Skip to main content

Windows Registry

Context and History​

  • Before Windows 95

    • Configuration stored in text files (INI) scattered in various locations.
    • Problems: duplication, inconsistencies, difficulty in centralized management.

  • Introduction of the Registry

    • Windows 95 introduces the Registry: a centralized hierarchical store.
    • Objective: unify system and application configuration.

Why the Registry Exists​

  • Centralization

    • Replaces multiple INI, CFG, and .INF files.

  • Hierarchy

    • Key/value tree structure, more organized than flat files.

  • Performance and Atomicity

    • Optimized read/write, support for partial transactions.

  • Security

    • ACL (NTFS-style permissions) on each registry key.

General Structure​

The registry is organized into hives. Each hive corresponds to a large file stored on disk (under %SystemRoot%\System32\Config for machine hives, and in the user profile for HKCU).

HiveFileMain Content
HKEY_LOCAL_MACHINE (HKLM)SYSTEM, SOFTWARE, etc.Machine configuration (all users)
HKEY_CURRENT_USER (HKCU)%USERPROFILE%\NTUSER.DATCurrent profile configuration
HKEY_USERSAll user profilesGathers each user's HKCU
HKEY_CLASSES_ROOT (HKCR)Merge of HKLM\SOFTWARE\Classes and HKCU\Software\ClassesFile associations, COM
HKEY_CURRENT_CONFIGLink to the active hardware configDynamic hardware settings

Keys, Subkeys, and Values​

  • Key: equivalent to a folder (containing subkeys and values).

  • Value: pair (Name, Type, Data).

    • Common types:

      • REG_SZ (string),
      • REG_DWORD (32-bit integer),
      • REG_QWORD (64-bit integer),
      • REG_MULTI_SZ (array of strings),
      • REG_BINARY (raw data).

Registry Editor (regedit.exe)​

  • Features

    • Visual navigation of the tree structure.
    • Export/Import of .reg.
    • Modify ACL (right-click → Permissions).

  • Warnings

    • Often requires administrator rights.
    • A bad modification can make Windows unstable.

The Registry Provider in PowerShell​

PowerShell exposes the registry as a provider similar to a file system:

  • Roots: HKLM: and HKCU:
  • Ability to navigate with Set-Location, Get-ChildItem, etc.

Practical Examples with PowerShell​

danger

Test these examples on your virtual machine

# List machine hives
Get-ChildItem -Path Registry::HKLM

# List keys under SOFTWARE
Get-ChildItem -Path HKLM:\SOFTWARE

Reading Values​

# Value of a key
Get-ItemProperty -Path 'HKCU:\Control Panel\Desktop' -Name Wallpaper

# Read all properties
Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa'

Testing for the Existence of a Key or Value​

# Existing key?
Test-Path -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion'

# Existing value?
(Get-ItemProperty -Path HKCU:\... -Name 'ValueName' -ErrorAction SilentlyContinue) -ne $null

Creating a Subkey and a Value​

warning

Replace Username with your username

# Create the MyApp key
New-Item -Path 'HKCU:\Software\Username\MyApp' -Force

# Add a string value
New-ItemProperty -Path 'HKCU:\Software\Username\MyApp' `
                -Name 'WelcomeMessage' `
                -Value 'Welcome to MyApp!' `
                -PropertyType String -Force

# Add a DWORD
New-ItemProperty -Path 'HKCU:\Software\Username\MyApp' `
                -Name 'Enabled' `
                -Value 1 `
                -PropertyType DWord -Force

Modifying an Existing Value​

# Disable fast startup (system example)
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Power' `
                 -Name 'HiberbootEnabled' `
                 -Value 0

Deleting a Key or Value​

warning

Replace Username with your username

# Delete a value
Remove-ItemProperty -Path 'HKCU:\Software\Username\MyApp' -Name 'WelcomeMessage'

# Delete the entire subkey
Remove-Item -Path 'HKCU:\Software\Username\MyApp' -Recurse -Force

Exporting and Importing​

warning

Replace Username with your username

# Export a branch to .reg
reg export "HKCU\Software\Username\MyApp" C:\temp\myapp.reg /y

# Import a .reg
reg import C:\temp\myapp.reg

Advanced Example: Changing the Wallpaper​

# Set the image path
$wall = 'C:\Images\mountain.jpg'

# Modify the key
Set-ItemProperty -Path 'HKCU:\Control Panel\Desktop' `
                 -Name 'Wallpaper' `
                 -Value $wall

# Refresh the display
Add-Type -AssemblyName user32
[User32]::SystemParametersInfo(0x0014, 0, $wall, 0x0002)

Security and Best Practices​

  • Backup before modification

    reg export "HKLM\SOFTWARE" C:\backup\software-hive.reg /y

  • Use -WhatIf and -Confirm

    Remove-Item -Path 'HKCU:\Software\Test' -Recurse -WhatIf

  • Prefer PowerShell over reg.exe for automation

  • Restrict ACLs

    • Check/modify via Get-Acl / Set-Acl if necessary.

Key Takeaways​

  1. The registry is the core of Windows configuration, centralized and hierarchical.
  2. It replaces INI files: more robust, secure, and performant.
  3. Each hive corresponds to a context (machine/user).
  4. PowerShell offers a native provider to navigate and modify the registry in scripts.
  5. Always backup and test before any production modification.