Windows Administrator Basics: Windows Registry

The Windows Registry is a hierarchical database that stores low-level settings for the Microsoft Windows operating system and for applications that opt to use the registry.

Windows Registry Root Keys

The Windows Registry consists of the following Root Keys.

-HKEY_CLASSES_ROOT

-HKEY_CURRENT_USER

-HKEY_LOCAL_MACHINE

-HKEY_USER

-HEKY_CURRENT_CONFIG

Root Keys contain SubKeys. Subkeys may contain subkeys of their own too and contain at least one value, called as its Default Value.

Windows Registry Hives

A hive is a logical group of keys, subkeys, and values in the registry that has a set of supporting files loaded into memory when the operating system is started or a user logs in. For Example, HKEY_CURRENT_USER with its subkeys and Value called a hive. When a user log on to Windows, the information from ntuser.dat file is loaded into HKEY_CURRENT_USER hive. When a user logs off, any changes in the registry are saved back to ntuser.dat

Windows Registry Data Type

The values stored in the registry are classified by a data type. A data type represents the specific kind of data that the value can store. There are 5 widely used data types which we will explain here.

REG_BINARY

The raw binary data is stored in this data type. Most hardware component information is stored as binary data, and can be displayed in an editor in hexadecimal format.

REG_DWORD

This type represents the data as a four-byte number and is commonly used for boolean values, such as “0” is disabled and “1” is enabled.

REG_EXPAND_SZ

This type is an expandable data string that is string containing a variable to be replaced when called by an application. For example, for the following value, the string “%SystemRoot%” will be replaced by the actual location of the directory containing the Windows NT system files. (This type is only available using an advanced registry editor such as REGEDT32)

REG_MULTI_SZ

This type is a multiple string used to represent values that contain lists or multiple values; each entry is separated by a NULL character. (This type is only available using an advanced registry editor such as REGEDT32)

REG_SZ

This type is a standard string, used to represent human-readable text values.

Backing up (Exporting) Windows Registry

You should always backup your registry before you attempt to change, create, or remove registry settings. This will give you an option to revert to a known good version if something goes wrong.

You can follow the steps below to backup windows registry.

• Press the Windows button and the R button simultaneously to open the Run window.
• Type “regedit” to open the registry editor and press Enter.

• Select the Key which you want to back up, right-click, and select Export. If you want to backup entire Windows registry, then select ‘Computer’ at the top and then select Export from the menu or Context menu.

• In the dialog box, enter a name for the backup file, select the location where you want to export the registry file, and click Save to create and save the backup.

Importing Windows Registry from Registry Editor

• Open Registry Editor, Select File > Import

• Browse to the location where you have saved the registry backup, select the file, and click on Open.

• You can see the import progress if you have taken the backup of the entire registry or complete hives. Otherwise, the action will be quick, and you may not see any progress window at all.

• You will see a dialog box showing success/failure of registry import.

Related Posts

• Windows 10 – Remote administration through PowerShell – Part 1
• Windows Administrator Basics: Managing Services from Command Line
• Windows Administrator Basics: Windows Services
• Windows Administrator Basics: Managing Windows Services from Powershell