Frequently Asked Questions of Registry Workshop
- What is the relationship between registry hives and files?
- How can I edit registry on non-bootable Windows system?
- I can not delete a registry key, is there any way to work around this problem?
- Can I use abbreviation of root keys in the address bar?
- I see HKLM and HKU in the snapshot. What about HKCR, HKCU and HKCC?
What is the relationship between registry hives and files?
Windows maintains a list of which hives exist on a particular machine in HKLM\SYSTEM\CurrentControlSet\Control\hivelist. The following table lists standard registry hives and corresponding files.
Regisrty Hive | File |
HKLM\SAM | %SystemRoot%\System32\Config\SAM |
HKLM\SECURITY | %SystemRoot%\System32\Config\Security |
HKLM\SOFTWARE | %SystemRoot%\System32\Config\Software |
HKLM\SYSTEM | %SystemRoot%\System32\Config\System |
HKU\.DEFAULT | %SystemRoot%\System32\Config\DEFAULT |
HKU\SID | Documents and Settings\userName\NTUSER.DAT |
HKU\SID_Classes | Documents and Settings\userName\Local Settings \Application Data\Microsoft\Windows\UsrClass.dat |
How can I edit registry on non-bootable Windows system?
You can move the hard disk with the corrupted Windows to another computer, use the Load Hive function to load the registry hive and edit it.
I can not delete a registry key, is there any way to work around this problem?
If you are sure it's not a permission problem, you can try the following steps.
- Select any registry key and export the key to a registry hive file. For performance reason, please do not select a key contains a lot of subkeys and values.
- Select the parent key of the key you want to delete. If there are other keys and values in the parent key, move these keys and values to other place or export to a REG file.
- Import the registry hive file on top of the parent key. This operation will overwrite everything in the parent key.
- Delete the imported keys and values and restore the old content.
Can I use abbreviation of root keys in the address bar?
Yes, you can use following abbreviations.
Root Key | Abbreviation |
HKEY_CLASSES_ROOT | HKCR |
HKEY_CURRENT_USER | HKCU |
HKEY_LOCAL_MACHINE | HKLM |
HKEY_USERS | HKU |
HKEY_CURRENT_CONFIG | HKCC |
I see HKLM and HKU in the snapshot. What about HKCR, HKCU and HKCC?
HKLM and HKU contain all registry data. HKCR, HKCU and HKCC are just links.
Root Key | Equivalent |
HKCR | HKCU\Software\Classes + HKLM\SOFTWARE\Classes |
HKCU | HKU\SID |
HKCC | HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\Current |