The Microsoft Computer Dictionary, Fifth Edition, defines the registry as:

A central hierarchical database used in Microsoft Windows 9x, Windows CE, Windows NT, and Windows 2000 used to store information necessary to configure the system for one or more users, applications and hardware devices.

To edit the registry, Microsoft recommends that you follow the steps in the Microsoft documentation only. If possible, use the Windows user interface instead of directly editing the registry.
You can edit the registry by using Registry Editor (Regedit.exe or Regedt32.exe). If you use Registry Editor incorrectly, you can cause serious problems that may require you to reinstall your operating system. Microsoft does not guarantee that problems that you cause by using Registry Editor incorrectly can be resolved. Use Registry Editor at your own risk.

Before you modify the registry, make sure to back up the registry, and make sure that you understand how to restore the registry if a problem occurs.

• HOW TO: Back Up, Edit, and Restore the Registry in Windows XP and Windows Server 2003
• HOW TO: Backup, Edit, and Restore the Registry in Windows 2000
• HOW TO: Backup, Edit, and Restore the Registry in Windows NT 4.0
• HOW TO: Backup, Edit, and Restore the Registry in Windows 95, Windows 98, and Windows Me
• Command Line Switches REGEDIT Windows 3.1

Note The registry in 64-Bit versions of Windows XP and Windows Server 2003 is divided into 32-bit and 64-bit keys. Many of the 32-bit keys have the same names as their 64-bit counterparts, and vice versa. The default 64-bit version of Registry Editor that comes with 64-Bit versions of Windows XP and Windows Server 2003 displays the 32-bit keys under the following node:

HKEY_LOCAL_MACHINE\Software\WOW6432

• HOW TO: View the System Registry By Using 64-Bit Versions of Windows

The navigation area of Registry Editor displays folders, each of which represents a predefined key on the local computer. When you access the registry of a remote computer, only two predefined keys appear: HKEY_USERS and HKEY_LOCAL_MACHINE. The following table lists the predefined keys used by the system. The maximum size of a key name is 255 characters.

Folder/predefined key	Description
HKEY_CURRENT_USER	Contains the root of the configuration information for the user who is currently logged on. The user's folders, screen colours, and Control Panel settings are stored here. This information is associated with the user's profile. This key is sometimes abbreviated as "HKCU."
HKEY_USERS	Contains the root of all user profiles on the computer.
HKEY_CURRENT_USER	is a subkey of HKEY_USERS, which is sometimes abbreviated as "HKU."
HKEY_LOCAL_MACHINE	Contains configuration information particular to the computer (for any user). This key is sometimes abbreviated as "HKLM."
HKEY_CLASSES_ROOT	Is a subkey of HKEY_LOCAL_MACHINE\Software. The information stored here ensures that the correct program opens when you open a file by using Windows Explorer. This key is sometimes abbreviated as "HKCR." Starting with Windows 2000, this information is stored under both the HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER keys. The HKEY_LOCAL_MACHINE\Software\Classes key contains default settings that can apply to all users on the local computer. The HKEY_CURRENT_USER\Software\Classes key contains settings that override the default settings and apply only to the interactive user. The HKEY_CLASSES_ROOT key provides a view of the registry that merges the information from these two sources. HKEY_CLASSES_ROOT also provides this merged view for programs designed for previous versions of Windows. To change the settings for the interactive user, changes should be made under HKEY_CURRENT_USER\Software\Classes rather than HKEY_CLASSES_ROOT. To change the default settings, changes should be made under HKEY_LOCAL_MACHINE\Software\Classes. If you write keys to a key under HKEY_CLASSES_ROOT, the system stores the information under HKEY_LOCAL_MACHINE\Software\Classes. If you write values to a key under HKEY_CLASSES_ROOT, and the key already exists under HKEY_CURRENT_USER\Software\Classes, the system will store the information there instead of under HKEY_LOCAL_MACHINE\Software\Classes.
HKEY_CURRENT_CONFIG	Contains information about the hardware profile used by the local computer at system startup.

The following table lists the data types currently defined and used by Windows. The maximum size of a value name is as follows:

Windows Server 2003 and Windows XP:	16,383 characters
Windows 2000:	260 ANSI characters or 16,383 Unicode characters
Windows Me/Windows 98/Windows 95:	255 characters

Long values (more than 2,048 bytes) should be stored as files with the file names stored in the registry. This helps the registry perform efficiently. The maximum size of a value is as follows:

Windows NT 4.0/Windows 2000/Windows XP/Windows Server 2003: Available memory

Windows Me/Windows 98/Windows 95: 16,300 bytes

Note There is a 64K limit for the total size of all values of a key.

Name	Data type	Description
Binary Value	REG_BINARY	Raw binary data. Most hardware component information is stored as binary data and is displayed in Registry Editor in hexadecimal format.
DWORD Value	REG_DWORD	Data represented by a number that is 4 bytes long (a 32-bit integer). Many parameters for device drivers and services are this type and are displayed in Registry Editor in binary, hexadecimal, or decimal format. Related values are DWORD_LITTLE_ENDIAN (least significant byte is at the lowest address) and REG_DWORD_BIG_ENDIAN (least significant byte is at the highest address).
Expandable String Value	REG_EXPAND_SZ	A variable-length data string. This data type includes variables that are resolved when a program or service uses the data.
Multi-String Value	REG_MULTI_SZ	A multiple string. Values that contain lists or multiple values in a form that people can read are usually this type. Entries are separated by spaces, commas, or other marks.
String Value	REG_SZ	A fixed-length text string.
Binary Value	REG_RESOURCE_LIST	A series of nested arrays designed to store a resource list used by a hardware device driver or one of the physical devices it controls. This data is detected and written into the \ResourceMap tree by the system and is displayed in Registry Editor in hexadecimal format as a Binary Value.
Binary Value	REG_RESOURCE_REQUIREMENTS_LIST	A series of nested arrays designed to store a device driver's list of possible hardware resources it or one of the physical devices it controls can use, from which the system writes a subset into the \ResourceMap tree. This data is detected by the system and is displayed in Registry Editor in hexadecimal format as a Binary Value.
Binary Value	REG_FULL_RESOURCE_DESCRIPTOR	A series of nested arrays designed to store a resource list used by a physical hardware device. This data is detected and written into the \HardwareDescription tree by the system and is displayed in Registry Editor in hexadecimal format as a Binary Value.
None	REG_NONE	Data with no particular type. This data is written to the registry by the system or applications and is displayed in Registry Editor in hexadecimal format as a Binary Value
Link	REG_LINK	A Unicode string naming a symbolic link.
QWORD Value	REG_QWORD	Data represented by a number that is a 64-bit integer. This data is displayed in Registry Editor as a Binary Value and was first introduced in Windows 2000.

A registry hive is a group of keys, subkeys, and values in the registry that has a set of supporting files containing backups of its data.
The supporting files for all hives except HKEY_CURRENT_USER are in the Systemroot\System32\Config folder on Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003; the supporting files for HKEY_CURRENT_USER are in the Systemroot\Profiles\Username folder. The file name extensions of the files in these folders, and in some cases a lack of an extension, indicate the type of data they contain. Ntuser.dat.log

Registry hive	Supporting Files
HKEY_LOCAL_MACHINE\SAM	Sam, Sam.log, Sam.sav
HKEY_LOCAL_MACHINE\Security	Security, Security.log, Security.sav
HKEY_LOCAL_MACHINE\Software	Software, Software.log, Software.sav
HKEY_LOCAL_MACHINE\System	System, System.alt, System.log, System.sav
HKEY_CURRENT_CONFIG	System, System.alt, System.log, System.sav, Ntuser.dat,
HKEY_USERS\DEFAULT	Default, Default.log, Default.sav

In Windows 98, the registry files are called User.dat and System.dat. In Windows Millennium Edition, the registry files are called Classes.dat, User.dat, and System.dat.

Note Security features in Windows NT, Windows 2000, Windows XP, and Windows Server 2003 allow an administrator to control access to registry keys.

This information applies to:

• Microsoft Windows Server 2003, 64-Bit Datacenter Edition
• Microsoft Windows Server 2003, 64-Bit Enterprise Edition
• Microsoft Windows Server 2003, Datacenter Edition
• Microsoft Windows Server 2003, Enterprise Edition
• Microsoft Windows Server 2003, Standard Edition
• Microsoft Windows Server 2003, Web Edition
• Microsoft Windows XP 64-Bit Edition
• Microsoft Windows XP Home Edition
• Microsoft Windows XP Professional
• Microsoft Windows XP Media Center Edition
• Microsoft Windows XP Tablet PC Edition
• Microsoft Windows 2000 Server
• Microsoft Windows 2000 Advanced Server
• Microsoft Windows 2000 Professional
• Microsoft Windows 2000 Datacenter Server
• Microsoft Windows NT Server 4.0
• Microsoft Windows NT Server, Enterprise Edition 4.0
• Microsoft Windows NT Workstation 4.0
• Microsoft Windows Millennium Edition
• Microsoft Windows 98 Second Edition
• Microsoft Windows 98
• Microsoft Windows 95
• Microsoft Windows Small Business Server 2003, Premium Edition
• Microsoft Windows Small Business Server 2003, Standard Edition