The Geeks Corner

How the registry works..

Simply opening Registry Editor offers your first hints of its organization. Make sure you’re signed in
with an account in the Local Administrators group (Standard users can view the registry but not make
changes), type regedit in the search box, and then click the matching command in the results list. You
can open its file location and pin the shortcut to Start if you want; I don’t recommend pinning Registry
Editor to the taskbar except for short-term tasks.
The basic structure of the registry has remained constant for decades. Figure 3-1 shows the hierarchy
of the registry, with one of its five top-level subtrees expanded to show some of its keys and subkeys

Figure 3-1: Opening Registry Editor shows the five subtrees, each beginning with HKEY, with values and data
available for viewing and editing in the right pane.
This instance of Registry Editor is connected to the local computer, as evidenced by the heading at the
top of the tree. (As I explain later in this chapter, you can connect to another PC over a network to edit
its registry remotely.)
Beneath that top heading are five subtrees, each beginning with HKEY. In general, information about
the local PC is saved in HKEY_LOCAL_MACHINE; settings for the user who is currently signed-in
interactively are in HKEY_CURRENT_USER. In this and other books, you’ll often see these two subtrees
abbreviated, properly, as HKLM and HKCU.
Keys and subkeys in each of those subtrees are the equivalent of folders and subfolders. By itself, a
key or subkey does nothing but supply a location where values can be stored.
In Figure 3-1, I’ve expanded the HKEY_LOCAL_MACHINE subtree to display several levels of keys and
subkeys, with the BIOS subkey selected and its associated values listed on the right. You can see the
full path to this subkey in the status bar at the bottom of the window.
Each value in the pane on the right represents a setting or configuration detail for the current PC or
user. As I explain in the next section, you can view and (carefully) edit the data contained in those
values to change a preference or setting.
In general, I recommend that you use built-in configuration tools—typically the Windows 10 Settings
app, the Local Group Policy Editor (Gpedit.msc), or Control Panel, in particular—rather than editing the
registry directly. Save the latter option for times when it’s the only practical solution.
Don’t use registry cleaners
In the Annals of Useless Software, there’s a special category for registry cleaners. These tools are
usually sold with extravagant promises of improved performance and reliability. And yet, the only
objective tests I have seen show literally zero difference in performance after “cleaning” and
“optimizing” the registry

In fact, the entire premise behind registry cleaning is flawed. Yes, there are, no doubt, a few stray
entries in your registry that were left behind when you uninstalled a program. But the idea that
cleaning even a few dozen of those unneeded entries will make a measurable difference is absurd.
If you have a specific problem with removing a specific program, a registry cleaning utility might be
able to identify keys that will help you to solve that specific problem. But that’s a rare scenario. The
more likely result of indiscriminately “cleaning” (in other words, deleting) registry entries is that
you’ll delete something you really need, causing a program or feature to fail.
And if you don’t believe me, maybe you’ll believe Microsoft, which has published its support policy
for registry cleaning utilities at support.microsoft.com/kb/2563254. The executive summary states
the following:
“Microsoft does not support the use of registry cleaners. … Microsoft is not responsible for issues
caused by using a registry cleaning utility. … Microsoft cannot guarantee that problems resulting
from the use of a registry cleaning utility can be solved.”

Editing the registry like a pro

For an example of a task that can’t be accomplished by using built-in Windows tools, look no further
than the Registered Owner and Registered Organization values associated with a copy of Windows 10.
These values are occasionally used by third-party programs to populate default user information
fields.
You can find those in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
key. In Figure 3-2, I’ve double-clicked the RegisteredOrganization value, opening a box in which I can
change its data to something other than the default “Windows User” entry.

Figure 3-2: Editing a text string in a registry value is one of the simplest tasks in Registry Editor.
Because the data type in that value is REG_SZ (plain text), it’s a simple matter to type a replacement
value and press Enter or click OK to save it.
For values that you can turn on or off, the data type is usually REG_DWORD, with a 0 for off and 1 for
on. In the Settings app, for example, you’ll find a Defer Upgrades check box under Update & Security

Windows Update > Advanced Options. Selecting or clearing that check box changes the associated
value in HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings. You could accomplish the same
configuration setting by changing the registry value from 0 to 1, as shown here:

Backup and restoring registry values
Some registry values don’t really lend themselves to manual editing. Consider the example of the
Caps Lock key on your keyboard. For many people (myself included), its actual function is completely
useless, and its primary effect is to change text TO ALL CAPS when you accidentally hit it, resulting in
muttered curses and some unnecessary editing.
The only way to change what happens when you press the Caps Lock key on a PC running
Windows 10 is to make a change to the registry, specifically to the Scancode Map value in the
subkey HKLM\SYSTEM\CurrentControlSet\Control\Keyboard Layout. Figure 3-3 shows the Keyboard
Layout key selected. I’ve double-clicked the Scancode Map value and changed its data to a value
that tells Windows to ignore the Caps Lock key. Note that its data is a binary value, with the data type
REG_BINARY.

Figure 3-3: This slightly intimidating Registry Editor window is where you add the binary information to change
the keyboard scan codes to turn off the Caps Lock key.
After you change that value and restart your PC, that annoying Caps Lock key is effectively
neutralized. Tapping it, deliberately or otherwise, does absolutely nothing.

More on keyboard scancode maps
If that example whetted your interest, you might want to read this article from the superb
howtogeek.com website, which explains how scancode maps work: http://bit.ly/scancode-maps.
That’s an extreme but fitting example of a task that you can accomplish by using Registry Editor. But
do you really want to manually type all of that binary code? Of course you don’t. Which is why clever
IT pros save that type of registry change so that they can apply it automatically, with just a click or
two.
The secret is to create a simple text file that contains the necessary changes and save it in Registration
Entries format, with a .reg file name extension. (This is the same technique you should use before you
make a change that you might want to roll back, by the way.)
After you’ve made the changes in the registry, right-click the key or subkey whose changes you
want to save and then, on the shortcut menu, choose Export. That opens the dialog box shown in
Figure 3-4.

Figure 3-4: Use the Export option to save the current contents of a registry key before editing it.
Afterward, you can use this tool to copy settings between PCs.
Note the Export Range selection at the bottom of that dialog box. It’s worth double-checking the
Selected Branch box to be certain it displays the key or subkey you chose. (The only reason to select
All is if you want to save the contents of the entire registry in a plain-text file so that you can compare
before and after versions after installing a program or making a configuration change. Be warned: The
resulting files are enormous. In that scenario, you’re better off saving an individual subtree or two
rather than the entire registry.)
Should you back up the registry?
In earlier Windows versions, making a backup copy of the registry was an essential step before
most major configuration changes. With Windows 10, that step is unnecessary. The System Restore
option is a more effective way to accomplish the same goal of rolling back unwanted changes, and
in the case of major problems, the Reset option is faster and more likely to succeed. It is, however,

prudent to back up individual keys and subkeys before making changes, just in case you need to
restore the original settings.
After you save the exported file, you need to jump through one more hoop to make that file truly
useful. The .reg file contains every value associated with the selected key and all its subkeys. This can
result in a problem if you import that file on another PC: You’re likely to change a bunch of settings
you didn’t really want to tamper with.
The solution is to open the .reg file in a text editor, manually delete the settings for keys you don’t
want to change, and then save the edited file. The result is a file that looks like this:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout]
“Scancode Map”=hex:00,00,00,00,00,00,00,00,02,00,00,00,00,00,3a,00,00,00,00,00
Note that the key or subkey is enclosed in brackets. For an explanation of the syntax of .reg files
(including the use of the hyphen to delete registry keys and values), go to
https://support.microsoft.com/en-us/kb/310516.
To import your saved setting into the registry of another PC running Windows 10, all you need to do
is copy the file to a USB flash drive or a shared network folder and then double-click it from the target
PC. Doing so results in a confirmation prompt and a success message. To make the change silently,
type Regedit.exe /s saved_file, where saved_file is the full path to the .reg file you created.
When you import settings from a .reg file, Windows processes the file’s contents in order, starting at
the top of the file. If the first key on the list doesn’t already exist, Windows creates that key and then
adds any values you specify. If you want to create a new subkey with another subkey below it, be sure
to enter the lines in the correct order.
Data items must be enclosed in quotation marks and are immediately followed by an equal sign and
then the value you want to add. If a data item in your file doesn’t exist in the registry, the .reg file adds
it along with the specified value. If the specified data item does exist, the value in your .reg file
overwrites the existing value.
Finally, you have the option to use the Reg command in a Command Prompt window or in a batch file
or script. From an elevated Command Prompt, use this command:
reg add “HKLM\SYSTEM\CurrentControlSet\Control\Keyboard Layout” /v “Scancode Map” /t REG_BINARY
/d “00 00 00 00 00 00 00 00 02 00 00 00 00 00 3a 00 00 00 00 00”
Type reg /? to see the full list of eligible arguments for the reg command (query, add, export, import,
and so on). Each of those variants has its own syntax help. Try reg add /? to make sense of the
switches in the command above.

Finding keys, values, and data
If you know the exact subkey that contains the value you’re looking for, you can navigate through the
tree on the left to find it, expanding keys to see the full list of subkeys beneath them.
When you’re not sure of the location, use Registry Editor’s built-in Find function, which is available on
the Edit menu. You can also use the keyboard shortcut Ctrl+F. Either option opens the dialog box
shown in Figure 3-5

Backup and res

Figure 3-5: Press Ctrl+F to open the Find dialog box and search for a setting in the registry.
If you know the exact string you’re looking for, type it here and, optionally, use the three check boxes
to narrow your search to find matches only in keys, values, or data. Press Enter or click Find Next to
locate the next matching instance below your current selection.
You don’t need to reopen the Find dialog box to repeat the search. Instead, press F3 to find the next
matching entry in the list. Keep pressing F3 until you locate the entry you’re looking for.
If you regularly revisit the same keys in the registry, you should get to know the Favorites option on
the Registry Editor menu. Select a key or subkey, click Favorite, and then click Add To Favorites. That
opens the dialog box shown in Figure 3-6. By default, this box contains the name of the selected key
or subkey, but you can change it to a more descriptive name.

Figure 3-6: After selecting a key or subkey from the tree on the left, use the Add To Favorites menu to save a
pointer to that key on the Favorites menu.
After you add one or more items in this fashion, they appear at the bottom of the Favorites menu, as
shown here

Copy your favorite registry settings
Here’s a secret that even most Windows experts don’t know about. Your Registry Editor Favorites
are saved, naturally, in the registry—specifically in the subkey HKCU\SOFTWARE\Microsoft\
Windows\CurrentVersion\Applets\Regedit\Favorites. After customizing the Favorites menu, rightclick that key and export its contents to a .reg file, as I described in the previous section. You can
now use that file to export your Favorites from one machine to another.
Using the command line
As I ill

ustrated in the example earlier in this chapter, all versions of Windows include a built-in
command called Reg with which you can perform operations on registry subkeys and values. It’s
especially useful for IT pros who want to put together scripts to query and change registry values on a
network.
Documenting this powerful command could easily fill a chapter of its own, but if you’re curious, check
out the official reference at http://bit.ly/reg-command.

Editing the registry by using Local Group
Policy Editor
You can configure many user preferences and system settings by using Group Policy. On a domain
network, that typically involves an administrator creating templates that are applied to a domainjoined PC when it connects to the network.
But those same policies are available on any PC running Windows 10 Professional or Enterprise, using
the Local Group Policy Editor. The result gives the administrator of such a PC access to many settings
that aren’t otherwise available. To start this useful tool, run Gpedit.msc. Figure 3-7 shows the Local
Group Policy Editor in action.

This built-in app has a hierarchical organization, as displayed in the tree on the left, that’s similar to
that of Registry Editor. The two main branches correspond roughly to HKLM and KKCU. Policies in the
Computer Configuration branch typically apply to the PC, independent of users, whereas those in the
User Configuration branch typically apply after a user signs in.
Earlier in this chapter, I pointed out the Defer Upgrades option, which you can set by selecting a check
box in the Settings app or by editing the registry. Using Group Policy offers significantly more options
than a single check box. This policy and its associated setting are found in Computer Configuration >
Administrative Templates > Windows Components > Windows Update. Figure 3-8 shows the
relevant policy, one of 19 settings available under this heading (note that not all of them apply to
Windows 10).

Selecting that policy from the list on the right in Local Group Policy Editor displays a surprisingly
detailed block of help text to the left of the entry itself, explaining what the policy does and how to
configure it. Double-click the policy to open a window in which you can configure it, as shown in
Figure 3-9.

Figure 3-9: Select Enabled from the options at the top of this policy setting window to make more detailed
settings available below.
Although the explanatory text never uses the phrase, this is an important piece of the Windows
Update for Business feature. As with many features that are intended for business users, the primary
deployment tool is Group Policy, and it allows for far more options than are available in the Settings
app. Although its design is for enterprise networks, you can freely use it on your own PC, with exactly the same effect.

Editing the registry on a remote PC
By default, opening Registry Editor connects to the registry on the local PC. With a little advance work,
you can connect to a remote PC for some simple registry editing tasks. The Connect Network Registry
option is available on Registry Editor’s File menu, but before you can make it work, you need to do a
bit of advance configuration.
First, you must turn on the Remote Registry service on the remote PC whose registry you want to edit.
To do that, in the search box on the taskbar, type services and then click Services from the results list.
In the Services console (Services.msc), double-click the Remote Registry service and change the
Startup entry from Disabled to Manual or Automatic, and then click Start.
To edit the remote registry (as opposed to just viewing it), you must be signed in as an administrator
on your local computer.
Finally, you need to be able to supply administrative credentials for the remote PC

With those details out of the way, on the File menu, choose Connect Network Registry. Type the name
of the remote computer to which you want to connect, and then enter the credentials for an
administrator’s account on the remote PC when prompted.
The result, shown in Figure 3-10, is a new top-level branch in the tree pane, with two subtrees
beneath it.

Figure 3-10: Connecting to a remote registry requires some configuration changes and offers only limited access
to the remote PC.
Your capabilities in this mode are severely limited compared to those you have available when you
sign in interactively to the remote PC. In general, on a home or small office network, you’ll probably
have better results using Remote Desktop Protocol to connect to the remote PC and then run Registry
Editor in the Remote Desktop session.

restoring registry values

Finding keys, values, and data

Using the command line

Editing the registry by using Local Group Policy Editor

Editing the registry on a remote PC

---

Published @ May 4, 2022 4:26 am