Windows Vista’s Registry Structure

Windows Vista’s Registry Structure

It really does help troubleshooting if you understand the registry’s structure.  In particular, knowledge of the layout will prevent you navigating to the wrong section.  My foibles include thrashing around in the HKEY_LOCAL_MACHINE section, when I should be tracing a setting in the HKEY_USERS hive.  Another of my common blunders is creating a REG_DWORD instead of a REG_SZ, or vice versa.  While I still occasionally make these and other mistakes, thanks to my experience of the registry structure, I can soon correct my errors.

Topics for Vista’s Registry Structure


Types of Registry Folders

The layout of the Vista registry is remarkably similar to that found in NT 4.0, Windows 2000 and XP.

Registry Folder or Hive What it contains
HKEY_LOCAL_MACHINE Holds configuration settings for the computer (no matter which user logs on).
Can be abbreviated to ‘HKLM’.
HKEY_USERS Contains all the actively loaded user profiles on the computer.  More often than not, you would configure the subfolder under HKEY_CURRENT_USER which corresponded to a particular user.   Most common of all, you would edit a value under HKEY_CURRENT_USER.
Subsets of Main Hives 
HKEY_CLASSES_ROOT HKCR is an alias of HKEY_LOCAL_MACHINE\Software.  These settings ensure that the correct program opens when you launch Windows Explorer.

This information is stored under both the HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER keys. The HKEY_LOCAL_MACHINE\Software\Classes key contains default settings that can apply to all users on the local computer. The HKEY_CURRENT_USER\Software\Classes key contains settings that override the default settings and apply only to the interactive user.

HKEY_CURRENT_CONFIG Contains settings which control the hardware profile that is used by the computer at startup.
HKEY_CURRENT_USER Contains the settings for the user who is currently logged on.  HKCU for short

Registry Data Types

Data type Common Name Description
REG_DWORD DWORD Value Data represented by a 32-bit integer (4 bytes long).
REG_SZ String Value A fixed-length text string.  However, REG_SZ can also hold numbers.
The above REG_SZ and REG_DWORD are by far the most common registry types.  However, I include the other types below for completeness.
REG_MULTI_SZ Multi-String Value A multiple string. A data type capable of holding  more than one value.  Separate each entry by spaces, commas, or other marks.
REG_EXPAND_SZ Expandable String Value A variable-length data string. This data type is by system variables.
REG_BINARY Binary Value Raw binary data. Displayed in hexadecimal format.
REG_QWORD QWORD Value Data represented by a number that is a 64-bit integer. This data is displayed in a Binary Value.
REG_RESOURCE_LIST Binary Value A series of nested arrays, designed to store a resource list.
REG_RESOURCE_REQUIREMENTS_LIST Binary Value A series of nested arrays that are designed to store a device driver’s list of possible hardware resources.
REG_FULL_RESOURCE_DESCRIPTOR Binary Value A series of nested arrays that is designed to store a resource list that is used by a physical hardware device.
REG_LINK Link A Unicode string naming a symbolic link.
REG_NONE None Data with no particular type. This data is written to the registry by the system or applications and is displayed in Registry Editor in hexadecimal format.

Guy Recommends : SolarWinds’ Free VM MonitorSolarwinds VM Console Free Download

The best feature of this new this new version of SolarWinds VM Monitor is that it checks Windows Hyper-V.  Naturally, it still works with virtual machines on VMware ESX Servers.  VM Monitor is a clever desktop tool that not only tests that your server is online, but also displays the CPU and memory utilization for each node.

It’s easy to install and to configure this virtual machine monitor, all you need the host server’s IP address or hostname and the logon info. Give this virtual machine monitor a try – it’s free.

Download your free copy of SolarWinds VM Monitor.

Registry Files and Their Physical Location

Registry Hive Supporting files in \Windows\System32\Config
HKEY_LOCAL_MACHINE\SAM Sam, Sam.log, Sam.sav
HKEY_LOCAL_MACHINE\Security Security, Security.log, Security.sav
HKEY_LOCAL_MACHINE\Software Software, Software.log, Software.sav
HKEY_LOCAL_MACHINE\System System, System.alt, System.log, System.sav
HKEY_CURRENT_CONFIG System, System.alt, System.log, System.sav, Ntuser.dat, Ntuser.dat.log
HKEY_USERS\DEFAULT Default, Default.log, Default.sav


Monitor Your Network with the Real-time Traffic AnalyzerSolarwinds Real-time Traffic Analyzer

The main reason to monitor your network is to check that your all your servers are available.  If there is a network problem you want an interface to show the scope of the problem at a glance.

Even when all servers and routers are available, sooner or later you will be curious to know who, or what, is hogging your precious network’s bandwidth.  A GUI showing the top 10 users makes interesting reading.

Another reason to monitor network traffic is to learn more about your server’s response times and the use of resources.  To take the pain out of capturing frames and analysing the raw data, Guy recommends that you download a copy of the SolarWindsfree Real-time NetFlow Analyzer.

If you like this page then please share it with your friends


Configuring Windows Vista Topics:


     Vista Tools and Extras


   Tweak the Registry ebook

Download Your Tweak the Registry Ebook for only $6.45

This ebook will explain the workings of the registry.  I thoroughly enjoy tweaking the registry, and I want to distill the best of my experiences and pass them on to you.

Each registry tweak has two aims; to solve a specific problem, and to provide general learning points, which help you to master regedit. 

Over 60 pages ebook and PDF format