Talk:Windows Registry

message: "The Windows registry was introduced to tidy up the profusion of per-program INI files that had previously been used to store configuration settings for Windows programs.[1] These files tended to be scattered all over the system, which made them difficult to track."
The part "which made them difficult to track" seems to be a positiv assessment of the registry. But the port from one server to another of the registry is not easy and the current usage of the registry make it impossible to transfer between 32- and 64-bit windows version.
Most ".ini" datas could be transfered without problem, if the "not operation system" related informations would be stored in ".ini" files.
It seems to better to delete the "which made them difficult to track" part or to write "which made them difficult to track, but easy to port between different servers.".  —Preceding unsigned comment added by 195.145.45.7 (talk) 17:32, 8 November 2007 (UTC)
replies: text: Agreed!--Bstard12 (talk) 18:31, 15 November 2011 (UTC)
thread_title:  Assessment of Microsoft registry usage 

message: The "Advantages and Disadvantages" section was tagged with the suggestion that its content be integrated into the article.  I've integrated the "Pro" points into a new Rationale section that explains the evolution of the registry from the simple .INI files that preceded it.  Please contribute to this new section. One point from the Pros list didn't seem to fit:
* Portions of settings like any subset of an application configuration can be saved in a text-based .REG file, which can be edited with any text editor later. .REG files can easily be merged back into the registry both by unattended batch file or by the user just double-clicking on the file without harming any setting that is not explicitly stated in the .REG file. This is very useful for administrators and support personnel who want to pre-set or pre-configure only a few options like approving the EULA of a certain application.
I've integrated the "Cons" into a new Criticism section.  Please contribute to this section, as the current material needs a broader, more coherent view.
Ross Fraser (talk) 05:22, 19 June 2010 (UTC)
replies: text: While damaged configuration files can have the same result to other operating systems, the damage can be more easily repaired by booting to another operating system, and using a text editor.
Apart from being ungrammatical, it doesn't seem to make much sense.  If you can edit a damaged computer's config files via booting from an external system, you should also be able to edit its registry using regedit.
Ross Fraser (talk) 07:35, 27 December 2010 (UTC)
thread_title:  Reorganize Advantages and Disadvantages section into a Rationale Section (up front) and a Criticisms section (at the end) 

message: The registry actually appears with programs like "MS-Word for windows" 2.0.  Regedit runs under Windows 3.0, and even the default setup for Windows 3.1 on its original release had registry entries fro WinWord 2.0.  --Wendy.krieger (talk) 11:06, 29 January 2011 (UTC)
replies: text: Yes, indeed - but what's your point? Socrates2008 (Talk) 11:32, 29 January 2011 (UTC)
thread_title:   Registry in Windows 3.0 

message: Well, the title speaks for itself. I think the section 'Criticism' should be moved downwards, because most articles from my experience, has the section 'Criticism' more to the bottom of the article, if at all.  — Preceding unsigned comment added by Enoch exe inc (talk • contribs) 16:34, 17 June 2011 (UTC)
replies: text: Criticism needs to be near the top, because it's so central to the Windows Registry. Bostoner (talk) 03:15, 2 August 2011 (UTC)
thread_title:  Moving Section 'Criticism' down a bit. 

message: OS X has 2 Library's. One is for user-specific configuration, and one is for system-wide configuration. An application can allow both types of configuration, with some configuration features applying to both and some to only one. There's another Library folder, but it's not really for configuration. Bostoner (talk) 03:15, 2 August 2011 (UTC)
thread_title:  Inaccurate Information on OS X 

message: 72.89.210.51 (talk) 16:38, 25 December 2011 (UTC)
thread_title:  Accessability thru network, registering and triggering events 

message: This: http://www.beginningtoseethelight.org/ntsecurity/index.php is one of the only sources information about the binary format of registry hive files that I have ever found.  I believe that it should be included.  — Preceding unsigned comment added by 75.154.106.91 (talk) 15:42, 17 April 2012 (UTC)
thread_title:  Links 

message: Why are some registry keys "locked" and unable to be edited or deleted?  The page could mention "locked" registry keys. TurboForce (talk) 13:29, 20 July 2012 (UTC)
replies: text: For the same reason that locked files cannot be deleted - some process has opened the key, but failed to close it, causing a handle leak Socrates2008 (Talk) 12:23, 21 July 2012 (UTC)
replies: text: Some registry keys and entries are undeletable i.e. when editing the registry, the key cannot be deleted, even in safe mode.  Maybe this behaviour is caused by a rootkit?  But I have seen cases where legitimate registry keys or entries cannot be deleted and seem to be "locked".  Interesting and maybe worth mentioning in the page what causes this locking behaviour? TurboForce (talk) 19:54, 21 July 2012 (UTC)
replies: text: It could also be that those keys cannot be edited (even by Administrators), precisely to prevent infection by rootkits. However, on a live system, it's probably indeed 'in use' and thus locked. In fact, I think that's the main way rootkits block editing too. I think with some sources detailing the possibilities, this could indeed form a short paragraph for the article? --DanielPharos (talk) 09:45, 30 July 2012 (UTC)
replies: text: WP:OR.  Rootkits typically hide keys - I've never heard of them locking keys to deny access to other processes, so happy hunting finding a ref for this. Socrates2008 (Talk) 10:51, 30 July 2012 (UTC)
replies: text: Well, it appears to be the entire reason for this tool to exist: , and I've seen in happen in the wild. Also, if I were a malware-writer, I'd do it. But of course you're right: we should consider it OR unless some proper sources are added to it. I was merely pointing out that TurboForce is right in that rootkits *can* be responsible for undeletable Registry keys. --DanielPharos (talk) 14:47, 30 July 2012 (UTC)
replies: text: Windows registry keys cannot be "locked" as such. One can set permissions on individual keys/values so that regular users are not allowed to delete/change the keys. Just like with regular files, you can even deny administrator access by transferring ownership to another account and explicitly/implicitly deny administrators access. However, you cannot prevent the administrator from taking advantage of the "take ownership" super privilege to take back ownership. A possible source of this "locking" myth is the fact that when an app requests deletion of a key/value, it is only marked for deletion. The actual deletion will occur automatically when the last handle to the key is closed. Running applications (could be malware) may certainly keep keys open - and thus delay the deletion. But they cannot prevent it. Some malware registers itself to run during logon/boot so that it may change back or re-add keys, thus it may appear as if the key cannot be deleted. Also, some hives are transient and are maintained by the kernel. You cannot change the values of those keys. Useerup (talk) 22:47, 30 July 2012 (UTC)
replies: text: Huh, I never knew that... I stand corrected, and learned something new. :) --DanielPharos (talk) 06:40, 31 July 2012 (UTC)
replies: text: I wonder if undeletable registry keys are being mistaken for "locked" registry keys?  This tool can delete the undeletable keys. TurboForce (talk) 11:20, 31 July 2012 (UTC)
replies: text: A malware app that leaked handles would attract unwanted attention to itself.  One of the primary reasons for not being able to delete keys is when they contain NULLs that prevent tools like Regedit from deleting them - this is normally a limitation with the Regedit tool itself, not in the underlying APIs (see RegDelNull).  Also, Registry info is not really "deleted" from the Registry - like many other databases, the records are simply marked for deletion in the internal database as this is more efficient on I/O. Socrates2008 (Talk) 11:26, 31 July 2012 (UTC)
replies: text: When the user is unable to edit or delete anything in the registry (such as the leftovers from a failed un-install), this is what I'm referring to when I describe the "locking" behaviour here.  I'm hoping someone can add this info to the page and explain why registry entries can become locked. TurboForce (talk) 15:41, 2 August 2012 (UTC)
replies: text: I suspect that whenever a user is unable to edit or delete keys and/or values it is because of either 1) inadequate permissions or 2) attempt to edit a transient (and system-maintained) hive. Can you point us to any instance where it is documented that a user has been unable to edit keys and where these two causes can be ruled out? Useerup (talk) 16:00, 2 August 2012 (UTC)
replies: text: Now we're getting somewhere.  Can we try to find all the possible reasons why registry keys become locked and mention these reasons on the page?  Looking for answers, I found this page on Microsoft's website, which says that the user will be unable to delete a key with "embedded null characters" and the page says "This usually occurs due to a corrupt application install or similar", which could explain why registry entries appear to be "locked" when the user tries to delete them after an app's un-installer pukes before the end - a situation I've witnessed a number of times! TurboForce (talk) 18:17, 2 August 2012 (UTC)
replies: text: Did you read User:Socrates2008s reply above? user:Socrates2008 wrote: "One of the primary reasons for not being able to delete keys is when they contain NULLs that prevent tools like Regedit from deleting them - this is normally a limitation with the Regedit tool itself". It seems that the registry allows keys to be created with embedded NULL characters, but that some tools have problems handling those keys. However Windows itself does not create or look for keys with NULL characters. If you create such a key it will not have any effect on anything - since nobody is looking for it. Some tools (evidently regedit) cannot delete the key. Your point? Do you really think that a bug in regedit is worth mentioning in the article? Useerup (talk) 21:35, 2 August 2012 (UTC)
replies: text: Yes I've read all the points in this section.  Again, I think it would be good if the article can explain all the reasons WHY registry entries become locked.  If the regedit supplied with Windows cannot do anything with keys containing NULL characters, but the Windows registry itself contains keys with NULL characters then I consider this a major problem.  Why is the Windows registry allowing keys with null characters to be created and the supplied regedit from Microsoft can't do anything with those keys containing NULL characters?  If the settings were saved in plaintext files instead, and something got "corrupted" in a plaintext file, the user could use any text editor and remove the corrupted data, provided the user had the privileges to edit that file.  Does anyone have the time and expertise to explain in the article *all* of the reasons why registry entries become "locked" and does not allow the user to delete and/or edit them? TurboForce (talk) 12:20, 3 August 2012 (UTC)
replies: text: After 4 days, has anyone decided on this?  It would definitely be a good idea to mention in the page why registry keys can become "locked" - or whatever you want to call it when you can't edit something in the registry for whatever reason.  No, I'm not just referring to NULL characters - which could also be mentioned as well.  Not trying to go off topic: the use of "third party" registry editors could be mentioned if they are notable or have extras that the Windows registry editor lacks; I can remember a registry editor was included in Norton Utilities.  The RegDelNull is a notable example, although not a full-featured registry editor. TurboForce (talk) 11:08, 7 August 2012 (UTC)
replies: text: It is a non-problem and a fringe problem. There is no "locking" of registry keys. They can have security descriptors which may block users from editing (or even reading) keys they are not permitted to. The "embedded null" keys allows someone to create a key which cannot be deleted by the regedit editor. But that cannot be utilized to "lock" any keys that control anything in Windows or any application. There's is preciously little information about this problem *anywhere*. It is definitely not a notable issue. Useerup (talk) 19:32, 7 August 2012 (UTC)
replies: text: Thank you for explaining it.  To someone who is reading the page because they think a registry key is "locked", the page could at least explain better what measures are in place to prevent users from editing certain registry keys.  Perhaps a new section like "Registry key protection", which discusses how the measures are implemented e.g. security descriptors, or even other causes such as a handle leak - mentioned earlier.  Why would anyone want to create a registry key which cannot be deleted with the supplied regedit?  My first thought is malware taking advantage of that!  I have created a section in my userpage to show how something supposedly simple can quickly cause confusion and a *lot* of debating amongst readers.  The Windows Registry page could do a better job of explaining, simply, why some registry keys are protected or blocked for whatever reason(s). TurboForce (talk) 21:02, 7 August 2012 (UTC)
replies: text: Well, if you feel that some information about the ACLs of Registry keys is missing; be bold and add it! --DanielPharos (talk) 06:00, 8 August 2012 (UTC)

text: ....but WP:V and WP:RS apply!  The new "Security" section was laced with errors, which I've had a go at fixing, but references are required please otherwise the new section must go. Socrates2008 (Talk) 10:25, 8 August 2012 (UTC)
replies: text: references added... Useerup (talk) 12:22, 8 August 2012 (UTC)
replies: text: I've not yet come across a ref link to prove that a "handle leak" can prevent the user from editing a registry key; I have come across several Microsoft support pages which mention this problem, such as this one.  I'm hoping to list all the possible reasons why a user may be blocked from either deleting, editing or even reading a registry key.  It is not just security measures which blocks the user from doing something in the registry. TurboForce (talk) 17:24, 8 August 2012 (UTC)
replies: text: I don't think you're going to find one - looks like handle leaks only prevent hives from unloading (hence UphClean) and depletion of system resources.  PS: Sloppy coding is another reason that keys "can't" be deleted. Socrates2008 (Talk) 11:11, 9 August 2012 (UTC)
replies: text: Thanks for the info.  I always laugh at the fancy words "this behavior is by design" in them pages. xD  At least on this page, we can mention all the other reasons why registry keys can't be deleted, even if these don't make it into the main page. TurboForce (talk) 11:55, 9 August 2012 (UTC)
replies: text: I am curious: Why do you feel this is a notable topic? Remember, to be notable it is not just that you feel that it is important. This issue seems rather fringe (evidenced by the lack of sources) and it will run afoul of WP:UNDUE. Right now you have piggy-backed the security section with a fringe issue which has nothing to do with security. It has to go somewhere else. But before creating a section where you are going to "mention all the reasons why registry keys can't be deleted", please make a case for how this is WP:DUE. Useerup (talk) 12:13, 9 August 2012 (UTC)
replies: text: Let's keep things simple.  When the user is blocked from doing something with a registry key, there are other reasons outside of any security measures in place.  Why would the user see "error deleting key"?  The user should not be under the illusion that a security setting somewhere has blocked/locked that key (or whatever you want to call it) when in fact it's something else. TurboForce (talk) 12:39, 9 August 2012 (UTC)
replies: text: Why do you think this is notable? Useerup (talk) 12:52, 9 August 2012 (UTC)
replies: text: It's obvious: if registry keys are protected/locked/blocked for other reasons not mentioned, then the security section is misleading.  It's missing the facts.  Maybe those missing facts belong elsewhere on the page?  There's more information about it on this page than the main page. TurboForce (talk) 13:13, 9 August 2012 (UTC)
replies: text: Useerup is right - I think this just turned into a fishing expedition. Socrates2008 (Talk) 11:31, 10 August 2012 (UTC)
replies: text: If you're happy with the main page misleading readers then fine.  It's crystal clear that there's other causes, outside of security measures, which can block registry keys. Lucky Wikipedia is not a book publishing company, who wants all the correct information, not some of it omitted. TurboForce (talk) 20:07, 10 August 2012 (UTC)
replies: text: If it's "crystal", then where are all the supporting refs?  WP:OR applies. Socrates2008 (Talk) 10:36, 12 August 2012 (UTC)
replies: text: It's been discussed here.  I've already added info about the "NULL" character registry keys, which are un-deletable with regedit.  If there are other notable reasons why anything in the registry is blocked in some way, not caused by the security settings, these reasons should be mentioned, along with good refs of course.  Maybe malware or a poorly written app has blocked a key because it's "in use"?  Sometimes refs are hard to find, just to prove what's already correct. TurboForce (talk) 18:33, 12 August 2012 (UTC)
replies: text: As we (I) learned about two weeks ago, there is no "in use"-state when it comes to Registry keys, so I don't know what you're going on about. In fact, you *can* delete a key while it's still opened by other processes:   (Note, however, that this is only available to drivers.) --DanielPharos (talk) 20:06, 12 August 2012 (UTC)
replies: text: Doesn't have to be a driver - PowerShell example below showing an open key successfully being deleted from another process.  We're done here. Socrates2008 (Talk) 12:43, 13 August 2012 (UTC)
replies: text: I was actually planning on trying that myself just now, so thanks for being quicker than me! ;)  Yep, that's the end of this discussion then... --DanielPharos (talk) 17:57, 13 August 2012 (UTC)
thread_title:  Locked registry keys 

message: The link to http://www.docstoc.com/docs/2381418/Forensic-Analysis-of-the-Windows-Registry-Computer-Forensics appears to be an assignment. It is not clear how it has been reviewed/challenged and the sit on which it is published does not claim to have any such process in place. If anyone can find a link to a e.g. a trusted publisher or similar where the status of the paper can be verified please link to that instead. Otherwise it is a self-published paper. Useerup (talk) 15:57, 2 August 2012 (UTC)
replies: text: Look at the references from page 32 onwards.  If the paper is correct, then I don't see anything wrong with citing it.  I've not had the time to thoroughly read it, but skipping through it quickly - I can see that the author has used many references and it does not appear to be any kind of self-published reference.  What do other readers' think? TurboForce (talk) 18:02, 2 August 2012 (UTC)
replies: text: The paper looks like an assignment which has been turned in as part of a university course. There is no reason to doubt that it is anything but an academic paper. But that's not the point. The point is that it contains opinions and we cannot see that it has been published in a way which would have invited opposition. There is no reference to how the paper was received, graded, defended or opposed. This falls under WP:QS. The paper was basically uploaded to a document store with no context. That is why I call for some reference (e.g. a reputable news site) which has published the paper. Absent that, it is basically a self-published source. Useerup (talk) 21:28, 2 August 2012 (UTC)
replies: text: All source material is published by a person or persons, just like industrial robots in factories are created by humans in the first place.  As long as the paper is correct and the author(s) have used valid references, I don't see there being *any* problem with using it as a ref.  You could be checking Wikipedia articles for literally years to see if all the references are to your satisfaction, especially articles in which web references are almost non-existent, in which case book references can be used - but would you be able to locate that book and read it thoroughly?  It appears that you're only checking the validity of ref links if there's any negativity about Microsoft products.  Do you check ref links with the same thoroughness if there's statements in Wikipedia articles praising Microsoft?  I don't want a full scale argument and I don't have much time to dedicate to editing Wikipedia at the moment.  I'm glad you have explained some of the registry "locking" behaviour in the previous section, which I must emphasise is not a criticism, but a technical issue with the Windows registry, which would be great if it's mentioned in the main page.  Anyway, enough typing now because I'm tired and the time here is actually 1 hour ahead of what's showing next to my username (BST). TurboForce (talk) 22:10, 2 August 2012 (UTC)
replies: text: And who get to decide whether a paper is "correct"? I have read the paper and I certainly see some inaccuracies as well as outdated information and speculation. The paper cannot stand alone. Read the policies on reliable sources, please. Useerup (talk) 22:13, 2 August 2012 (UTC)
replies: text: Does it meet WP:RS?  Yes - primarily because it's published by a university.  What score would it get out of 10 for "correctness" and completeness?  6.5  Socrates2008 (Talk) 11:08, 3 August 2012 (UTC)
replies: text: The problem is that the paper is not published by an university. It appears to be an assignment which has been uploaded to a document sharing site. It does not reside on any university site. In fact there is no context, not even a year on the "due date". We have no idea of how it was received. Useerup (talk) 12:30, 3 August 2012 (UTC)
replies: text: This document was indeed written by a student of the university: . The 2006 finishing year is consistent with the references in the document; only 2006 and earlier. --DanielPharos (talk) 09:51, 4 August 2012 (UTC)
replies: text: Nice find. The university actually has a searchable database with research papers. But I cannot find this paper in it. If the paper was publishes by the university it would certainly meet WP:RS. But it is not and it does not. Note, that I'm not opposing the assertions or conclusions made in the paper, I just don't think that it meets the requirement that a RS should have been subjected to peer review or meaningful editorial oversight. In this context the paper main purpose (forensics) is not even used, merely an outdated assertion from the paper is used. Useerup (talk) 20:56, 4 August 2012 (UTC)

text: I removed the references to the student assignment. The claims now lack proper citation/attribution and I have marked them as such. Useerup (talk) 05:32, 28 August 2012 (UTC)
thread_title:  Unreliable source 

message: Microsoft states “A hive is a logical group of keys, subkeys, and values in the registry that has a set of supporting files containing backups of its data”.
http://msdn.microsoft.com/en-us/library/windows/desktop/ms724877%28v=vs.85%29.aspx
This Wikipedia article states that hives are actually the supporting files containing the backup data.
"Even though the registry presents itself as an integrated hierarchical database, branches of the registry are actually stored in a number of disk files called hives."
So, what about the sections in the registry that have no corresponding file because it is a volatile key that is created (and built) by the kernel at system start? (Also described in the same msdn document.)
98.169.82.242 (talk) 22:58, 1 January 2013 (UTC)
replies: text: Could you make the changes to make the article more correct? Useerup (talk) 16:08, 2 January 2013 (UTC)
thread_title:  Definition of "Hive" 

message: The token "hex" is apparently a keyword token in the .reg file format, and the value which follows in parentheses. I cannot find any documentation on this in the Microsoft documentation [sic]; specifically, there is no mention in citation [17]. Is the material in the .REG files section from a Microsoft site? Or is it derived from empirical induction? If the former, please add a reference; if the latter, please note this explicitly.  — Preceding unsigned comment added by RobertREvans76 (talk • contribs) 16:07, 23 April 2013 (UTC)
thread_title:  Hex keyword token in .REG file definition? 

message: Suggest that an explanation of the term HKEY be included in this Wikipedia page along the lines of this extract: 
'HKEY stands for "Handle to Registry Key" and is a typedef supplied in the Windows headers files. The Window architects use the opaque handle scheme that most operating systems use. When requesting resources from the operating system, you are given a "handle" or cookie that represents the real object. In order to protect the internals from changes, the handle is not the actual data. The folks working on the registry system happened to want to differentiate a handle returned from the registry from one returned from CreateFile, for example. Therefore, they called it HKEY.'
From: http://searchwindowsserver.techtarget.com/answer/What-does-HKEY-mean-or-stand-for
CPES (talk) 15:28, 4 October 2015 (UTC)
thread_title:  Meaning of HKEY 

message: As it says, programs put their initialization information into the registry instead of .ini files.  But now, under Windows 10 in User mode, old programs cannot even read the registry.  Some info here on how the registry is used and interacts with UAC in Windows 10 would be most welcome.69.74.253.62 (talk) 13:50, 4 August 2017 (UTC)
thread_title:  This article needs Windows 10 content 

message: Hello fellow Wikipedians,
I have just modified 4 external links on Windows Registry. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
*Added archive https://web.archive.org/web/20080509003336/http://docs.rinet.ru/Registratura/htm/apf.htm to http://docs.rinet.ru/Registratura/htm/apf.htm
*Corrected formatting/usage for http://amnesia.gtisc.gatech.edu/~moyix/suzibandit.ltd.uk/MSc/
*Added archive https://web.archive.org/web/20120527133205/http://roscidus.com/desktop/AppDirs to http://roscidus.com/desktop/AppDirs
*Added archive https://archive.is/20070219161339/http://productsdb.riscos.com/admin/riscos.htm to http://productsdb.riscos.com/admin/riscos.htm
When you have finished reviewing my changes, you may follow the instructions on the template below to fix any issues with the URLs.
Cheers.—InternetArchiveBot (Report bug) 07:35, 13 January 2018 (UTC)
thread_title:  External links modified 

message: name a utility that can directly manipulate the Window`s Server 2008 Registry? SophiaRoboticsRobots (talk) 02:54, 23 April 2019 (UTC)
thread_title:  Window`s Server 2008 

message: Registry has many more disadvantages. Furthermore, in the current disadvantages section there is one sentence of disadvantages and three sentences of advantages. It is ridiculous and obviously biased.  — Preceding unsigned comment added by 93.92.193.34 (talk) 12:15, 29 January 2020 (UTC)
thread_title:  Registry has many more disadvantages