Microsoft Windows Registry Guide, Second Edition

SOFTWARE

The key HKLM\SOFTWARE is second in interest only to HKCU\Software. It contains per-computer software settings, including many Windows settings. Because Windows and most applications store settings as per-user settings, this branch is a bit slimmer than HKCU\Software, but it still contains numerous settings that are useful for customization. The types of settings you find in HKLM\SOFTWARE are typically those that an administrator defines. Because HKLM\SOFTWARE contains per-computer settings, any changes you make here affect all users who log on to the computer. Also, restricted users don't have permission to change settings in HKLM.

The key HKLM\SOFTWARE is organized similarly to the way HKCU\Software is organized. Applications store settings in HKLM\SOFTWARE\Vendor \Program\Version\. Vendor is the name of the program's publisher, Program is the name of the program, and Version is the program's version number. Often, Version is CurrentVersion. This branch also contains a handful of subkeys that don't follow this organization. For example, HKLM\SOFTWARE\Policies contains per-computer policies. The sections following this one describe the most interesting and useful parts of HKLM\SOFTWARE.

Classes

The key HKLM\CLASSES contains per-computer file associations. This key contains the vast majority of file associations, as opposed to HKCU\Classes, which contains per-user file associations. Windows merges both subkeys to form HKCR. Appendix A, “File Associations,” describes HKCR in detail.

Clients

The key HKLM\SOFTWARE\Clients defines the client programs that Internet Explorer associates with different Internet services. You configure these clients on the Programs tab of the Internet Properties dialog box, shown in Figure D-2. For example, you can choose the mail client that Internet Explorer uses when you click a mailto link, or you can choose the news client to use when you click a news link. These choices also determine the programs that Internet Explorer launches when you choose one of the tools on the Tools menu.

Figure D-2 You associate client programs with Internet services by using the Programs tab.

The Clients key contains six subkeys by default: Contacts, Internet Call, Mail, Media, News, and StartMenuInternet. The default value of each subkey specifies the name of the application that is the default tool for that category. For example, if the default value of HKLM\SOFTWARE\Clients\Mail is Outlook Express, then Outlook Express is the default mail client that Internet Explorer starts when you click a mailto link.

Drill down a bit further and you find one subkey for each client program. For example, Clients\Mail contains the Hotmail, MSN Explorer, and Outlook Express subkeys. The organization of these subkeys is almost the same as the organization of the subkeys in HKCR. Typically, you find the subkeys Protocols and shell under each client program's subkey. The subkey Protocols defines the protocols associated with the application. For example, the key HKLM\SOFTWARE\Clients\Mail\Outlook Express\Protocols describes the command to run when users click a mailto link on a Web page. The subkey shell defines the command to run when users choose an option on Internet Explorer's Tools menu. The subkey HKLM\SOFTWARE\Clients \Mail\Outlook Express\shell describes the command to run when users click Tools, Mail And News, Read Mail in Internet Explorer.

Microsoft\Active Setup

A variety of Windows components, notably Internet Explorer components, still use Active Setup. The key HKLM\SOFTWARE\Microsoft\Active Setup contains these components' registrations. The subkey FeatureComponentID is sometimes useful for mapping a GUID to a component. Look for the GUID in this subkey; then look at the REG_SZ value to determine the component's name.

The key HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components is each component's registration. Each subkey is a component. For example, the subkey {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} is for NetShow. Within each subkey, you see several values, some more interesting than others. First the REG_BINARY value IsInstalled indicates whether the component is installed or not. The value is 0x0001 if the component is installed; if not, the value is 0x0000. The REG_SZ value Version contains the component's version.

The most interesting value is the REG_EXPAND_SZ value StubPath. If this value exists, Windows executes the command it contains after the operating system creates a new user profile. If you don't see this value, nothing happens. To keep Windows from running the command, remove the value StubPath from that component's subkey in Installed Components.

Microsoft\Command Processor

The command-prompt window supports file and folder name completion, as well as a few other features. You can configure these features using Tweak UI, as described in Chapter 5, “Mapping Tweak UI,” or you can hack them directly in the registry. This key is similar to HKCU\Software\Microsoft\Command Processor. The difference is that this key applies to all users, whereas the key in HKCU applies only to the current console user. The following list describes the settings in the subkey Command Processor, which configure the command-prompt window:

Table D-1 Values for DefaultColor

Value

Color

0

Black

1

Blue

2

Green

3

Aqua

4

Red

5

Purple

6

Yellow

7

White

8

Gray

9

Light Blue

A

Light Green

B

Light Aqua

C

Light Red

D

Light Purple

E

Light Yellow

F

Bright White

Microsoft\Driver Signing

The key HKLM\SOFTWARE\Microsoft\Driver Signing contains values that configure the Windows driver-signing feature. Microsoft digitally signs driver files so that Windows can verify that Microsoft tested the driver file and that the file hasn't changed since Microsoft tested it. This key's only value, Policy, controls how Windows handles driver files that aren't signed. Here are the possible values:

This setting comes from the Driver Signing Options dialog box, shown in Figure D-3. It applies to all users, unless you clear the Make This Action The System Default check box. The figure shows the values associated with each option.

Figure D-3 In an enterprise environment, blocking unsigned device drivers is the safest option.

Microsoft\DrWatson

The DrWatson subkey stores configuration settings for Dr. Watson for Windows (Drwtsn32.exe), the application error debugger. These entries specify how Dr. Watson for Windows notifies the user of an application error, and how its log file and crash dump file are configured. Dr. Watson adds these entries the first time it starts:

Microsoft\Internet Explorer

The key HKLM\SOFTWARE\Microsoft\Internet Explorer contains Internet Explorer settings that apply to every user who logs on to the computer. For example, the subkey AboutURLs contains the URLs of Web pages that Internet Explorer displays in special scenarios. The subkey AdvancedOptions defines templates for the options on the Internet Options dialog box's Advanced tab.

Microsoft\Sysprep

You won't see HKLM\SOFTWARE\Microsoft\Sysprep on your computer unless you installed Windows from a disk image that you prepared with Sysprep. Chapter 15, “Cloning Disks with Sysprep,” describes how to use this tool. The values in this subkey are useful for understanding what Sysprep has done:

Microsoft\Windows NT\CurrentVersion

The key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion contains useful subkeys for learning more about Windows but not customizing it. The values in this subkey describe the current version of Windows, the registered owner, and the path in which you installed the operating system. For IT professionals, the three most useful subkeys are in the following list:

Microsoft\Windows NT\CurrentVersion\Winlogon

The Winlogon subkey stores configuration data for the Winlogon service. Winlogon provides support for interactive logon to Windows. This subkey stores data that applies to all users of the computer. The Winlogon subkey in HKCU stores data that applies to a specific user. The following list describes settings in the Winlogon key:

Policies

Windows stores per-computer policies in the key HKLM\SOFTWARE\Policies, the preferred branch for registry-based policies. Restricted users don't have permission to change the Policies subkey, which prevents them from circumventing policies by editing the registry. Windows supports hundreds of policies that enable IT professionals to control the computer's configuration. Chapter 7, “Using Registry-Based Policy,” shows you how to customize policies by building custom administrative templates.

Very often, using policies is the best and most interesting way to customize Windows. For example, many of the customizations you learn about in Chapter 4, “Hacking the Registry,” rely on policy settings in the registry to change behaviors. Some policies enable you to change behavior that annoys you. In this regard, the per-user policies in HKCU\Software\Policies offer more customization possibilities that the policies that you find in HKLM\SOFTWARE\Policies.

Although editing the registry directly is certainly one way to customize policies, there are better ways. The first is to use Group Policy Editor to edit the local Group Policy Object (GPO). This provides a user interface for the policies, limiting your settings to valid choices. Chapter 7, “Using Registry-Based Policy,” describes how to edit the local GPO. In short, type gpedit.msc in the Run dialog box, and then edit the policies under Computer Configuration and User Configuration in Administrative Templates. The second way is to write scripts that change policies. I use scripts when I need to repeat the same setting many times, such as when I'm configuring multiple computers or when I reinstall Windows on computers often. Chapter 11, “Scripting Registry Changes,” shows you how to write scripts to edit the registry.

Related

Категории