Microsoft Press

Microsoft Professional Editions

The Technical Guide to Deploying, Configuring
and Supporting Windows 98 in Your Organization

Resource Kit

Page 1339

Chapter 33

Windows 98 Registry

This chapter describes how Microsoft Windows 98 components use the Registry, provides an overview of Registry tools, including Registry Checker, Registry Editor and Porfile Editor, and describes how to badckup and restore the Registry. It provides anoverview of teh structure of the Registry, and describes teh Registry keys. It, also, describes how values from Windows 3.x ini files are stored in the Registry, and includes Registry entries for modems, TCP/IP, others.

Thsi chaptrer is designed for system and network administrators and for "power users." It is not intended for Registry programmers (see the Microsoft Windows 98 Software Development Kit for that information.)

Note: This chapter assumes that the Windows 98 files are in the Windows folder, which is the default folder where Setup copies the system files.

Caution. Whereever possible, use the administrative tools, such as Control Panel or System Policy Editor, to make configuration chagnes, rather than editing the Registry. This is to ensure values are stored properly in the Registry when changing the configuration.

If you use Registry Editor to change valeus, you will not be warned if any entry is incorrect. Editing the Registry directly by using tghe Registry Editor can cause errors in loading hardware and software, and can prevent users from being able to start the computer.

Page 1351

Getting Started with the Registry Tools

This section describes how to get started with the tools that you can use to display, modify, back up, and recover the Registry.

Getting Started with Registry Checker

Registry Checker is a system maintenance program that finds and fixes Registry problems. Each time you start your computer, Registry Checker automatically scans the Registry for inconsistent structures, and if no problem is found, Registry Checker makes one backup for each day. Registry Checker consists of two executable files, ScanReg.exe and ScanRegW.exe, which are automatically copied to the \Windows\Command and \Windows folders, respectively, when Windows 98 is installed.

If a problem is found in the Registry, Registry Checker can restore the Registry from a good backup copy. Registry Checker maintains five compressed backups of the Registry that have successfully started the computer. Registry Checker attempts to fix Registry if a backup cannot be found. Registry Checker also removes unused space in the Registry, reducing the size the Registry file, and therefore improving performance.

Once per day at every startup, a new .cab file is created. The file name is (where xxx is a unique number assigned when the file is created). The new file replaces the oldest file. These files are located in the \Windows\Sysbckup folder (a hidden folder). Registry Checker always maintains atleast the last configuration from which the system was successfully booted.

The Registry Checker utility is actually two executable files:Scanreg.exe (ScanReg)is a real-mode MS-DOS executable file and Scanregw.exe (ScanReg W) is a protected-mode Windows executable file. They store copies of the entire Registry, both User.dat and System.dat, as well as Win.ini and System.ini, into a compressed file (*.cab).

ScanReg W scans the Registry for corruption and determines if it requires optimization, and then backs up the following system configuration files: User.dat, System.dat, Win.ini, and System.ini. This scan occurs automatically when the system is started. On the first successful boot, a .CAB file is created and marked as a Registry backup that is capable of booting the system. You can run ScanRegW when you want to force a scan and backup of these files. ScanRegW backs up the Registry and configuration files using the file.

ScanReg runs when ScanRegW detects a problem with the Registry and it prompts you to restart the computer to fix the problem. ScanReg either restores the Registry from a know good backup, or, if no backups are available, it repairs the current Registry. If ScanRegW detects that optimization is required, ScanReg optimizes the Registry on the next startup. With some severe types of Registry damage, Io.sys will detect the problem and the MS-DOS mode configuration menu appears, warning you that a Registry corruption has been detected, and prompts you to run the following from a command prompt:


At the conclusion of the first successful boot, a .cab file is created and marked as successful if started with the current Registry.

From the command prompt, running SCANREG.EXE / RESTORE will list the available backups to restore from, as explained in "Backing Up and Recovering the Registry" later in this chapter. Choose one to replace the current files with a known working set. The corrupt Registry files are backed up to a file in the \Windows\sysbkup folder.

The Registry Checker scan and backup tools can be configured with the Scanreg.ini file. The following list includes some configurable settings in the Scanreg.ini fite:

Getting Started with Registry Editor

The Registry Editor is a tool for displaying and editing the Registry database. Registry Editor (Regedit.exe) is copied to the Windows directory automatically when Windows 98 is installed.

Tip You can add the Registry Editor icon to your desktop by using the right mouse button to drag Regedit.exe from Windows Explorer to the desktop.

To run Registry Editor

From the Start menu, click Run and type regedit

Both mouse and keyboard commands may be used to navigate in Registry Editor.

To find specific data in the Registry

In the Registry Editor window, double-click any folder icon for a Registry key to display the contents of that key.


From the Edit menu, click Find. Then type all or part of the text string you want to find, and click options to specify whether you want to find a key name, an entry name, or data.

After Registry Editor finds the first instance of the text string, you can press F3 to search for the next instance.

Registry Editor can be used to view or modify a Registry on a local computer or on another computer over a network. Both the administrator's computer and the remote computer require the Microsoft Remote Registry service to allow remote Registry access.

For more information about the Microsoft Remote Registry service, see "Managing Remotely" later in this chapter and Chapter 25, "Remote Administration. "

Tip The network administrator can restrict users from being able to use Registry Editor to modify the Registry by setting a system policy named Disable Registry Editing Tools. However, this policy does not prevent the administrator or another user from modifying the Registry by using System Policy Editor.

For more information about this restriction and about using System Policy Editor to modify the Registry on individual or multiple computers, see Chapter 7, "User Profiles," and Chapter 8, "System Policies."

The values of the active key appear in the right pane of the Registry Editor. Each key contains at least one value with the name Default. Each additional value for a key must have both a name and a data value. The names appear in the right pane in the first column.

Valid characters to include in a name are A through Z, O through 9, blank, and underscore (_). The values appear under Data. In Windows 98, the size of the subkey is unlimited. For better efficiency, use a file to store large amounts of data (subkeys over 64 KB), and then maintain a pointer to this file in the subkey. Individual values within a subkey are restricted to 16 KB of data.

The Registry Editor can handle the following data types:


Stored as characters enclosed in quotation marks, it is a variable length, null- terminated set of characters.


Represented as a sequence of hex bytes (0-9 and A-F), a defined value can be 1-16 KB in size.


Represented by a special case of binary value. They are restricted to 4 bytes, and the value is shown in hexadecimals and decimals in this format:


The first number, 0x00000000, is the hex representation of the value, whereas the number in parenthesis, (0), contains the decimal representation.

If the Default entry contains no value, the following string is shown:

(value not set)

The representation and meaning of the value's data depends on the key. A binary sequence can be interpreted as a single byte, a double byte, or a byte sequence. Some numerical values are stored as strings.

Important Before modifying Registry values, always back up your system. "See Backing up and Recovering the Registry" later in this chapter.

To change any value

  1. Click the key in the left pane of the Registry Editor to display its values in the right pane.

  2. Double-click the value. The Registry Editor displays one of three types of dialog boxes, depending on the type of value you are changing.

Table 33.2 Registry Editor Value Types

Value type

Text value

The Edit String dialog box appears. Type a new value into the Value Data box. Text values are automatically displayed in quotation marks ("") and the new value is stored immediately in the Registry.

Binary value

The Edit Binary Value dialog box appears with the value data in hexadecimal format. Select a value to type a new value. When you click OK, the value is stored in the Registry.


The Edit DWORD Value dialog box appears. Select a Base option, and enter the value into the Value Data box. A DWORD can never exceed 32 bits.

To add a new value

  1. Click a root key, and then right-click in the right pane of the Registry Editor to display the context menu.

  2. Select New and then select the value type.

    A new entry called NewKey is inserted into the Registry. New Value represents the value you chose in step two above.

To delete any entry

Select the entry, and then select Delete from the context menu.

Caution The Registry Editor does not have an Undo function. All changes are written directly to the disk. If you want to remove an item from the Registry, consider renaming it as opposed to deleting it. However, use caution when renaming because this can affect system functionality.

To rename an entry

Select the entry, and then select Rename from the context menu.

Getting Started with Profile Editor

Each time the user logs on to a computer, Windows 98 searches the Registry under the following key to determine whether the user has a local profile: .

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version

\Profile List

Windows 98 also checks for the user profile in the user's home directory on the server. If the user profile on the server is the most current, Windows 98 copies it to the local computer for use during the current session, and then it loads the settings in this local copy into the Registry. If no local user profile exists, Windows 98 copies the server version to the local computer. If no profile is found, Windows 98 creates a new user profile on the local computer using default settings. If the user does not log on, then Windows 98 automatically uses the default user profile.

You can enable user profiles after Windows 98 is installed, either locally on a single computer or for multiple computers. You can avoid having to go to each computer to enable user profiles by creating a system policy that can be downloaded automatically when the initial Windows 98 installation is complete. For more information about enabling user profiles centrally on multiple computers, see Chapter 8, "System Policies."

To enable user profiles on a local computer after setup

  1. In Passwords in Control Panel, click the User Profiles tab.

  2. Click Users Can Customize Their Preferences And Desktop Settings.

  3. Select the options you want under User Profile Settings. These options describe what should be included as part of the user profile.

  4. Shut down and restart the computer.

Tip If you include desktop icons in your user profile, only the shortcuts (icons that represent links) will be available when you log on to the network from another computer. Actual files on your desktop are part of your local user profile only.

To disable user profiles on a local computer

In Passwords in Control Panel, click the User Profiles tab. Click All Users Of This PC Use The Same Preferences And Desktop Settings.

Note If an application is installed after user profiles are enabled with the option to include the Start menu and Programs in the profile, only the user who was logged on when the application was installed will have an entry for that application on the Programs menu. Other users will have to create shortcuts to the application on their Programs menus.

For more information about using user profiles, see Chapter 7, "User Profiles."

Page 1359

Administrating with the Registry Tools

This section describes tasks and tips for managing the Registry, and for using the Registry to manage your system.

Managing the Registry

The following tasks help you manage the Registry itself.

Finding Information in the Registry

The Registry contains thousands of entries, so it can be difficult to find a desired key or value. Scrolling through the hierarchy could take some time. The most efficient approach to find data in the Registry is to use Registry Editor.

To find information in the Registry

  1. Start Registry Editor.

  2. From the Edit menu, select Find.

  3. Type what you want to look for in the Find What field. You can enter a key, a subkey, a value name, or an actual value (text or binary).

  4. Click Find Next.

Backing up and Recovering the Registry

The Registry is critical to your Windows 98 computer because Windows 98 and Windows 98 applications store their configuration information in the Registry. Therefore, it is crucial to back up the Registry regularly and frequently so that an this information can be recovered in the event that the Registry is damaged. It is also a good idea to back up the Registry before installing a new application and device.

You can use Registry Checker to back up and restore the Registry either manually or automatically.

To back up using Registry Checker

  1. From the Start menu, click Run.

  2. Type scanregw.exe, and click OK.

First Registry Checker verifies that the Registry is structurally sound. If the Registry is OK and the Registry has not been backed up that day, Registry Checker offers to back it up. Registry Checker will back up the Registry and store the compressed .cab file in \windows\sysbckup (a hidden directory).

If the Registry structure is sound but a content change is keeping the computer from booting, then you need to restore from a backup manually.

To restore the backup manually

  1. From the Start menu, click Shut Down.

  2. Select Restart In MS-DOS Mode and click OK.

  3. From the MS-DOS command prompt, type SCANREG /RESTORE.

  4. Select the latest know good backup.

    Backed up, compressed Registry files are listed with the name The files show the time and date of backup. Next to each .cab file are the works Started or Not Started. Started means that the file had successfully started Windows 98; Not Started means it did not.

The table below describes command line options for the ScanReg and ScanRegW utilities of Registry Checker.

Table 33.3 Command line options for Registry Checker

/backup (for scanreg, scanregw)

Backs up the Registry with no prompts to the ScanReg & user.

/restore (for scanreg)

Displays a list of backup files available, sorted by date and time of the backup.

"/comment" (for scanreg, scanregw)

Specifies that a comment be attached to the backup, which is displayed with /restore.

/fix (for scanreg)

Repairs the Registry files.

/autoscan (for scanregw)

Scans and backs up the Registry files.

/scanonly (for scanregw)

Scans the Registry files and returns an error level. Does not back up.

The following list identifies the error levels returned by ScanReg.

Error Level Error


The Registry is bad.


No problems found, no dialog box.


Not enough memory; free some memory. In real mode, Registry Checker may require more memory, or HIMEM needs to be installed (ScanReg doesn't work in Safe mode command prompt only). In protect mode, the Windows drive may be full.


File not found; one or both of the Registry files are missing.


Unable to create User.dat or System.dat.

Caution You may have backed up core configuration files using the Emergency Recovery Utility and CfgBack utilities from the Windows 95 CD. If these Windows 95 backup registries are restored to the Windows 98 system, the computer will not boot.

For more information about Registry Checker, see Chapter 29, "General Troubleshooting. "

Importing and Exporting Registry Data

The Registry can be exported, imported, or recreated using either the MS-DOS- based version of Registry Editor on the Windows 98 Start up disk or the real- mode version created in the \Windows directory. By using the export capabilities of Registry Editor, a specific branch or the entire Registry can be saved in text format as a .reg file. A branch of or the entire Registry can be restored by importing a .reg file that was created by exporting the Registry.

You can import and export using Registry Editor. All the information required to import the data must be in the imported file and the files need a REG extension. Valid Windows 98 REG files contain only ASCII characters in a predefined format and contain the word REGEDIT4 in the first line. The second line must be blank. The following format is valid for a REG file:



"Null File"=""

All the lines that follow the first blank line can contain entries for Registry settings. Each entry starts with the name of the destination key enclosed in square brackets []. The next line is used for the value of an entry (which is the value shown later in the right pane of Registry Editor). This value is included in quotation marks (for example, "NullFile"). Some lines start with @= followed by a value in quotes. The @ character indicates a default value for an entry. These entries are marked as Default in the right pane of the Registry Editor.

Caution The Windows 98 Resource Kit does not provide sufficient information to guide you through the process of editing a .reg file, so it is recommended that you undertake editing a .reg file only under the guidance of your product support representative.

Also use the regedit /c option with extreme care, and only when you are sure that the specified .reg file contains a complete image of the Registry.

To import with Registry Editor

  1. From Registry Editor, select Import Registry File from the Registry menu.

  2. Click a folder, and then click a file name (or enter a file name).

  3. Click Open.

Tip You can also just double-click a *.reg file. The extension is associated with Regedit and will be imported automatically.

After a .reg file is successfully imported, a message box informs you that the .reg file was valid, indicating that it was formatted properly, that it was a valid Windows 98 .reg file, and that all information contained in the file and entered into the Registry is valid.

To export a .reg file using Registry Editor

  1. In the Registry Editor, select the branch or subkey that you want to export.

  2. Open the Registry menu and select Export Registry File.

  3. In the Export Registry File dialog box, select the folder in which you want to save the REG file.

  4. Enter the new file name.

  5. Click Save.

    The Registry Editor creates a REG file containing the information of the selected branch. This REG file can now be imported as described above.

By default, the Registry Editor exports only the active branch. You can export the whole Registry by selecting All in the Export Range section, but keep the file size in mind.

Accessing the Registry in Real Mode

The Registry Editor runs in MS-DOS real mode. If you can boot your computer to MS-DOS mode, you can access the Registry Editor. The file Regedit.exe is on the Windows startup disk and in the \Windows folder. For more information about using Regedit, type Regedit with no command line options at the command prompt, and a help screen appears advising you how to use this tool.

To import a Registry file into the Registry in MS-DOS Registry Editor

  1. From the Start menu, click Shut Down.

  2. Select Restart In MS-DOS Mode and click OK.

  3. At the command prompt, type the following:

    REGEDIT /e: System /R:user filename

    L:system is optional and specifies the location of the System.dat file. /R:user is also optional and specifies the location of the User.dat file. Filename is the name of the Registry file that will be imported. For example, the following command will import the contents of Global.reg into User.dat and System.dat:

    REGEDIT /L:C:\Windows\ /R:C:\Windows\Profiles\ A:\Global.reg

Managing Your System with the Registry

This section describes tasks that you can use to manage your system with the Registry, including disabling Registry Editor, disabling a user's ability to use any computer but his or her own, and registering file name extensions.

Disabling Registry Editor for a User

You can disable the Registry Editor for a user so that the user cannot change entries that you have set to limit user access.

To disable Registry Editor for a user 1. Start System Policy Editor, and click Local User. 2. Click System, and then click Restrictions. 3. Select Disable Registry Editing Tools.

Note An experienced user can still change Registry settings by importing a .reg file.

Disabling a User's Ability to Roam

You can keep a user from using any computer but his or her own.

To disable a user's ability to roam

1. Start Registry Editor.

2. Create a DWORD value in HKEY_LOCAL_MACHINE\Network\Logon.

3. Enter UseHomeDirectory as the value.

Removing Existing User Profiles You can remove one or all existing user profiles so that all users of the

Windows 98-based system will see the same desktop and icons.

To remove existing user profiles

1. Start Registry Editor.

2. Remove the appropriate keys form the following Registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion \Profilelst\


To remove all profiles, remove the \ProfileLst subkey.

3. Quit Registry Editor.

4. Double-click My Computer.

5. On the View menu, click Options.

6. On the View tab, click Show All Files, and then click OK.


Remove the appropriate Windows\Profiles\ folder(s).

Registering File Name Extensions

When you select a file name in Windows 98, the file opens in an application associated with that file type. The file is opened with the appropriate application because the file extension is stored in the Registry with an association to that application.

File types and their associations to specific applications are stored in the Registry during the installation of new software. An application's setup program registers the file extension of the file type and the commands that are applied to this type of file type. All this information is stored in the HKEY_CLASSES_ROOT branch of the Registry.

Each file type must have two entries in HKEY_CLASSES_ROOT. The first entry defines the file extension and a name (name_ID) for this file type. This name is then used in a second entry to define the commands for this file type. In other words, one entry describes its extension and the other contains its properties.

The structure is as follows:

HKEY_CLASSES_ROOT text = "name_ID" name_ID = <"Description"> shell verb =

command = command string

Structure and description for a .bat file type The .bat key defines the file extension (.bat) and the associated value name_ID. The associated value name_ID is set to string "batfile," which is the unique name identifier for the second key.

Although the BAT extension is registered by the inclusion of the .bat key, Windows 98 needs additional information about what to do with a BAT file, such as executable commands that enable the user to open the file by clicking it. This is handled by the second key, batfile. The Default value that contains the description "MS-DOS Batch File" defines this type of file. The description is what you see in Microsoft Explorer in the Type column and the Registered File Types list on the File Types property page of the Options dialog box. The EditFlags value enables and disables the edit options in the Edit File Type dialog box.

The DefaultIcon subkey contains the value for the path and file name that contains the associated icon. The shell subkey contains information that Windows 98 retrieves about actions associated with the .bat file type. The shellex subkey contains information about shell extensions that handle the .bat file type.

Registering a new file type lets you manipulate how you access and enable functions, applications, and so on.

The preferred methods to register a file type are listed below:

The File Types tab on the Options property sheet from Windows Explorer View menu.

Open With dialog box, which appears if you have selected a file that is unregistered.

You can also use the Registry Editor to register a file type. Be sure to make a backup copy of the Registry before you begin, and be sure to manage every component of the process correctly.

To register a file type with Registry Editor

1. Make sure you have a backup copy of the Registry.

2. Start the Registry Editor, and expand the HKEY_CLASSES_ROOT branch.

3. Add a new subkey with the name of the file extension in HKEY_CLASSES_ROOT (you must include the dot, as in .bat).

4. Set the Default value of this key to the name_ID (this is the name of the second key you need to define the properties).

5. Use the previously defined name_ID to add the second subkey in HKEY_CLASSES_ROOT.

6. Add the shell subkey, and expand this branch with the verbs for the required commands (Open, Print, etc.).

7. Add a command key to each verb key.

8. Add the command string (path and name of the executable) in the Default value.

9. Close the Registry Editor, and then test the registered file type in Windows Explorer.

Managing Initialization Files

Although the Registry replaces the basic function of the initialization files used in earlier versions of Windows, the System.ini, Win.ini, and Winfile.ini files still appear in the Windows directory. These files continue to be used for compatibility with earlier Windows-based applications and device drivers. For example, entries in Win.ini and System.ini created by Winl6-based applications are not updated in the Registry because such applications do not know how to access the Windows 98 Registry.

If you install Windows 98 as an upgrade over Windows 3.1, some .ini file settings are copied into the Registry, including settings from Control.ini, Program.ini, System.ini, and Win.ini.

Some .ini file entries are not moved to the Registry, but remain in the .ini file for compatibility with Winl6-based applications. Most of these entries can be changed without editing the .ini files by using the graphical tools provided with Windows 98. However, some .ini entries cannot be set using the Windows 98 user interface. These entries are required for some applications to function properly, but should not require manual modification by users.

Win.ini Settings in the Registry Windows 98 migrates settings from configuration files into the Registry during Setup. The following table shows where Win.ini entries migrated to the Registry.

Registry Paths for Migrated Win.ini Sections

Win.ini secffon Subkey in HKEY_CURRENT_USER

[desktop] \Control Panel\Desktop

[Windows] \Control Panel\Desktop



The following tables list entries retained in Win.ini for compatibility with applications written for earlier versions of Windows. These values can be set using Control Panel and other tools in the Windows 98 interface.

Entries in Win.ini Retained and Supported in the User Interface


CursorBlinkRate Device DoubleClickHeight DoubleClickWidth

DoubleClickSpeed KeyboardDelay KeyboardSpeed

MouseSpeed MouseTrails SwapMouseButtons


iCountry iCurrDigits iCurrency irate iDigits iLZero iMeasure

iNegCurr iTime iTLZero sl 159 s2359 sCountry sCurrency

sLanguage sDecimal sList sShortDate sLongDate sThousand sTime

[fonts]: font-name [ports]: portname [PrinterPorts]: device

Entries in Win.ini Retained but Not Supported in the User Interface

[embedding]: object [FontSubstitute]: font-name=font-name [Mail]: MAPI [mci extensions]: extension [Windows]: Load and Run

System.ini Settings in the Registry The following table lists System.ini entries that are migrated to the Registry when Windows 98 is installed in the same directory as a previous version of Windows 3.x.

Registry Paths for Migrated System.ini Entries

System.ini entry SuLkey in HKEY_LOCAL_MACHINE

[386Enh]: Network


System.ini entry Subkey in HKEY_LOCAL_MACHINE

System\CurrentControlSet\Services\VxD\Vnetsetup Software\CurrentControlSet\Services\VxD\transport entry

[network]: Comment System\CurrentControlSet\Services\VxD\Vnetsetup ComputerName System\CurrentControlSet\Control\ComputerName EnableSharing System\CurrentControlSet\Services\VxD\Vnetsetup LMAnnounce System\CurrentControlSet\Services\VxD\Vnetsetup

Registry Paths for Migrated System.ini Entries (continued)

System.ini entry SuLkey in HKEY_LOCAL_MACHINE (continued)

[network]: (continued) LogonDomain

Lo g on V alidated







System\CurrentControlSet\Services\VxD\Vnetsetup System\CurrentControlSet\Network\LanMan\sharename



I The equivalent of the Reconnect settings is stored in HKEY_CURRENT_USER\Persistent.

The following tables list entries that are retained in System.ini for compatibility with applications written for earlier versions of Windows.

System.ini Entries Retained and Supported in the User Interface


AllEMSLocked Keyboard MaxPagingFileSize AllXMS Locked KeyPasteCRS kipCount MinUs erDi skS p ace AltKeyDelay KeyPasteKeyDelay Mouse AltPasteDelay PasteSkipCount Paging DMABufferSize KeyPasteTimeout PagingDrive Display MaxDMAPGAddress ScrollFrequency DOSPromptExitInstructions


display.drv mouse.drv sound.drv keyboard.drv network.drv



Entries in System.ini Retained but Not Supported in the User Interface


De v i c e=p le na me KeybdPasswd Local

Local Reboot MessageBackColor MessageTextColor

NetAsyncTimeout NetAsynchFallback NetDMASize


386grabber=plename comm.drv=filename drivers=plename fixedfon.fon=plename

fonts.fon=plename language . dll= library-name oemfonts.font=filename

shell=plename system.drv=filename TaskMan .Exe=filename

Entries in System.ini Retained but Not Supported in the User Interface (continued) [drivers]: alias=driver-filname

1372 Microsoft Windows 98 Resource Kit Understanding the Registry Structure

This section describes the hierarchical organization of the Registry and defines the overall structure of keys and value entries.

The primary building blocks for the Registry are keys, values, and data. The database for the Registry is organized into a hierarchical structure. It is first organized into keys, and each key contains one or more keys or one or more


Key 1 Key 1 val ue Key 2 val ue Key 3 Key 4

Key 2 Key 3

val ue

The Registry Editor displays the contents of the Registry database in six root keys. The hierarchical structure that appears in Registry Editor is similar to how Windows Explorer displays hierarchical directory structures. Each of the root key names begins with."HKEY_" to indicate that the key is a unique identifier, called a handle.

The HKEYs contain one or more subkeys, and each of the subkeys may contain subkeys. Key and subkey names can contain visible characters, including spaces, underscores, letters, and symbols, but cannot contain backslashes (\). The keys are case-aware, but are not case-sensitive, meaning the keys will recognize upper and lower case, but not require them.

A key's data is contained in the value. The data can be in the form of text, binary, or DWORD.





Variable length null-terminated set of characters Variable length of hexadecimal digits DWORD Single 32-bit value that appears as an 8-digit hexadecimal number (DWORD stands for double word value)

The actual contents or location of a specific Registry subkey may differ from what is described here, depending on the services and software installed. However, this description of the general organization will help you understand how to navigate the Registry.

Chapter33 Windows98 Registry 1373

The Windows 98 Registry structure represents database information specific to the computer and to individual users. The computer-specific information includes setting for hardware and software installed on the computer. The user- specific information includes settings in user profiles, such as desktop settings, preferences for certain software, and personal printer and network settings.

In Windows 98, data is written to the Registry when a push occurs-that is, after changed data has aged more than a few seconds, or when an application intentionally flushes the data to the hard disk.

Figure 33.3 shows the Registry subtrees.

The following briefly describes the Registry root keys. Root keys are described in greater detail in "Working with Registry Keys" later in this chapter.

HKEY_LOCAL_MACHINE This key contains computer-specific information about the type of hardware installed and software settings. This information is used for all users who log on to this system. HKEY_LOCAL_MACHINE has several subkeys, described later in this chapter.

HKEY_CURRENT_CONFIG This key handles Plug and Play and contains information about the current configuration of a multiple hardware configuration computer (for example, settings for a docking station). It is also a pointer of one of the configuration keys of HKEY_LOCAL_MACHINE\Config-the configuration key (000x for example, 000X) that contains information about the current configuration of hardware attached to the computer.

HKEY_DYN_DATA Dynamic data (data stored in RAM on the system) is contained in this key. This information may change as devices are added to or removed from the computer. The information for each device includes the related hardware key and the device's current status, including problems. The Device Manager uses this data to show the current hardware configuration, and this data is used to constantly update the System Monitor.

HKEY_CLASSES_ROOT This key points to HKEY_LOCAL_MACHINE\Software\Classes, which describes certain software settings. This key displays essential information about OLE and association mappings to support drag-and-drop operations, Windows 98 shortcuts (which are OLE links), and core aspects of the Windows 98 user interface.

HKEY_USERS This key contains information about all the users who log on to the computer, including both generic and user-specific information. The generic settings are available to all users who log on to the computer. The information is made up of default settings for applications, desktop configurations, and so on. This key contains subkeys for each user that logs on to this computer.

HKEY_CURRENT.USER This key points to a branch of HnKEY_USERS for the user who is currently logged on.

Interpreting Value Entries in the Registry Keys

Registry Editor displays data in two panes. The value entries in the right pane are associated with the selected key in the left pane.

A value entry has three parts: the data type of the value (which appears as an icon), the name of the value, and the value itself. A value's data cannot be larger than 1 6K. The limit to total Registry size depends on available hard disk space and available memory.

The following table lists the data types currently used by the system.

Data type WrkooOS.eps


Binary data. Most hardware component information is stored as binary data, and can be displayed in Registry Editor in binary or hexadecimal format. For example, Regoot Flab: OxOO OOOOOO.

WrkooO6.eps A sequence of characters representing human-readable text. For example, BitsPerPixel: "X".

Analyzing the Registry Files

The Registry is logically one data store, but physically it consists of two different files to allow maximum flexibility for network configurations:


User-specific information is contained in User.dat. The information in this file is reflected in user profiles.

Hardware-specific and computer-specific settings are contained in System.dat. This information is reflected in hardware profiles and in the settings displayed in Device Manager.

By default, User.dat and System.dat are stored in the Windows folder, but these two files can be located in physically different locations. For example, if user profiles are enabled, System.dat can be stored on the local hard disk and User.dat stored in each user's logon directory (%WinDir%\Profiles\user_name, allowing "roving" users to maintain the same desktop preferences wherever they log on to the network.

For information about how Windows 98 chooses between local and network versions of User.dat when loading a user profile, and how system policies can override settings in .dat files to enforce user-specific and computer-specific information, see Chapter 8, "System Policies."

Working with the Registry Keys

Each branch of the Registry contains information that logically belongs together. Each root key reflects a different aspect of the configuration data (that is, the user data and machine-dependent settings). Each of the root key names begins with "HKEY_", which stands for Key Handle.

The Registry contains keys with values that can change depending on the user and the system. It would be impossible to describe all Registry settings, but what follows is a general description of the Registry root keys and some of the more significant subkeys.


This branch of the Registry is stored in the System.dat file. This key contains all data used for backwards compatibility with Windows 3.x OLE and DDE support. It also contains all the names of registered file types and their properties (icons and commands), and information about Quick Viewers, property sheet handlers, copy hook handlers, and other ActiveX components. An application's setup program registers the file extension of the file type and the commands that are ~nnlier1 to this file tvue in subkeYs of HKEY_CLASSES_ROOT.

The file name extension subkeys pertain to the file extensions. For each of those subkeys, a second file type (batfile, exefile, and so on) exists. Most of these subkeys are identified by a leading period, followed usually by three characters of a file name extension, such as .bmp. Windows 98 begins a search for any file type by looking in this Registry key for a subkey name that matches the file extension.

The CLSID (Class Identifier) subkey contains ActiveX object properties. This 16-byte value corresponds to a specific ActiveX module. The default value of the subkey is usually a description of the ActiveX class, such as General Property Page Object and identifies the object associated with that CLSID number.

The asterisk (*) subkey signifies a file extension wild card. The information found here applies to all files regardless of their extensions. You can specify shell extensions, such as context menu items, that apply to all applications with this subkey.

This key also contains a type of action that can be performed on an object, such as print, open, or edit. This is called a verb in the Registry. For example, the Shell subkey of HKEY_CLASSES_ROOT contains subkeys that define the actions edit, open, or print, all of which can be performed on a .bat file type. If you right- click a .bat file in Windows Explorer, you find the commands Edit, Open, and Print on the context menu. Also, double-clicking a .bat file in Windows Explorer invokes the open verb.

HKEY_CLASSES_ROOT is a pointer of HKEY_LOCAL_MACHINE\Software\Classes subkey, meaning that HKEY_CLASSES_ROOT points to all the subkeys in HKEY_LOCAL_MACHINE\Software\Classes.

For more information on the Classes keys, see "HKEY_CLASSES_ROOT" earlier in this chapter.

The Classes subkey contains two types of subkeys:

File name-extension subkeys, which specify the class-definition associated with files that have the selected extension.

Class-definition keys, which specify the shell and OLE properties of a class (or type) of document. If an application supports Dynamic Data Exchange (DDE), the Shell subkey can contain Open and Print subkeys that define DDE commands for opening and printing files, similar to the OLE and DDE information stored in the Registry under earlier versions of Windows. In the following illustration, c:\windows\notepad.exe % l is the open command, and the % l parameter stands for the selected file name in Windows Explorer when the command is carried out.

Note It is sometimes necessary to put quotation marks around the %1, such as "%1", for long file names. This is needed for some programs to work with long file names. For example, with Registry Editor, if quotes are not place around the file name, you cannot open a .reg file that contains a space in the name, such as NAME WITH A SPACE.REG.



HKEY_CURRENT_USER contains the configuration information of the user profile for the currently logged on user. A user profile ensures that the user interface and operation of Windows 98 will be the same on any computer where that user logs on, if that person's profile is available at that computer.

HKEY USERS contains the profile configuration information for a default user and the user defined with a user profile that is currently logged on. HKEY CURRENT USERS points to either the default user or the user that is currently logged on.

HKEY_CURRENT_USER contains all the information necessary to set up a particular user environment on the computer, such as application preferences, screen polors, and security access permissions. Many of these settings are the same kind of information that was stored in Win.ini under Windows 3.x. HKEY_CURRENT_USER has several subkeys, some of which are described in the following table.




AppEvents Contains subkeys holding the path and file name of the system sound files that play when specific system events occur. The EventLabels subkey contains the labels for sounds. The Schemes subkey contains the wave file for the sounds. Control Panel Contains subkeys for Control Panel settings, including information stored in Win.ini and Control.ini under Windows 3.x. InstallLocationsMRU Contains the locations that applications were most recently installed from (MRU stands for "most recently used"). Keyboard layout Contains subkeys that contain values defining the current active keyboard layout, which should be set by using the Keyboard option in Control Panel. Network Contains subkeys describing persistent and recent network connections. RemoteAccess Contains address and profile subkeys for remote network acces' Software Subkeys describing the current user's software settings and containing application-specific information stored in Win.ini or private initialization files under Windows 3.x.


HKEY_LOCAL_MACHINE contains the configuration data for the local computer. The information in this database is used by applications, device drivers, and Windows 98 to determine configuration data for the local computer, regardless of which user is logged on and what software is in use. The configuration data in this key is stored in System.dat file.

Hardware devices can place information in the Registry automatically using the Plug and Play interface. Software for installing device drivers can place information in the Registry by writing to standard APIs. Users can place information about hardware in the Registry by using the Add New Hardware option and other options in Control Panel, or by using Device Manager, as described in Chapter 26, "Device Management."

HKEY_LOCAL_MACHINE contains several subkeys, as listed briefly in the following table. The rest of this section provides details about some of these keys.

Subkey name Contents








A subkey of Config is mapped to HKEY_CURRENT_CONFIG as the current configuration. A collection of hardware configuration profiles for the local computer. The profiles are found on the Hardware Profiles tab in the System option from the Control Panel.

Information about hardware devices connected to the system.

Contains information about serial ports and modems used with the HyperTerminal program.

Network information created when a user logs on to a networked computer, including the user name, primary network provider, whether the logon was validated by a server, and information about the system policies processor.

Information about the network security access, provider, and remote administration capabilities.

The computer-specific information about software installed on the local computer, along with miscellaneous configuration data.

The database that controls system startup, device driver loading, Windows 98 services, and operating system behavior

Config Subtree in HKEY_LOCAL_MACHINE

A subkey of Config is mapped to HKEY_CURRENT_CONFIG as the current configuration. HKEY_LOCAL_MACHINE\Config contains information about alternate hardware configurations for the computer. For example, it can contain information about multiple configurations to be used when the computer is connected to a network, when it is uncocked from a docking station, and so on. Each alternate configuration is assigned a unique identifier, and this configuration ID has a subkey under the Config key. Each configuration appears in the list of hardware profiles in the System option in Control Panel.




When Windows 98 checks the hardware configuration at system startup, one of three things occurs:

In most situations, the configuration ID is mapped to a unique configuration and Windows 98 selects the appropriate one automatically, and the settings for the related Config subkey are used for system configuration.

If the user is starting the computer for the first time with new hardware components, Windows 98 creates a new configuration for the new configuration ID, and a new Config subkey is added to the Registry.

If the configuration ID is mapped to more than one configuration (for example, because Windows 98 cannot distinguish between two configurations), the user is prompted to choose which configuration to use.


Windows 98 bus enumerators are responsible for building the hardware tree. This includes assigning an identification code to each device on its bus and retrieving the device's configuration information, either directly from the device or from the Registry. For more information about the hardware tree and bus enumerators, see Chapter 30, "Windows 98 Architecture."

Bus enumeration information is stored in the HKEY_LOCAL_MACHINE\Enum subtree. For all types of devices, subkeys contain information such as device type, assigned drive letter, hardware ID, and device manufacturer, plus driver-related information for network components.

Information about the following types of devices are stored in these subkeys:


Device enumeration







Fixed disk devices

Floppy disk devices Plug and Play devices on an ISA bus

Monitor devices

Network protocol, server, and bindings Legacy devices

Software Subtree in HKEY_LOCAL_MACHINE

The HKEY_LOCAL_MACHINE\Software subtree contains configuration information about all installed software that has written its configuration information in the Registry. The entries in this key apply for anyone using this particular computer, and include definitions for file associations and OLE information.

The software subkey contains, for example, the information you add when registering an application to use a specific file name extension and information added during installation of Windows-based applications.

The HKEY_LOCAL_MACHINE\Software subtree contains several subkeys, including the Classes subkey, plus description subkeys for all installed software that has registered itself in the Registry, as described in the following sections.

Classes Subkey The HKEY_LOCAL_MACHINE\Software\Classes subkey defines types of documents and provides information about OLE and file name-extension associations that can be used by applications. HKEY_CLASSES_ROOT is an alias for this subkey.

HKEY_CLASSES_ROOT is a pointer to HKEY_LOCAL_MACHINE \Software\Classes. The sole purpose for HKEY_CLASSES_ROOT is to provide compatibility with the Windows 3.x registration database.

Description Subkeys The various subkeys of HKEY_LOCAL_MACHINE\Software\Descaption contain the names and version numbers of the software installed on the local computer (if that software writes information to the Registry as part of its installation process). User-specific information about the configuration of an application is stored at the same relative path under HKEY_CURRENT_USER.

Important The information in each subkey is added by the related application. Do not edit entries in these subkeys unless directed to do so by your application vendor.

During installation, applications record this information in the following form:


The key named HKEY_LOCAL_MACHINE\Software\Microsoft and its subkey named Windows\CurrentVersion are of particular interest. These subkeys contain information about software that supports services built into Windows 98.

The Setup subkey under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows \CurrentVersion is used internally by Windows 98 for its Setup program.

System Subtree in HKEY_LOCAL_MACHINE

The data in HKEY_LOCAL_MACHINE\System is organized into control sets that contain a complete set of parameters for device drivers and services that can be loaded with Windows 98.

All data that controls startup is described in the CurrentControlSet subtree under HKEY_LOCAL_MACHINE\System. This control set has two parts:

The Control key contains information used to control system startup, including the computer's network name and the subsystems to start.

The Services key contains information to control the loading and configuration of drivers, file systems, and so on. The data in the Services key also controls how these services call each other.

Control Subkey The Control subkey contains startup parameters for the system, including settings for startup and shutdown, file system performance, keyboard layouts and language support, and so on. The following table describes some typical subkeys.



ComputerName The computer name, which should be set using the Network option in Control Panel FileSystem The type and settings of the file system IDConfigDB The identification for the current configuration Keyboard layouts A list of the DLLs for the keyboard language, which should be set using the Keyboard option in Control Panel Resources Descriptions and driver information for multimedia components



NetworkProvider Descriptions of the network providers Nls Information on national language support, including language and locale preferences, which should be set using the Keyboard option in Control Panel PerfStats Statistics gathered from system components that can be viewed using System Monitor Print Information about the current printers and printing environment, contained in several subkeys:

Environments, which contains subkeys defining drivers and print processors for operating system environments Monitors, which can contain suLkeys with data for specific network printing monitors Printers, which can contain subkeys describing printer parameters for each installed printer - Providers, which can contain subkeys describing DLLs for network print services

SessionManager Global variables that are maintained by the operating system, plus subkeys that list applications that do not run well under Windows 98, DLLs whose version numbers should be checked, and directories and file names for all the Session Manager DLLs TimeZoneInformation Values for time zone settings, which should be set using the Date/Time option in Control Panel Update Value indicating whether Windows 98 was installed over an earlier version of Windows VMM32 The file names of VxD files combined into the Vmm32.vxd virtual device driver

Services Subkey for CurrentControlSet The Services subkey in CurrentControlSet lists the Kernel device drivers, file system drivers, and Windows 98 service drivers that can be loaded at startup. The Services subkey also contains subkeys with static descriptions of hardware to which drivers can be attached. The following table shows some typical Services subkeys.




Agent_name Subkeys for each installed system agent, such as Microsoft Network Monitor, SNMP, or network backup agents

Arbitrators Subkeys for arbitrators required to manage resources between competing devices, usually including address, DMA, I/O, and IRQ arbitrators Subkeys for all classes of devices the operating system supports, such as disk drives, keyboard, display, mouse, and so on Contents


MSNP32, Subkeys for 32-bit, protected-mode network providers, including logon and NWNP32 secunty provider information

VxD Subkeys for all virtual device drivers, including disk drivers, network components, disk caches, and so on

Caution Do not change these value entries using Registry Editor. These settings should be maintained only by the system. Settings for drivers that appear under the Services subkeys can be changed by using Control Panel or system policies.


HKEY_USERS contains all current user information (the.Default subkey), plus all previously loaded user profiles for users who have logged on in the past. The information in the .Default subkey is used to create the user profile for a user who logs on without a user profile. The .Default subkey contains keys for Appl~vents, Control Panel, Keyboard layouts, Network, RunMRU, and Software, among others.

If the HKEY_USERS key shows a.Default subkey only, then HKEY_ CURRENT .USER points to that key in HKEY_USERS. If a second key with a user name exists, then HKEY_CURRENT_USER points to that second key.

Whenever similar data exists in HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER, the data in HKEY_CURRENT_USER takes precedence. For example, settings for applications and the desktop defined by the current user take precedence over default settings.

The .Default subkey is used to create a user profile for users who log on to a computer that does not already have a user profile for that user. This subkey


This branch of the Registry is stored in the System.dat file. The HKEY_ CURRENT_CONFIG key points to the current system configuration in the collection of configurations stored in HKEY_LOCAL_MACHINE \Config\OOOx, which contains the current hardware configuration. The number x refers to the configuration number. For example, if you have a docked and an uncocked mode for your laptop computer, you would have a subkey for each configuration: 0001 and 0002.

The Display subkey specifies screen fonts and screen settings, such as resolution. The Enum subkey contains subkeys that specify Plug and Play BIOS and the System subkey contains subkeys that list available printers.


Some configuration information in Windows 98 must be stored in RAM because it requires fast modification and retrieval that cannot wait for the Registry to flush to the hard disk. All this data can be found under HKEY_DYN_DATA. This information under this key is newly created every time Windows 98 starts.

The Config Manager subkey, sometimes referred to as the hardware tree, is a record in RAM of the current system configuration. The information is drawn from the devices currently installed and loaded, or that failed loading. The hardware tree is created every time the system starts and updates whenever a change occurs to the system configuration. The information that appears in Registry Editor is provided when this key is displayed, so it is never out of date.

HKEY_DYN_DATA also contains statistics gathered for various network components currently in use on the system. These reside under HKEY_DYN DATA\PerfStats.


VxDs from other vendors can provide dynamic data to this area too. For more information, see the Win32 Software Development Kit for Windows 98 and Windows NT.

Plug and Play and the Registry

Plug and Play is both a design approach and a set of personal computer architecture specifications with the goal of making the personal computer, add-in hardware devices, drivers, and the operating system work together automatically without user intervention. In order to achieve this goal, all the components must be Plug and Play. The components of a Plug and Play system include:


A Plug and Play operating system

A Plug and Play Basic Input Output System (BIOS) Plug and Play hardware devices with drivers

Depending on whether any of these components are Plug and Play or not, the level of ease-of-use and dynamic operation varies. At the lowest level, where all three components are legacy, or not Plug and Play, the system lacks any dynamic operation and is difficult to use because card jumpers and switches need to be manually set and drivers manually loaded.

At the next level, when a Plug and Play operating system (such as Windows 98) is used with legacy hardware, the system supports dynamic operation of PCMCIA devices and is relatively easy to use.

Hardware setup is made simple by the Device Wizard (which helps to detect, identify, and configure devices), consistent user interface of device property sheets, and availability of device information through the Registry and Device Manager. Additional ease of use is achieved due to automatic loading of drivers using the Device Installer, and due to smart software that reacts to configuration changes to give dynamic hardware event messages.

At the highest level, where all three components are Plug and Play, installing new devices is as easy as plugging them in and turning on the computer. Hardware setup is completely silent and transparent, and you do not need to modify expansion card jumper settings, or even modify operating system configuration files. Also, due to the Plug and Play BIOS, the system supports full dynamic operation, including hot docking, APM 1.1 power management, automatic configuration of boot devices, and programming of motherboard devices.

The Registry is the backbone for Plug and Play (PnP) specifications. It contains hardware-specific information so that when a user plugs a new piece of hardware into the computer, Windows 98 automatically configures the hardware device, or helps the user set it up with a Setup Wizard.

Windows 98 uses the device ID to search the .INF files for that device. It then creates an entry in the HKEY_LOCAL_MACHINE key and copies information from the .inf file into the key. Enum keys refer to the Windows 98 enumeration process that checks the hardware device. HKEY_CURRENT_CONFIG subkey Enum contains various subkeys (BIOS, Root, etc.) that specify PnP BIOS or other elements. HKEY_DYN_DATA Enum subkey contains EISA: ISA Plug and Play bus. HKEY DYN_DATA\ConfigManager\Enum defines the allocation of the resource, problems with the device, and configuration information.

The HKEY_LOCAL_MACHINE\Enum key contains subkeys for the specific hardware components used by the computer. Windows 98 uses this information to allocate resources, such as IO addresses and interrupts, for the devices. All values in the \Enum branch are vendor- and device-specific, so specific information can vary from machine to machine. The following list briefly describes entries in the \Enum subkey.

BIOS This subkey contains entries for PnP components of the BIOS (which includes timers, controllers, and DMA chips). Each BIOS subLey starts with the string *PNP and is followed by a four-digit number that represents classes by which the components are grouped: *PNP0000. Each *PNPxxxx key contains subkeys (00, 01) that contain the data (such as class name, device description string, driver name, and hardware ID) for the device configuration. See Table 33.4 for more details.

ESDI This subkey contains the configuration data of the IDE-controller used for hard disk drives and other devices.

FLOP This subkey contains the conf~guration data of the floppy disk controllers used in the system.

HTREE This subkey is reserved for future use for Windows.

ISAPNP This subkey contains entries for PnP equipment enumerated on the ISA bus.

MF This subkey defines manufacturer-specific information about hardware components.

Monitor This subkey contains information about the monitor used in the system. If setup cannot detect the monitor type, the selection is set by the user.

Network This subkey contains information about the network (for example, redirectors, services, and NetBEUI). The network adapter is specified in the Root\Net subkey.

PCI This subkey contains entries for PnP equipment on a PCI bus.

Root This subkey contains *PNPxxxx entries for legacy, non-plug-and-play hardware, (such as the CPU, BIOS, network adapters, and printer drivers).

SCSI This subkey contains the configuration data of the SCSI controllers used in the system.

Table 33.4 \Enum\BIOS Values for PnP Components

Value Description

PNP0000-PNP0004 PNP0100-PNP0102 PNP0200-PNP0202 PNP0300-PNP0313 PNP0400-PNP0401 PNP0500-PNP0501 PNP0600-PNP0602 PNP0700 PNP0800 PNP0900-PNP0915 PNP0930-PNP0931 PNP0940-PNP0941 PNPOAOO-PNPOA04 PNPOBOO PNPOC01

Interrupt controllers System timers DMA controllers Keyboard controllers Printer ports Communication ports Hard disk controllers Standard floppy disk controller System speaker Display adapters

Expansion buses CMOS real-time clock System board extension for PnP BIOS

Table 33.5 \Enum\BIOS Values for PnP Components (continue])

Value Description




PNP8xxx PNPA030



Numeric data processor PCMCIA controllers

Serial Microsoft mouse

Mouse ports Network adapters Mitsurni CD-ROM controller

Miscellaneous adapters

PnP codes are grouped in classes according to their four-digit code. You can view and modify the device configuration used on your computer with Device Manager, which is located under the Systems option in the Control Panel.

Detection and enumeration are the two processes that Windows 98 uses to configure devices. Detection is the process Windows 98 uses during its search for legacy or non-Plug and Play devices on a computer. Detection is used during Windows 98 Setup and any time you use the Add New Hardware Wizard to search for new hardware installed in your computer. Detection does not run each time you start Windows 98. During the detection process, Windows 98 creates a log file called Detlog.txt in the root directory of the boot drive. This file is commonly referenced when troubleshooting problems with hardware detection.

Enumeration is the process Windows 98 uses to identify Plug and Play devices in your computer, including those devices on Plug and Play buses, such as ISAPNP, PCI, and PC Card (PCMCIA) devices. Enumeration occurs each time Windows 98 starts and whenever Windows 98 receives notification that a change has occurred in the computer's hardware configuration, such as when you remove a PC Card.

View Preferences and the Registry

This section describes how Windows 98 stores View preferences for the desktop and windows that you open. View preferences include icon size, position, layout.

Windows 98 stores up to 28 entries containing View preferences for the desktop and windows that you open in a most-recently-used (MRU) list. When you close a window, the View preferences are written to subkeys with the names 0, 1, 2, and so on, located in the following Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion \Exp lo re r\S t ream s

The MRU List in the following Registry key defines the order of the 28 entries:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ Explorer\StreamMRU

When the desktop or one of the windows is no longer included in the MRU list, the desktop or window uses the default settings the next time the desktop or window is redrawn or refreshed.

When you make a change to the desktop or a window, the View preferences for the desktop or window are moved to the top of the MRU list. That item remains on the MRU list until it reaches the 28th spot. When an item reaches the 28th spot and another window is closed, the 28th item is removed from the MRU list.