reading 08 - OddGarden/Ops201-Reading-Notes GitHub Wiki

Windows Registry Demystified

The Windows Registry is a databse where Windows and many programs store their configuration settings. The Registry is available for edits often called "registry hacks

What is the Windows Registry, and How Does It Work?

  • It is a collection of several databases
  • it contains system wide settings as weill as user-specific settings
  • System wide settings are located at C:\Windows\System32\Config\
  • User-specific keys are located at C:\Windows\Users\Name directory. These files can't be edited.
  • Windows loads the settings into memory. When a program is launched it can check the registry stored in memory to find it's config. When the program setting is changed, it can change the settings in the registry. When you sign out/ shut down, the state of the registry is > saved tot he disk.
  • Prior to the registry, settings were stored in INI config files that were scattered across the OS. The registry is used by all programs now and serves to bring all the setting together. Not all programs stor their setting in the registry.

Why You Might Want to Edit the Registry

Registry hacks are useful whtn you are looking for options that aren't normally exposed in Windows.

Is It Safe?

Haphazardly deleting or changing things = a messed up systems configuration or even unbootable Windows. Always back up the registry before making any modifications.

How to Edit the Registry

  • press Windows+R to open the Run dialog. Type “regedit” and then press Enter.
  • agree to a User Account Control prompt
  • Navigate to whatever key you need to modify in the left pane. On Windows 10, you can also just copy-paste an address into the Registry Editor’s address bar and press Enter.
  • To change a value, double-click it in the right pane and enter the new value. To create a new value—right-click in the right pane, select > the type of value you need to create, and then enter the appropriate name for it.
  • You can click “OK” to save your change and close the Registry Editor