The HKEY_CURRENT_USER branch is built during logon and is an alias for the current user's subkey in the HKEY_USERS branch; it contains user-specific information. Twelve major subkeys are in this branch, but depending on your system setup and what's installed, you might find some extra ones.

I T'leventvwr.msc


[jpl exe2binrexe

expsrv.dll [^extmgr.dH [¡H extrac32.exe ¡^Jf3ahvoas,dt[ fiT? fastop-en.exe Si Faultrep.dll

Bf«*« [^fde.dll fdeploy.dll SjfdPHost.dll 1^] fdProxy.dll S) FDResPubrdlf fdSSDP.dll fdWCN.dll ¡^ fdWNet.dll fdWSD.dll fectient.dN

Open Author

Run as administrator Open With... Pin to Start Menu Add to Quick Launch

Send To

Cut Copy

Create Shortcut




Figure 20-4

The following table describes the major subkeys.

Subkey Description

AppEvents Contains information about the sound files that are specified for individual system and application events, such as the Windows Logon sound and the MailBeep sound. It has two subkeys of its own: EventLabels, which contains the event names, and Schemes, which contains references to the actual sound files organized by the application.

Console Contains all the user options for the MS-DOS Windows, including layout, screen color, and font settings.

Control Panel Contains many other subkeys for all the Control Panel settings, such as color schemes, screen savers, keyboard repeat rate, mouse speed, and so on.

Environment Contains the environment settings, specifically the temporary file locations.

It contains the environment variables that you would see in DOS when you typed SET at the command line. Much of the information contained in this key is connected to the System applet in the Control Panel.

Identities Is present only if Outlook Express 5.x (or later) is installed. It contains sub keys for an Outlook Express account, e-mail, and newsgroup settings, and the MSN Messenger, if installed.

Keyboard Layout Contains three subkeys that hold information about the current keyboard layout, which you can set using the Control Panel's Keyboard properties. The Preload subkey contains a value for each installed keyboard layout. These values point to keys in HKEY_LOCAL_MACHINE\System\ CurrentControlSet\Control\Keyboard Layouts, which contains references to the keyboard drivers.

Table continues on the next page




Contains two subkeys that describe the mapped network drives, including persistent connections and recent connections. These subkeys contain values for the connection type and the provider name of each connection.


This subkey contains information about the current user's installed printers. There may also be a subkey for each remote printer, if installed.


Contains address and profile subkeys for the user's dial-up and networking connections. The subkey itself contains global connection details, such as the area code and the number of redial attempts, whereas the Address and Profile subkeys contain settings for specific connection.


Contains the number of programs currently running on the computer.


Easily the largest key in the Registry, and one of the two Registry keys that are intended to be used for applications (the other is HKEY_LOCAL_MACHINE\Software). It contains vendor-specific subkeys that describe the current user's software settings and a raft of application-specific information that was previously stored in the Win.ini or custom vendor INI files under Windows 3.x. Each vendor subkey contains a separate subkey for each software application supplied by that vendor. The subkeys and values below them are completely determined by the vendor, but typically contain user preferences, histories, and so on.

Volatile Environment Contains environment variables related to the current logon session.

Volatile Environment Contains environment variables related to the current logon session.

Of particular interest to VB and VBA programmers is HKEY_CURRENT_USER\Software\VB and VBA Program Settings, which has been set aside specifically for them. Naturally, you will find this key mirrored in HKEY_USERS\current user subkey\Software\VB and VBA Program Settings.


The HKEY_LOCAL_MACHINE branch contains all the computer-specific settings, including hardware configuration and any computer-specific settings for installed software. In Windows XP, there are five major subkeys in this branch, which are described in the following table.

Subkey Description

Hardware Contains profiles for all the hardware that has been installed on the com puter, such as device drivers, resources like IRQ assignments, and other details. All the information contained is built during startup and deleted during shutdown. That being the case, use this subkey only for viewing, not for writing.

Subkey Description

SAM Contains all the user and group account information for the Security Account

Manager (SAM). The information in its subkeys is maintained in User Manager. It is also mapped to HKEY_LOCAL_MACHINE\Security, so changes to either are immediately reflected in the other. Do not attempt to change anything in here unless you want to reformat your hard disk afterward.

Security Contains all the security information for the computer, such as password policies, user rights and permissions, and the groups to which each user belongs. The information in its subkeys is maintained in User Manager. Do not attempt to change anything in here either.

Software Contains specific configuration information about the software installed on the computer. The entries under this subkey apply to all users, not just the current user, and contain information about what software is installed, and also define file associations and OLE information. Notice that this key has a subkey called Classes, which is an alias for HKEY_CLASSES_ROOT. In x64-based versions of Windows, there is a subkey called WOW6432Node, which stores 32-bit program settings on 64-bit Windows. Organization of the Registry on x64-based versions of Windows is discussed later, in the section "Registry Organization on x64-Based Windows."

System Contains other subkeys that contain the persistent information about devices and parameters that the system needs to start up, including control sets that contain information like the computer name, subsystems that need to be started, hardware configuration for devices and drivers that the operating system loads, specific hardware profile information when multiple hardware profiles are configured, file system services, and so on.

0 0

Post a comment