Wednesday, March 6, 2013

Windows Registry

Windows Registry is a hierarchical database that stores settings for configuration and options on a windows operating system.  It contains components for applications running on the platform that have been set to used the registry.

These are the five main subgroups, in which can be handled access from a known root key handle that is specifically mapped to the content.

  1. HKEY_CLASSES_ROOT
    This define classes by windows. Named grouped of functions to find what you can do with an object. Everything on the system is to be defined by the class. This is user specific and does not allow roaming user profiles.
  2. HKEY_CURRENT_USER
    This simply stores the settings of a current user. Each user's settings are stored in their own files called NTUSER.DAT and USRCLASS.DAT inside their own Documents and Settings subfolder.
  3. HKEY_USERS
    This stores all personalized information for users on the PC. Each user profile is actively loaded on the machine, and user hives are usually only loaded for currently logged-in users.
  4. HKEY_LOCAL_MACHINE
    This stores settings that are specific to the local computer. It contains all data for non-user specific configuration. It is key located by HKLM and not stored by disk, but maintained in memory by the system kernal in order to map other subkeys.
  5. HKEY_CURRENT_CONFIG
    If there are multiple values for a machine, this is where you would find settings.  It gathers information at runtime; information stored i this key is not permanently on the disk, just regenerated at the boot time.

No comments:

Post a Comment