Registry keys - The Six HKEY_ Handles
HKEY_LOCAL_MACHINE
Contains computer specific information about the type of hardware, software and other preferences on a given PC. This information is used for all users who log onto this computer.
SubKeys of the six HKEY Handles HKEY_LOCAL_MACHINE may contain the following Entries
Config
A collection of configurations for the local computer.
Enum
Info on the system's installed hardware devices.
Hardware
Info about hardware and its configuration.
Network
Info created when a user logs on to a networked PC.
Security
Info on network security and remote administration.
Software
Info about software and its configuration on system.
System
The database that controls system start-up, device driver loading, Windows Services and OS behavior.
HKEY_LOCAL_MACHINE\Config
This subtree contains information about alternate hardware configurations for the computer. For example, it can contain information about multiple configurations to be used when the computer is connected to a network, when it is undocked from a docking station, and so on. Each alternate configuration is assigned a unique identifier, and this configuration ID has a subkey under the Config key. Each configuration appears in the list of hardware profiles in the System option in Control Panel. When Windows checks the hardware configuration at system startup, one of three things occurs: In most situations, the configuration ID is mapped to a unique configuration and Windows selects the appropriate one automatically, and the settings for the related Config subkey are used for system configuration. If the user is starting the computer for the first time with new hardware components, Windows creates a new configuration for the new configuration ID, and a new Config subkey is added to the Registry.
If the configuration ID is mapped to more than one configuration (for example, because Windows cannot distinguish between two configurations), the user is prompted to choose which configuration to use.
HKEY_LOCAL_MACHINE\Enum
Windows bus enumerators are responsible for building the hardware tree. This includes assigning an identification code to each device on its bus and retrieving the device's configuration information, either directly from the device or from the Registry.
Bus enumeration information is stored in the HKEY_LOCAL_MACHINE subtree. For all types of devices, subkeys contain information such as device type, assigned drive letter, hardware ID, and device manufacturer, plus driver-related information for network components.
The following table shows which devices are enumerated in typical subkeys.
ESDI
Fixed disk devices
FLOP
Floppy disk devices
ISAPNP
Plug and Play devices on an ISA bus
Monitor
Monitor devices
Network
Network protocol, server, and bindings
Root
Legacy devices
HKEY_LOCAL_MACHINE\Hardware
Information about serial ports and modems used with the HyperTerminal program.
HKEY_LOCAL_MACHINE\Network
Network information created when a user logs on to a networked computer, including the user name, primary network provider, whether the logon was validated by a server, and information about the system policies processor.
HKEY_LOCAL_MACHINE\Security
Information about the network security provider and remote administration capabilities.
HKEY_LOCAL_MACHINE\Software
This subtree contains configuration information about all installed software that can write information in the Registry. The entries in this key apply for anyone using this particular computer, and include definitions for file associations and OLE information. The software subkey contains, for example, the information you add when registering an application to use a specific filename extension and information added during installation of Windows-based applications.
It subtree contains several subkeys, including the Classes subkey, plus description subkeys for all installed software that can write to the Registry, as described in the following sections.
HKEY_LOCAL_MACHINE\System
The data in HKEY_LOCAL_MACHINE is organized into control sets that contain a complete set of parameters for device drivers and services that can be loaded with Windows. All data that controls startup is described in the CurrentControlSet subtree under HKEY_LOCAL_MACHINE. This control set has two parts:
The Control key contains information used to control system startup, including the computer's network name and the subsystems to start.
The Services key contains information to control the loading and configuration of drivers, file systems, and so on. The data in the Services key also controls how these services call each other.
HKEY_Current_Config
This Key points to a branch of the Key HKEY_LOCAL_MACHINE\Config that contains information about the current hardware configuration.
HKEY_Dyn_Data
This Key points to a branch of HKEY_LOCAL_MACHINE that contains various bits of information regarding the System's Plug and Play configuration. This information is DYNAMIC, meaning that it may change as devices are added to or removed from the computer.
HKEY_Classes_Root
This Key points to a branch of HKEY_LOCAL_MACHINE that describes certain software settings. This Key contains essential information about OLE and drag and drop operations, shortcuts, and core aspects of the Windows GUI.
HKEY_Users
This Key contains information about the users that log onto the computer.
Both generic and user-specific information is used, and each user who uses the system has their own Subkey.
HKEY_Current_User
This Key points to a branch of HKEY_Users for the user who is currently logged onto the system.