Windows Registry for Beginners. Basic concepts, monitoring and care
The registry stores information about your computer's configuration, Windows settings, and settings for installed programs. System components continually access this information. Therefore, if a registry failure occurs, programs may stop working or partially lose their functionality. Let's take a closer look at the nuances of working with it.
Launching Registry Editor
The easiest way to open the Registry Editor in Windows 7 is through the “ Execute" It starts in the menu " Start» or a combination of buttons Win + R. In the text line, enter the command regedit and complete it. 
It is worth understanding that editing system parameters can lead to malfunctions of the computer and the inability to launch some programs. Therefore, it is recommended that only experienced users make any changes. Inept actions can lead to serious consequences.
Problems Occurring
The installation process of almost any program or utility includes making changes to the registry. If the installation is carried out incorrectly, or a failure occurs during it, then there is a possibility of incorrect editing of system files. Sometimes this does not affect the performance of the computer in any way. But in some cases it leads to failures, slowdowns and other negative factors.
Problem solving
There are three large groups of problems associated with the registry: fragmentation, filling with unnecessary information, and data corruption. Everything is clear with the last category, let’s take a closer look at the other two.
The phenomenon of fragmentation is that a file is written in blocks to different areas of the drive. At the same time, the speed of access to it slows down. Registry data is also susceptible to fragmentation.
Most often, the program is not completely removed from the computer; residual data is sometimes not erased. These include entries in the registry. A large number of them leads to slowdown of Win 7.
In the first case, defragmentation will help; it is performed using the utility Defraggler. To solve the second problem it is worth installing CCleaner. And for the third - roll back the OS.
Problem 1: Fragmentation
Utility Defraggler designed to optimize work with registry data. With its help you can perform defragmentation.
Defragmentation is only available before the OS boots. Therefore, the utility will run when the computer starts. Follow the instructions to set it up:
Note: first system startup after setup Defraggler will last longer than usual. This is quite normal, because the computer takes a certain time to process the data. Subsequent downloads will be much faster.
When defragmentation is successful, the system will boot. But the program is configured in such a way that the procedure will be performed every time the computer starts. To disable this setting, remove Defraggler or change its operating parameters. But it is advisable to leave everything as it is at the moment. This will improve the speed of your PC after booting.
Problem 2: Residual files
An experienced user can clean the Windows 7 registry manually. But it is preferable to use special software for this. In this case, there is no risk of damaging important data.
It is worth highlighting CCleaner. This is a powerful utility for cleaning your Windows PC. It has many different functions, including cleaning registry data.
Operating instructions:
It is advisable to clean residual data regularly, constantly making backup files. It will come in handy if changes to the registry cause any problems in Windows 7.
Problem 3: Data Corruption
If any actions with changing registry settings lead to serious problems, then the previous methods will not help solve the problem. In this case, it is preferable to perform a registry repair in Windows 7.
The simplest option is rollback. In this case 
The OS will return to its previous state, when no changes were made that caused the error.
Windows recovery instructions:
When choosing a restore point, you should focus on the date. Button " Find affected programs» will display system elements that will be removed during the rollback. 
Hello everyone!!!
So we return to the topic of the registry again. Knowing the history of its creation, its “evolution”, pros and cons, it will be easier for us to understand the principle of working with it.
A description of the registry keys will also help us understand its structure. Let's not waste time on details, but let's get started right now.
Registry keys. Go!
Let us remind you that the registry contains hardware configurations, settings Windows and application settings, and stores all information about the computer, in general.
Once again, we warn you that editing the registry manually, without understanding it at all, is contraindicated! Any inaccurate action, and the operating system refuses to cooperate with you at all. Make backups.
Now let's rummage inside the registry.
He looks like a conductor in Windows. All you see in the left panel are keys (parameters), in the right - values.
There are several types of values:
- String - string type;
- Binary - binary type;
- DWORD are values of type DWORD.
The registry contains a lot of data, which also have their own types:
- REG_EXPAND_SZ - data string with variable length;
- REG_MULTI_SZ - multi-line text. Has a format that is easy to read;
- REG_BINARY - binary data;
- REG_DWORD - 4-byte integers.
Let's move on to the sections.
In the operating system Windows 7 There are five registry keys:
- HKEY_CLASSES_ROOT (abbreviated HKCR);
- HKEY_CURRENT_USER - (abbreviated HKCU);
- HKEY_LOCAL_MACHINE - (abbreviated HKLM);
- HKEY_USERS - (abbreviated HKU);
- HKEY_CURRENT_CONFIG - (abbreviated HKCC).
These sections are standard. You will not be able to delete or rename them. Some sections are volatile and are not contained in a particular file.
The operating system itself creates and manages these sections in memory, so they are considered temporary. Resource assignment and hardware detections run every time the system starts, so there is no point in writing them to disk regularly.
HKEY_CLASSES_ROOT (HKCR).
This section is a subsection of HKEY_LOCAL_MACHINESoftwareClasses. It contains information about registered file types, formats, and ActiveX and COM objects. Thanks to Windows 2000, all information about formats is located not only in HKEY_LOCAL_MACHINE, but also in HKEY_CURRENT_USER. HKEY_LOCAL_MACHINESoftwareClasses. The HKEY_LOCAL_MACHINESoftwareClasses section contains standard default settings that apply to all accounts. And the parameters of the HKEY_CURRENT_USERSoftwareClasses section belong to only one active user. HKEY_CLASSES_ROOT contains data from two sections.
To summarize, the information in this section ensures that applications launch when a file is opened by Explorer, and it also links applications and file types together.
HKEY_CURRENT_USER (HKCU).
This section is a link to the HKEY_USERS subkey. The configuration is associated with the active user logged in to the system. The section contains the configuration of the active user who is logged into the operating system. HKEY_CURRENT_USER also contains user folders, control panel settings, and screen colors. This information is dynamic, while in other sections the information related to user settings is static.
HKEY_LOCAL_MACHINE (HKLM).
This section is the “heart” of the registry. It stores configurations of drivers, devices, and other things (for all users), by changing which you can optimize the operating system. This section contains only basic, important information.
Note that HKEY_LOCAL_MACHINE SYSTEMCurrentControlSet is a link to one of the subkeys named HKEY_LOCAL_MACHINE SYSTEMControlSet00n (n is a number). In turn, ControlSet00n is a collection of settings for Windows 7. The operating system is capable of serving several such sets. Windows 7 handles backups so that you can undo settings changes.
The system stores all configurations. It's worth looking at the LastKnownGood parameter, which is also there. When loading the operating system, you can select "Load Last Known Known Configuration", and the number of the booting setting will be listed as this registry entry.
HKEY_USERS (HKU).
This section contains all information about all users on your computer. Users almost never use the section, only for reference purposes.
Note again that HKEY_CURRENT_USER is a link to one of the HKEY_USERS subsections. If something changes in the HKEY_CURRENT_USER hive, then the information immediately goes to the desired HKEY_USERS subsection.
So, today we will talk about a topic that seems to be not very important, but, in fact, very necessary for every Windows user (and there are the vast majority of them) - what is the registry, what does it consist of, why is it needed and how to save it in their bins. So what exactly is a registry? In essence, this is a huge, hierarchically structured database that operates based on user requests. This database is needed to systematize system data, as well as optimize access to it. The registry contains a lot of diverse information about both normal operating system settings and various fine-tuning settings, including security settings and working with low-level programs, as well as drivers.
The registry is not some external program, it is part of the operating system. Ntdetect searches for registry files when the system boots and loads the boot parameters from there. knowledge of the registry keys and knowledge of their significance is necessary for effective system management. And also at least for basic diagnostics “why it doesn’t work like that.” The registry is a tree-based system of value/key directories. Which are responsible for certain settings. Moreover, it should be taken into account that different keys can have different types - from logical to string.
Demonstrative anatomy.
So, it’s worth telling what the registry physically consists of and how it works. It’s worth making a reservation right away. That in the form in which the registry is presented to the user, it is not stored anywhere and special programs are needed to edit it - registry editors. The standard regedit.exe and regedit32.exe are fine. During the process of configuring and installing the system, some part of the registry data is generated, and another part is generated during system operation. As a result, when the system boots, a virtual object REGISTRY\ is formed, which is the registry. Registry branches are available for editing, viewing and studying the registry using standard Windows tools (regedit.exe and regedt32.exe programs). After editing the registry and/or making changes to it, these changes are immediately written to files that are part of the registry. These are, in Windows 95 and Windows 98 user.dat and system.dat; in Windows ME - user.dat, classes.dat and system.dat. In later versions of the system, a much larger number of necessary files appeared.
About the shortcomings and how scammers make money from these shortcomings.
In fact, the system is quite complex, but quite reliable. Due to excessive complexity, difficulties arise with the fragmentation of the registry, and therefore with the speed of its operation. Also, the registry tends to become excessively “fat” as a result of the accumulation of data over a long period of operation, which also complicates its functioning. This problem can be solved using special programs to optimize and clean the registry. When dealing with this issue on your own, you should remember that you should not delete something from the registry if you do not know its purpose - this can seriously damage the system, or even render it unusable. In addition, scammers are trying to make a big deal out of these problems - the network is full of offers to “download a program to optimize the registry, after installing which your computer will run 30% faster.” Typically, such an offer is followed by a form to send an SMS, which confirms previous suspicions. You should not pay attention to such things, much less believe them - then you will not lose either money or nerves.
The main branches of the registry, their meaning and purpose.
HKEY_CLASSES_ROOT is a link to the HKEY_LOCAL_MACHINE\Software\Classes section. The information stored here ensures that the required program starts when you open a file using Explorer. This section contains connections between applications and file types, as well as information about OLE.
HKEY_USERS - this section contains settings for all computer users.
HKEY_CURRENT_USER – this branch is a link to a specific internal subkey HKEY_USERS. All settings are set in accordance with which user is currently in the system (i.e. which session is active).
HKEY_LOCAL_MACHINE - Contains almost all the settings and parameters that belong to this computer, including hardware settings, hardware configuration and user profiles.
HKEY_CURRENT_CONFIG is essentially just a link to HKEY_LOCAL_MACHINE\ SYSTEM \CurrentControlSet\ Hardware Profiles\Current. There are all the incoming hardware settings necessary to run the system.
The main standard sections written above cannot be deleted or renamed. Some registry keys are volatile and are not stored in any file. The OS creates and manages these partitions entirely in RAM, rather than saving them to the hard drive, so they are temporary in nature. The system creates volatile partitions every time it boots. For example, HKEY_LOCAL_MACHINE\HARDWARE is a registry key that stores information about hardware devices and the resources assigned to them. Resource assignment and hardware detection occur every time the system boots, so it is logical and natural that this data does not require permanent storage on the hard drive.
How to save what you have already acquired.
Sometimes it is useful to make a backup copy of the system registry for fear of damaging it. This can happen as a result of unsuccessful experiments with the registry, incorrect installation of drivers, and dozens of other reasons. And it doesn’t hurt to have it “just in case.” In order not to do this manually every time, you can use one of the many auto-backup programs, for example, Comodo Backup.
To understand what the Windows Registry is, imagine the human brain, which stores all the key information and code that allows the different parts of the computer, operating system and software, to communicate with each other. Including detailed information about hardware, communication protocols, installed software, configuration files and, of course, the inner workings of Windows itself.
No matter what version of Windows you use, you will have not one, but several registry files, since Windows breaks the registry into several main files containing all the necessary information about the operation of the computer, its hardware, each individual user's files, software, settings and settings.
The database registry files that the operating system loads into the computer's memory when the computer starts or the user logs on are often quite large and complex. But without these settings and parameters files, the computer will not be able to work at all.
The registry resembles the brain in other ways. It is also capable of self-healing, but only to a limited extent. While the human body is full of building blocks necessary to repair and restore damaged cells and tissues, in the case of the registry, if parts of the databases containing the information necessary to boot or restore the system are damaged, self-repair is out of the question.
Fortunately, however, you can restore and repair the registry from the outside, even resetting it to an earlier state or completely erasing it and starting from scratch.
Previously, in older versions of Windows, there was a need to manually open the .ini file in the program or driver folder and make the necessary changes to the settings in it. Each program and hardware driver had its own .ini file and each of them, for each individual PC, required individual configuration.
And since there have always been minor differences between different PCs, an .ini file imported from one computer to another is unlikely to work.
With the help of the registry, Microsoft has reconciled this chaos and effectively pulled all those individual .ini files into a single, manageable database.
The registry was first introduced in Windows 95 and Windows NT, and as a core component of the operating system has not changed much to this day. The reason for this is compatibility with existing hardware and software, which is critical for business PC users. Changing the registry will break too much or require a complex virtualization machine, which at the very least will create significant security problems.
Over time, the Registry, with features like User Account Control (UAC) that prevent malware from burrowing deep into folder structures where it would never be found, has become more robust and secure.
Despite its size and the tens or even hundreds of thousands of keys it contains, it is quite simple and reliable, compiling a fairly simple structure of folders, keys and values.
Windows Registry Files
If you use a modern version of Windows, I mean Windows 7, Windows 8 or 8.1 and Windows 10, then the registry, its structure, operation and editing capabilities are the same. The main components of the operating system do not change very often.
Windows has several registry file stores, one for settings that apply to all PC users, such as hardware and general operating system settings, and several others for each individual user.
The main registry files are located in the %systemroot%\System 32\Config\ directory and consist of the following:
- SAM (Security Accounts Manager)
- SECURITY
- SOFTWARE
- SYSTEM
- DEFAULT
- USERDIFF (used only for OS upgrades)
Additionally, each user has their own registry files:
- %userprofile%\ntuser.dat
- %userprofile%\AppData\Local\Microsoft\Windows\UsrClass.dat
The first of these files, the ntuser.dat file, contains the user's basic software, settings, and configuration options. The second, UsrClass.dat, contains additional parameters such as user file relationships and COM (Composite Object Model) information.
Registry files are in binary format and cannot be read without special software. This distinguishes them from .REG files, which can be exported from the Windows Registry Editor for viewing and editing by administrators.
Registry Keys and Values
The Register, when viewed as a whole, is divided into five main sections or groups. This helps organize the various keys and folders in the registry and make them easily manageable.
When you change or create items in the registry you create keys and values, but to Windows Registry files, what are the differences between them?
Note. Registry keys are containers that contain values for software, hardware, or the Windows operating system. Keys can be thought of as a folder where values are separate files. You can navigate through keys using a hierarchy of folder types. Values are like the nuts and bolts of the registry. These are parameters, integers and strings that contain data and information that will help Windows boot and run your hardware and applications efficiently.
HKEY_CLASSES_ROOT (HKCR)
This section stores information about registered applications OLE objects class IDs and file associations. You may sometimes see it abbreviated as HKCR. It adds duplicate keys to the already existing HKEY_CURRENT_USER\Software\Classes subkey, and Windows will use the HKEY_CURRENT_USER\Software\Classes subkey as the primary one.
HKEY_CURRENT_USER (HKCU)
This section contains user profile configuration settings, including the disk location of user folders, Control Panel settings, and specific application configuration settings.
HKEY_LOCAL_MACHINE (HKLM)
This section contains all the settings specific to a PC on which Windows is installed. It contains SAM, SECURITY, SYSTEM and SOFTWARE files. The fifth file, HARDWARE, is created anew each time the computer starts and contains information about the detected hardware.
This section also contains those in
%systemroot%\System 32\config\ COMPONENTS and BCD files, which store information related to the configuration of downloading data to the PC.
There are only a few subkeys in the HKEY_LOCAL_MACHINE registry key that are worthy of attention, since this set of registry files is the most frequently modified and edited by users.
SAM
The Security Accounts Manager keys section will typically appear blank unless the user has appropriate administrative rights. It contains security information for all connected PC domains, including the local domain, which is also called SAM.
The SAM database contains the username used to log into the domain, the domain's UID (unique identifier), the cryptographic hash of the user's password, the user's registry and server location, and various other connection-related parameters and flags.
SECURITY
This subsection is also empty for most users, unless they have the appropriate administrative permissions. When connected to a domain, it is associated with the Server Registry Hive database, which contains all security policies applicable to the current user and installed applications.
SYSTEM
This subsection contains information about Windows installation, settings and data about currently connected devices, and disks containing system files.
SOFTWARE
This section contains settings for the current Windows installation, installed programs and applications, and software vendor keys, and includes subsections for file extensions, MIME types, and class and interface object identifiers (such as ActiveX).
HKEY_USERS (HKU)
HKEY_CURRENT_CONFIG (HKCC)
HKCC keys contain information collected when the computer and Windows boot. This information applies only to the current session and is deleted when the computer is turned off.
Each registry key contains individual keys of various types, providing maximum flexibility in managing and configuring the Windows operating system, applications, and hardware.
HKEY_PERFORMANCE_DATA
This section is invisible when using the Windows Registry Editor. It contains the runtime and performance data, Windows kernels, drivers, applications, and services. They are deleted when the computer is turned off and restored the next time it boots.
Registry Value Types
When you create a new registry value, you will be presented with the following options:
- REG_BINARY: This key type stores raw binary data.
- REG_DWORD: A 32-bit variable-length integer.
- DWORDS: Typically used to define device driver settings and software customization options.
- REG_SZ: Fixed length string value.
- REG_EXPAND_SZ: The expandable length of the string value, also used for environment variables.
- REG_MULTI_SZ: A multi-string that can contain a list of values, usually separated by commas or spaces.
- REG_RESOURCE_LIST: list of resources, nested arrays, used device drivers.
- REG_RESOURCE_REQUIRMENTS_LIST: List of hardware resources used by device drivers.
- REG_FULL_RESOURCE_DESCRIPTOR: Nested arrays used to store lists of physical device resources.
- REG_LINK: A symbolic link (UNICODE) to the following registry key that specifies the root key and the path to the target key.
- REG_NONE: Data that does not have a specific type.
- REG_QWORD: 64-bit length variables.
Note. There are some differences between the registries of 32-bit (x86) and 64-bit (x64) Windows operating systems. The 64-bit qword option is not supported on 32-bit versions of the Windows operating system. Additionally, the registry handles 32-bit and 64-bit keys in such a smart way that the file system handles multiple versions of the same dll files but maintains compatibility, which you can find in the registry section HKEY_LOCAL_MACHINE\Software\WOW6432Node.
.REG files
REG files differ from registry files in several important ways. First, although they store registry keys and values, they are intended to be backed up and transferred between PCs, and install Windows from those values and keys. Additionally, .REG files, unlike registry database files that contain a binary system, are stored in ASCII text format.
REG files open automatically (or at least should if everything is installed and organized correctly) when double-clicked in the Windows Registry Editor.
You can use .REG files in the registry editor itself to export the entire registry or its individual keys.
You can also manually edit the contents of the .REG file in Windows Notepad or any other text file editor. Right-click on the .REG file in Explorer, and in the context menu that appears, open the “edit” option.
In the example in the figure, the key is HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics, and it is highlighted here because it includes an addition to the default configuration.
At the end of the key is a section called "MinWidth", which has a numerical value of 54. This key changes the behavior of Windows taskbar icons (not grouped) so that program icons, when running multiple instances, appear separately, but without their labels.
Overall, although the Windows Registry is a huge, bloated behemoth with thousands of complex binary, hexadecimal and ASCII values and codes, it is quite easy to work with.
Windows Registry (system registry) is a hierarchical (tree) database containing records that define the parameters and settings of Microsoft Windows operating systems. The registry, as it appears when viewed by Registry Editor, is built from data that comes from registry files and hardware information collected during the boot process. When describing registry files in English, the term is used "Hive". In Microsoft documentation this term is translated as "Bush".
The main files responsible for creating the registry
Registry files are created during the installation process of the operating system and are stored in the folder:
%SystemRoot%\system32\config (usually C:\windows\system32\config ).
For Windows operating systems these are files named:
system
software
sam
security
default
components
bcd-template
In the operating systems Windows Vista, Windows 7, Windows8, , , , registry files are located in the directory \Windows\system32\config and have the same names, however, in these operating systems a new registry key has been added to store ( Boot Configuration Data) With name BCD00000000. The file with the data for this section is named bcd and is located in a hidden folder Boot active partition (the partition from which the system boots). Typically, during a standard Windows installation, a small active partition is created (from 100 to 500 megabytes depending on the operating system), which is hidden from the user and contains only service data for booting the system - boot records, boot manager bootmgr,boot configuration store BCD, localization files and memory testing programs. Bush location bcd depends on how the system boot loader is configured during installation, and may be located on the same partition as the Windows directory.
The location of the registry files in any version of Windows can be viewed using the Registry Editor, in the section:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\hivelist
This section stores information about all hives, including user profiles, with links to their location in the Windows file system.
Registry structure
The Windows registry has a tree structure and consists of 5 main registry keys:
HKEY_LOCAL_MACHINE (HKLM) is the largest registry key. It contains all the basic settings of the operating system, as well as computer hardware and software. The information contained in this section applies to all users registering on the system.
HKEY_CLASSES_ROOT (HKCR) - contains associations between applications and file types (by file extensions). This section also contains information about registered file types and COM and ActiveX objects. Except HKEY_CLASSES_ROOT this information is also stored in sections HKEY_LOCAL_MACHINE And HKEY_CURRENT_USER. Chapter HKEY_LOCAL_MACHINE\Software\Classes Contains default settings that apply to all users on the local computer. Options contained in the section HKEY_CURRENT_USER\Software\Classes, override the default ones and apply only to the current user. Chapter HKEY_CLASSES_ROOT includes data from both sources.
HKEY_USERS (HKU) - contains environment settings for each of the loaded user profiles, as well as for the default profile. IN HKEY_USERS there is a nested section \Default, as well as other subsections identified by the security identifier ( Security ID, SID) each user.
This section duplicates the information in HKEY_USERS\user SID, Where user SID- security identifier of the user currently registered in the system (you can find out the SID of the current user by typing in the command line whoami/user).
HKEY_CURRENT_CONFIG (HKCC) - contains settings for the current hardware profile. The current hardware profile includes sets of changes made to the standard device configuration specified in the subsections Software And System root partition HKEY LOCAL_MACHINE. IN HKEY_CURRENT_CONFIG Only changes are reflected. In addition, the information in this section is located in HKEY_LOCAL_MACHINE\System\CurrentControlSet\HardwareProfiles\Current.
Data in the registry is stored in the form of settings located in registry keys. Each parameter is characterized by a name, data type, and value.
Basic data types used in the registry
REG_DWORD - 32-bit number. Many device driver and service settings use this type of data. Registry editors can display this data in binary, hexadecimal, and decimal format.
REG_SZ - A text string in a human readable format. Values that represent component descriptions are typically assigned this data type.
REG_EXPAND_SZ - The data string to be expanded. This line is text containing a variable that can be replaced when called by the application, for example used to record environment variables.
REG_MULTI_SZ - Multiline field. Values that are actually lists of text strings in a human-readable format typically have this data type. The lines are separated by the NULL character.
REG_BINARY - Binary data. Most hardware components use information that is stored as binary data. Registry editors display this information in hexadecimal format.
REG_RESOURCE_LIST - List of hardware resources. Applies only to a branch HKEY_LOCAL_MACHINE\HARDWARE.
You can also sometimes find the following types of registry data:
REG_RESOURCE_REQUIREMENTS_LIST- List of required hardware resources. Applies only to a branch HKEY_LOCAL_MACHINE\HARDWARE.
REG_FULL_RESOURCE_ DESCRIPTOR - Descriptor (descriptor) of a hardware resource. Applies only to a branch HKEY_LOCAL_MACHINE\HARDWARE.
REG_QWORD - 64-bit number.
REG_DWORD_LITTLE_ENDIAN - 32-bit number in little-endian format, equivalent REG_DWORD.
REG_DWORD_BIG_ENDIAN is a 32-bit number in big-endian format.
REG_QWORD_LITTLE_ENDIAN is a 64-bit number in arrowhead format. Equivalent REG_QWORD.
REG_NONE - The parameter does not have a specific data type.
Interaction of the registry with the operating system
When the computer starts, the hardware recognizer ( hardware recognizer) places a list of devices it detects in the registry. Typically, hardware recognition is done by software Ntdetect.com and the operating system kernel Ntoskrnl.exe
When the system starts, the system kernel retrieves information from the registry about the device drivers being loaded and the order in which they are loaded. In addition, the program Ntoskrnl.exe sends information about itself to the registry (for example, version number).
During the system boot process, device drivers exchange boot parameters and configuration data with the registry. A device driver reports the system resources it uses, including hardware interrupts ( IRQ) and memory access channels ( DMA) so that the system can include this data in the registry. By the way, the registry allows you to create several hardware profiles. Hardware profile ( hardware profile) is a set of instructions that can be used to tell the operating system which device drivers should load when the computer starts. By default, the system creates a standard hardware profile that contains information about all the hardware found on the computer.
When a user logs in, user profiles are loaded ( user profiles). All information related to a specific username and associated rights is stored in the registry. A user profile defines individual system settings (display resolution, network connection settings, connected devices, and much more). Information about user profiles is also stored in the registry.
When installing applications. Each time you run the installer, new configuration data is added to the registry. When starting out, all installation programs must read information from the registry to determine whether the components they need are present on the system. In addition, the registry allows applications to share configuration information, giving them more interoperability. The application must actively and correctly use the registry, and also be able to remove it gracefully without affecting components that may be used by other programs (libraries, program modules, etc.). This information is also stored in the registry.
When administering the system. When a user makes changes to the system configuration using system administration tools (for example, using Control panels or snap MMC), all changes are immediately reflected in the system registry. In essence, administration tools are the most convenient and safe means of modifying the registry. By the way, the registry editor can also be considered an administrative tool ( regedit.exe), because all changes to the system can be made directly by editing the registry.
■ During the loading and operation of the operating system, registry data is constantly accessed, both for reading and writing. Registry files are constantly changing because not only the system, but also individual applications can use the registry to store their own data, settings and settings. In other words, accessing the registry is one of the most common operations. Even if the user is not working at the computer, the registry is still accessed by system services, drivers, and applications.
■ Violation of the integrity of the registry files (violation of the data structure) or incorrect values of individual critical parameters can lead to system crash. Therefore, before experimenting with the registry, take care of the possibility of saving and restoring it.
