|
Softpanorama |
May the source be with you, but remember the KISS principle ;-)
|
Registry is a pretty complex and convoluted database. In all versions of Windows, the registry can accumulate obsolete or redundant entries. In older versions of Windows like windows 95 it was a real problem and users suffered from registries containing huge numbers of redundant entries. This slowed computer operations; and could even lead to crashes. that means that tools to help to navigate registry, search it, backup/restore it and clean it should be part of the any Windows user toolbox. In best Unix (or DOS) traditions such tools should be available as command line utilities and Microsoft does provide such tools for free. They are just difficult to find :-). The right place to look are Reskits.
The set of Microsoft registry tools in Reskits are still in the state of flux. They have overlapping functionality and it is not very clear what is exact or even major function for each utility due to this overlap. I have impression that in writing those utilities left hand did not know what right hand was doing: in other words there was no coherent strategy to provide those tools. When some Microsoft programmer feel a need for such a tool he wrote it and the best of those were packaged in the Resource Kits.
Also versions of the same tool for different version of Windows sometimes differ considerably. For example, the reg utility is different in NT Reskit v.1.1, Win2K Reskit v.2.0 and Win XP Reskit v.3.0.
Note: Free Registry Tools can often serve as a replacement of Microsoft registry tools.
An interesting series of articles about Windows registry was authored by Darren Mar-Elia, see Recommended Articles section
|
|||||||
Command PromptIf you're a command-line junkie like me, you'll appreciate file name and directory completion. The MS-DOS command prompt supports both of these features, but you have to enable them first. Table 5-27 describes the settings in the Command Prompt category in Tweak UI. Set the value
CompletionCharto the keystroke you want to use for file name completion, and set the valuePathCompletionCharto the keystroke you want to use for directory completion. You can use the same keystroke for both values. The value you use for key is the ASCII key code. Thus, Tab is 0x09. The valueWordDelimitersis a string of characters that delimit words on the command line when you press Ctrl+Right Arrow or Ctrl+Left Arrow. Create these values if they don't exist.Table 5-27 Values in Command Prompt
Setting Name Type Data HKCU\Software\Microsoft\Command ProcessorFile name completionCompletionCharREG_DWORDkeyDirectory completionPathCompletionCharREG_DWORDkeyHKCU\ConsoleWord separatorsWordDelimitersREG_SZseparators
RegEditX makes your registry editing more productive than ever. RegEditX extends the standard Windows Registry Editor (REGEDIT), so you don't have to learn new ways of accomplishing tasks you already know how to perform. Just keep using the same familiar Registry Editor --- more efficiently.
Once you've tried RegEditX, you won't want to edit the registry any other way.
REGBack: Registry Backup - Registry Backup (RegBack) is a tool for backing up the Windows Registry to files without use of a tape drive. RegBack allows you to back up Registry hives while the system is running and has the hive files open.
REGFind: RegFind is a command-line tool with which you can search the Windows 2000 registry for arbitrary data, key names, or value names and optionally replace any of these with new values.
REGINI: Registry Change by Script - This tool uses character-based batch files to add keys to the Windows 2000 registry by specifying a registry script.
REGRest: Registry Restoration - Registry Restoration (RegRest) restores Registry hive files from backups created by RegBack.
Dureg: Registry Size Estimator - Shows how much data is stored in the registry, or in any registry subtree, key, or subkey.
Regdmp
Regdmp is a Resource Kit utility that works hand-in-hand with Regini. As its name implies, it is used to dump the contents of the Registry. It works similarly to the Regedit export feature and creates output that is compatible with Regini scripts. Regdmp uses the same subtree names as Regini to specify which Registry path you want to dump. Using Regdmp, you can create Regini input scripts based on actual Registry values. You can then modify the contents of Regdmp output to make any modifications you need to the Registry. Figure 10 shows an example of using Regdmp to export the contents of the HKEY_CURRENT_USER\Control Panel\Desktop key.
The command to generate this output and redirect it to a file is as follows:
regdmp "HKEY_CURRENT_USER\Control Panel\Desktop" desktop.ini
How to Maintain
Current Registry Backups in Windows NT 4.0 and Windows 2000
Microsoft Knowledge Base Article: 318149 - The solution that is described
in this article is not supported by Microsoft. Use this method at your own risk.
Registry Maintenance
Sample Chapter 2 from Osborne's Admin 911: Windows 2000 Registry.
If your registry becomes corrupt, confused, or misguided, it affects
the health of your computer and your software, and it hinders your ability to
get any work done. Sometimes a sick registry is the result of user action, caused
by somebody mucking around without the proper respect for the delicacy of the
registry. Just as often, registry problems occur as a result of software installation
procedures, hardware configuration, or general system configuration changes.
If you plan registry maintenance properly, and execute that plan regularly,
you can rescue your computer from the clutches of a registry that no longer
works properly. That's what this chapter is about.
Getting Rid of the Unwanted
Sample Chapter 8 from Mastering Windows 2000 Registry, published by Sybex,
Inc.
Reg.exe
Simple usage: REG operation <Parameter List> operation [ QUERY | ADD | UPDATE | DELETE | COPY | SAVE | BACKUP | RESTORE | LOAD | UNLOAD ]
For example: Reg add hkcu\software\testkey\testvalue=1 reg_dword \\testsr
Reg can access the whole of the registry and uses the codes HKCU, HKLM, HKCR, HKU and HKCC to refer to the various hives in the registry. Reg is not case-sensitive.
The Reg operations can be used with remote machines by adding the UNC name of the server to the end of the command line (see reg add /? for more help).
Reg can be found on the Resource Kit supplements. It provides much of the functionality of the previous utilities in a series of commands that are much like the Net command. One of the advantages of using Reg is that the syntax remains the same throughout the tool. It will also back up and restore the registry and provide the options to load and unload parts of the registry on the fly. However, Reg can't search the registry as Regfind can, and it has had its problems and revisions. For example, there was a problem with it not recognizing UNC machine names over 13 characters long, as it counted the two \\s as part of the name. It is advisable to download the latest version from supplements at ftp://ftp.microsoft.com/bussys/winnt/winnt-public/reskit/nt40/i386 as reg_x86.exe.
REG: This tool enables you to add, change, delete, search, backup, restore, and perform other operations on registry entries from the command prompt or a batch file. It can be used on both local and remote computers. Note: This version of REG is in fact version 1.10 from the NT4 Resource Kit. It works with Windows 2000 but is not the version 2 that comes with the 2000 Reskit and is very much updated and with differing syntax to version 1.10, nor is it the version 3 that comes bundled with Windows XP (Thanks Pete!)
REGBack: Registry Backup - Registry Backup (RegBack) is a tool for backing up the Windows Registry to files without use of a tape drive. RegBack allows you to back up Registry hives while the system is running and has the hive files open.
REGFind: RegFind is a command-line tool with which you can search the Windows 2000 registry for arbitrary data, key names, or value names and optionally replace any of these with new values.
Microsoft Windows XP Registry Guide by Jerry Honeycutt,
322756 - How to back up, edit, and restore the registry in Windows XP and Windows Server 2003 For a Microsoft Windows NT 4.0 version of this article, see 323170.
Important This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base
Alternative link:
How to back up, edit, and restore the registry in Windows XP and Windows Server 2003
Download the WinGuides.com Help Files
Windows Registry Guide 2003
Size: 1.4 MB
Platforms: Windows 95/98/ME/NT/2000/XP
Download now!
Windows XP Registry Backup 101
In this article we will cover the Windows XP Registry, its function importance and most importantly, how to apply a basic level of disaster prevention to your system in case a problem does occur. Backing up the Registry in Windows XP is simple, painless and can save you a headache when you need that backup.
Microsoft Windows 2000 Resource Kit: Registry Information -- several online books
This file provides detailed descriptions of Windows 2000 registry content, such as the subtrees, keys, subkeys, and entries that advanced users want to know about, including many entries that cannot be changed by using Windows 2000 tools or programming interfaces.
How to Restore the Registry Step-by-step instructions on how to restore the system registry.
Support Article: How To Use WinDiff to Compare Registry Files
How can you compare registry entries before and after an upgrade, the installation
of a new software package, or between two computers?
Registry Settings Management in Deployment The Registry Editor allows you to specify registry keys and values to be added to the registry of the target computer.
Windows 2000 Registry Repair Utility
Office 2000 SR-1/Windows 2000 Utility: Registry Repair The Office 2000 SR-1/Windows 2000 Registry Repair Utility restores the registry settings for several important files that may cause Office 2000 SR-1 applications to behave oddly on Windows 2000. SubInACL (SubInACL.exe) SubInACL is a command-line tool that enables administrators to obtain security information about files, registry keys, and services, and transfer this information from user to user, from local or global group to group, and from domain to domain.Disabled Registry Editing Tools Revisited
Sysinternals Freeware - Regmon
Monitoring and Troubleshooting the Registry by Darren Mar-Elia
Sample Chapter from Microsoft® Windows XP® Registry Guide by Jerry Honeycutt Mapping Tweak UI
Command PromptIf you're a command-line junkie like me, you'll appreciate file name and directory completion. The MS-DOS command prompt supports both of these features, but you have to enable them first. Table 5-27 describes the settings in the Command Prompt category in Tweak UI. Set the value
CompletionCharto the keystroke you want to use for file name completion, and set the valuePathCompletionCharto the keystroke you want to use for directory completion. You can use the same keystroke for both values. The value you use for key is the ASCII key code. Thus, Tab is 0x09. The valueWordDelimitersis a string of characters that delimit words on the command line when you press Ctrl+Right Arrow or Ctrl+Left Arrow. Create these values if they don't exist.Table 5-27 Values in Command Prompt
Setting Name Type Data HKCU\Software\Microsoft\Command ProcessorFile name completionCompletionCharREG_DWORDkeyDirectory completionPathCompletionCharREG_DWORDkeyHKCU\ConsoleWord separatorsWordDelimitersREG_SZseparators
Ch 10 -- Making Manual Changes to the Registry Using REGEDIT.EXE
Reg is a command-line tool called the Console Registry Tool for Windows. It allows you work with the Registry to query, change, add or delete, export and more. Reg tool is different in NT Reskit v.1.1, Win2K Reskit v.2.0 and Win XP Reskit v.3.0. Syntax:
REG Operation [Parameter List]
Operation [ QUERY | ADD | DELETE | COPY |SAVE | LOAD | UNLOAD | RESTORE |COMPARE | EXPORT | IMPORT ]
Return code except of REG COMPARE (see below): 0 - Succussful, 1 - Failed
For help on a specific operation type: REG Operation /? . Examples:
REG QUERY /?
REG ADD /?
REG DELETE /?
REG COPY /?
REG SAVE /?
REG RESTORE /?
REG LOAD /?
REG UNLOAD /?
REG COMPARE /?
REG EXPORT /?
REG IMPORT /?
The reg compare option replaces the CompReg utility that was available in NT 4.0’s Resource Kit and lets you compare the contents of keys or values on local and remote machines. See Darren Mar-Elia Monitoring and Troubleshooting the Registry for details:
Reg’s Compare Option
WinDiff is great if you want to compare dumps of two Registry trees. However, if you need to compare keys or values in real time against a running system’s Registry, you should familiarize yourself with the reg utility’s compare option. I first introduced reg in "Viewing and Manipulating the Registry," the third installment in this series. Reg is the Swiss Army knife of Registry tools. The reg compare option replaces the CompReg utility that was available in NT 4.0’s Resource Kit and lets you compare the contents of keys or values on local and remote machines.
As an example of how you can use reg’s compare option to compare two keys on the same machine, I compare the contents of HKEY_CURRENT_USER\Control Panel\Desktop and HKEY_USERSÊ\.Default\Control Panel\Desktop. The command syntax for such a comparison follows:
reg compare "HKU\.Default\Control Panel\Desktop" "HKCU\Control Panel\Desktop" /s /od
The /s option tells CompReg to check subkeys and values that exist under each key specified. The /od option instructs reg to show only the differences between the two keys. The output of the above command follows:< Value: HKEY_USERS\.Default\Control Panel\Desktop DragFullWindows REG_SZ 2 > Value: HKEY_CURRENT_USER\Control Panel\Desktop DragFullWindows REG_SZ 1 < Value: HKEY_USERS\.Default\Control Panel\Desktop PaintDesktopVersion REG_DWORD 0x0 > Value: HKEY_CURRENT_USER\Control Panel\Desktop PaintDesktopVersion REG_DWORD 0x1 < Value: HKEY_USERS\.Default\Control Panel\Desktop ScreenSaverIsSecure REG_SZ 0 > Value: HKEY_CURRENT_USER\Control Panel\Desktop ScreenSaverIsSecure REG_SZ 1 < Value: HKEY_USERS\.Default\Control Panel\Desktop ScreenSaveTimeOut REG_SZ 900 > Value: HKEY_CURRENT_USER\Control Panel\Desktop ScreenSaveTimeOut REG_SZ 600 < Value: HKEY_USERS\.Default\Control Panel\Desktop SCRNSAVE.EXE REG_SZ logon.scr > Value: HKEY_CURRENT_USER\Control Panel\Desktop SCRNSAVE.EXE REG_SZ C:\WINNT\System32\logon.scr < Value: HKEY_USERS\.Default\Control Panel\Desktop Wallpaper REG_SZ (None) > Value: HKEY_CURRENT_USER\Control Panel\Desktop Wallpaper REG_SZ \\n9990sfo \home\darren.marelia\My Pictures\pooky.bmp > Value: HKEY_CURRENT_USER\Control Panel\Desktop WallpaperStyle REG_SZ 0 < Value: HKEY_USERS\.Default\Control Panel\Desktop BorderWidth REG_SZ 1 > Value: HKEY_CURRENT_USER\Control Panel\Desktop BorderWidth REG_SZ -15 < Value: HKEY_USERS\.Default\Control Panel\Desktop IconSpacing REG_SZ 75 > Value: HKEY_CURRENT_USER\Control Panel\Desktop IconSpacing REG_SZ -1125 > Value: HKEY_CURRENT_USER\Control Panel\Desktop Shell Icon Size REG_SZ 32 Result Compared: DifferentAs you can see, the command I typed found a number of differences under the desktop key. The greater than and less than signs at the beginning of each line indicate to which key the line belongs. The next piece of data tells you the value name and what type of value it is (e.g., REG_SZ). Finally, the number or text at the end indicates the actual data within the value for each of the compared keys.
i386 Resource KitCommand Line Registry Tool REG.EXE REG.EXEThis commands queries, adds, updates, deletes, copys, saves, backups, restores, loads and unloads:
- QUERY option
Explain to determine the Service Pack on a local machine
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\CSDVersion"
Returns : REG_SZ CSDVersion Service Pack 5
To query on a remote machine just add to the end of the comand line the machine name such as:
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\CSDVersion" \\REMOTESERVER
- LOAD and UNLOAD
Loads a registry hive in and out of the registry
- SAVE and BACKUP
Both SAVE and BACKUP are identical.
For use for saving hives
- RESTORE
For use for restoring hives
This command-line tool writes all or part of the Windows 2000 registry to the standard output (STDOUT). This output is displayed on the screen by default, but can also be redirected to a file. The output format is suitable for input to Regini.exe, another Windows 2000 Resource Kit tool.
RegDmp provides the following general information:
The tool also provides the following Group Policy information:
To access some parts of the registry, you must be a member of the Administrators group.
File Required Regdmp.exe. Command line options:
regdmp [{-m \\ComputerName | -h HiveFile HiveRoot | -w Directory}] [-i n] [-o OutputWidth] [-s] [RegistryPath]
Where:
Examples:
C:\>regdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run"
Regdmp
Regdmp is a Resource Kit utility that works hand-in-hand with Regini. As its name implies, it is used to dump the contents of the Registry. It works similarly to the Regedit export feature and creates output that is compatible with Regini scripts. Regdmp uses the same subtree names as Regini to specify which Registry path you want to dump. Using Regdmp, you can create Regini input scripts based on actual Registry values. You can then modify the contents of Regdmp output to make any modifications you need to the Registry. Figure 10 shows an example of using Regdmp to export the contents of the HKEY_CURRENT_USER\Control Panel\Desktop key.
The command to generate this output and redirect it to a file is as follows:
regdmp "HKEY_CURRENT_USER\Control Panel\Desktop" >desktop.ini
If scripts are your favorite tools for configuration and setup tasks, you can use regini.exe to apply your scripting skills to registry edits. Regini provides more power than .reg files can muster, including the ability to delete subkeys and data items and to set permissions on registry keys. You can find Regini in the Microsoft Windows 2000 Server Resource Kit and the Microsoft Windows NT Server 4.0 Resource Kit. (I've successfully used the Win2K version of regini.exe on NT machines, and vice versa.)
The resource kits also contain full documentation (i.e., regini.doc) for this nifty utility. Regini uses the following syntax:
regini <ScriptFileName>
where ScriptFileName is the path to a script file you've written to perform a specific registry edit. You can use Uniform Naming Convention (UNC) in the path statement if the script is on a network share.
To distribute registry changes that use Regini, you must make the program available to each target computer (assuming that you haven't installed the resource kits across your enterprise). You can use a batch file to map Regini's UNC path and then run the program. For example, if Regini resides on a network share named ResKit on a server named Tools1, you can create the following batch file:
Net use x: \\tools1\reskit
x:\ regini <ScriptFileName>
Net use x: /deleteScript File Guidelines
The script file you use with Regini can have any name and extension you want. The file must be in ANSI format; regini.exe converts the file to Unicode when it reads the file, but you can't use a Unicode text file as the script file. (Microsoft should fix this limitation.) Registry commands in this script file must use the following syntax:
\Registry\<KeyPath> [<ACL>]
<DataItemName> = <DataType> <DataValue>The presence of an equal sign in a line indicates that the line contains a registry data item and a value that you're adding, deleting, or modifying.
Lines in the script must have a carriage return at the end. If a line wraps, which usually happens when the registry key is deeply nested and therefore very long, the continuation symbol is a backslash. So, if you enter
Something\
Morestuff\
Evenmoreregini.exe reads the line as SomethingMorestuff Evenmore. Note that the space before the backslash on the second line inserts a space between Morestuff and Evenmore. If no space is required (i.e., if the point at which the wrapping occurs isn't a natural space such as the space within the name of a subkey), omit the space before the backslash.
The first line of each registry command contains the KeyPath variable, which is the full path to the key you're manipulating. If the key doesn't exist in the registry when you run the script, the command will add it. Regini.exe uses the kernel naming conventions for registry subtrees, and you can either enter kernel names in your script or use standard subtree names and let regini.exe translate them. (The kernel conventions are easier to type.) The kernel naming conventions for subtrees are as follows:
HKEY_LOCAL_MACHINE is \Registry\Machine HKEY_USERS is \Registry\User HKEY_CURRENT_USER is \Registry\User\User_SID The first line can also contain an optional ACL variable. You can include this variable to manipulate ACL permissions instead of, or in addition to, keys and data items. The ACL data comes after the KeyPath variable and consists of a series of numbers separated by spaces and enclosed within square brackets. (Table 2 lists these numbers and their meanings.) For example, the following command:
\Registry\machine\system\currentcontrolset [1 11 17]
assigns Administrators Full Access, Power Users Full Access, and System Full Access permissions to the HKEY_LOCAL_MACHINE \SYSTEM \CurrentControlSet registry subkey.
Table 2 ACL Number Definitions
Number Permissions for the Target Registry Key 1
Administrators Full Access
2
Administrators Read Access
3
Administrators Read and Write Access
4
Administrators Read, Write, and Delete Access
5
Creator Full Access
6
Creator Read and Write Access
7
World Full Access
8
World Read Access
9
World Read and Write Access
10
World Read, Write, and Delete Access
11
Power Users Full Access
12
Power Users Read and Write Access
13
Power Users Read, Write, and Delete Access
14
System Operators Full Access
15
System Operators Read and Write Access
16
System Operators Read, Write, and Delete Access
17
System Full Access
18
System Read and Write Access
19
System Read Access
20
Administrators Read, Write, and Execute Access
21
Interactive User Full Access
22
Interactive User Read and Write Access
23
Interactive User Read, Write, and Delete Access
Watch out: This feature is dangerous if you don't understand the way it works. When you use this feature, you aren't adding the ACL permissions that you enclose within the brackets—you're resetting the ACLs. The data within the brackets replaces any existing data. Don't use this feature unless you first check the existing ACL for the key you're manipulating. (You can use regedt32 to view the ACL.) Otherwise, you might accidentally eliminate or modify permissions for a group.
The second line contains the information for the data item you're manipulating: DataItemName is the name of the data item and consists of every character from the first nonblank character on the line to the last nonblank character before the equal sign. You don't need to use a special format (e.g., enclosing the name in quotation marks) to handle data items with spaces. If the data item doesn't exist in the registry when you run the script, the command will add it.
DataType is the data type for the data item. Regini recognizes the text to the right of the equal sign, up to the first space, as the data type.
DataValue represents the value you're applying to the data item. This value begins with the first nonblank character following the space after the data type and continues to the end of the line. You don't need to use any special handling to specify spaces within a value.
Regini.exe expects the data type and its accompanying value in your script to match certain standards. These standards are as follows:
REG_SZ or REG_EXPAND_SZ for string values. REG_MULTI_SZ for multiple strings. You must surround each string with quotation marks. REG_DWORD for decimal or hex values. For REG_DWORD data items, the default value is decimal. Use 0x to specify a hex value. If you enter the value On, True, or Yes, the value is converted to 0x00000001; if you enter the value No, False, or Off, the value is converted to 0x00000000. REG_BINARY for binary values formatted as two or more decimal numbers. The first decimal number specifies the number of bytes of data that follow. The remaining numbers are converted into 32-bit numbers. (The value length must always be a multiple of 4 bytes.) Regini Features
Regini gives you several options for data manipulation. For example, DELETE is a regini.exe keyword that requires only the name of the data item. To remove a data item, enter the following syntax as the second (i.e., data item) line of your script:
DataItemName = DELETE
Regini.exe also has a neat feature that lets you point to a text file that contains the value for a data item. This feature eliminates the need to directly enter long binary values (for REG_BINARY data items) or many multiple strings (for REG_ MULTI_SZ data items). During execution, regini.exe opens the target file and writes its contents to the registry as the value for the data item. To use this feature, replace the item type with an instruction to use a file. The instruction includes a reference to the item type and uses the following syntax options:
For REG_BINARY data items: DataItemName = REG_BINARYFILE FilePath For REG_MULTI_SZ data items: DataItemName = REG_MULTISZFILE FilePath For example, if you enter the following script:
UserNicknamesForCompanyNewsletter = REG_MULTISZFILE \myscripts\script101.txt
Regini reads the content of the file named script101.txt and writes the contents as the value of the data item UserNicknamesForCompanyNewsletter. (I made up that data item for this example, so don't look for it in your registry.)
Putting It All Together
As an example of a complete command, review the following script. This command changes computer settings so that the most recent user's name doesn't appear in the Logon dialog box.
\registry\machine\software\micro
soft\windows\currentversionpolicies\system
DontDisplayLastUserName = REG_DWORD 1To make additional changes in the same subkey, you need only add lines below the line that references the subkey. As long as each additional line contains an equal sign, regini.exe properly handles the line's content. For example, the data items that control pre-logon messages (i.e., LegalNoticeText and LegalNoticeCaption) reside in the same registry subkey as the DontDisplayLastUserName item. To also configure the computer to display a message before users log on, simply add two lines to the previous script:
\registry\machine\software\micro
soft\windows\currentversionpolicies\system
DontDisplayLastUserName = REG_DWORD 1
LegalNoticeText = REG_SZ Your E-Mail is Now Being Monitored
LegalNoticeCaption = REG_SZ Notice To Employees
299958 - Errors that the RegClean utility finds after you install Microsoft Office
Copyright © 1996-2008 by Dr. Nikolai Bezroukov. www.softpanorama.org was created as a service to the UN Sustainable Development Networking Programme (SDNP) in the author free time. Submit comments This document is an industrial compilation designed and created exclusively for educational use and is placed under the copyright of the Open Content License(OPL). Original materials copyright belong to respective owners. Quotes are made for educational purposes only in compliance with the fair use doctrine.
Standard disclaimer:
Last modified: November 08, 2008