values, represented in hexadecimal and decimal, with the hex value shown first followed by the decimal equivalent shown in parentheses, thus:
0x00000000 (0)
DWORD stands for double word. There are eight bits in a byte and two bytes – 16 bits – create what programmers term a word. Hence the 32-bit values are double words.
Class Identifiers
After working with the Registry for a while, most of the strangeness will wear off. Key names, although a little cryptic, usually provide some idea of their contents and values tend to fall into the three main categories described above.
There's one group of subkeys, though, which will stop you in your tracks. These are the ActiveX class identifiers, known as CLSIDs.
| Geekgirl.technote: What's ActiveX? |
|
ActiveX is a set of rules for how applications should share information; it provides interaction between applications and within otherwise usually static applications, such as Web pages. |
Each ActiveX class, whether it is a compound document object, an ActiveX control or some other class of ActiveX module, is assigned a unique CLSID. The unique string used for each CLSID is called a globally unique identifier, or GUID, and programmers use a utility called Guidgen.exe to generate the number. CLSIDs are stored as 16-byte values and appear as long strings of numbers enclosed in braces. For example:
{3EA48300-8CF6-101B-84FB-666CCB9BCD32}
Each CLSID takes the same form of 8, 4, 4, 4 and 12 digits separated by hyphens.
You'll find an overwhelming list of these things if you look in HKEY_CLASSES_ROOT\CLSID. Many of these entries are installed by Windows itself; others are inserted in the Registry when you install applications and utilities.
If you're intimidated by CLSIDs, never fear. So, too, are programmers, who instead of using CLSIDs in their programs often use aliases called Program Identifiers, or progids. Progids are much easier for humans to handle, taking the form:
vendor.component.version
(vendor is sometimes replaced by the actual program name), or simply:
vendor.component
An example is:
HKEY_CLASSES_ROOT\word.document.8
All progid entries in the Registry have a subkey called CLSID which lists the associated class identifier. If you do a search for the associated CLSID in the registry, you'll find a separate subkey which provides much more detail about the actual properties of the class referenced by the progid alias.
Don't get too het up about CLSIDs. It's good to understand their function so you don't get flummoxed when working with the Registry, but you won't often have to deal with them directly. And, by clicking any of the CLSIDs listed in the registry you'll find the default value describes the class itself, such as Microsoft Excel Worksheet or Microsoft Waveform Audio Files.
| Geekgirl.technote: Doing a manual Registry backup |
|
Before you use the Registry Editor, use the Registry Checker to create a manual backup:
|
Step-by-step: Editing Registry values
To help you get accustomed to working with the Registry, here's a step-by-step guide to editing Registry values.
- To edit an existing key, select the key to display its values in the contents pane then double-click the value you wish to edit. Alternatively, you can right-click the value and choose Modify from the pop-up menu. Regedit will open one of three Edit dialogs, depending on the type of value you're editing (string, DWORD or binary).
- To edit a string value, type the text without including the quotation marks into the Value Data box. The quotes will be added automatically by Regedit.
- To edit a binary value, select the section of the value you wish to edit first, then type in the new value. Note that the first four digits on the left indicate the offset of the value in the data stream and cannot be edited. The data is displayed both in hex form and in its ASCII equivalent (the characters on the right), and you can edit the value by altering either of these.
- For DWORDS, if you know the hexadecimal value click Hexadecimal in the Base section and then type the value into the Value Data box. Alternatively, you can enter a decimal value by choosing Decimal in the Base section and typing the value into the Value Data box. By switching from one base to the other, you can check how your value will appear in each format.
Top Tweak: A fat caret
Practice your Registry editing with this tweak, which lets you adjust the width of the system caret. The caret is the bar which indicates the insertion point when you're editing text. If you sometimes lose track of the caret, making it wider will help you spot it. This tweak affects the caret in system programs such as Notepad, Windows Explorer and Internet Explorer.
- Navigate to HKEY_CURRENT_USER\Control Panel\desktop.
- Add a new DWORD value and name it CaretWidth.
- Edit CaretWidth and make its value 2 (the default is 1).
- Close Regedit and log off and back on to enable the new caret width.
Coming up
In the final part of this series, we'll look at alternative ways of editing the Registry, including the use of .reg files, and we'll try out some Registry tweaks.
© 2003 Rose Vines
Support geekgirl'sDo you find the tutorials on this site useful? If so, please show your support by kicking in a few bucks to sponsor an orphanage for Afghan refugees. For a small amount, it is possible to make a difference in an area of the world which is hurting badly. |
|
|
| Want to know more? Read this post on my blog. |
| top | home | windows 9x menu |