Windows 95 Registry Overview

Archived content. No warranty is made as to technical accuracy. Content may contain URLs that were valid when originally published, but now link to sites or pages that no longer exist.

This chapter presents background information about the structure of the Registry, and how values from Windows 3.x INI files are stored in the Registry. Notice, however, that no descriptions of individual Registry entries are provided, because such details are beyond the scope of the Windows 95 Resource Kit.

Caution Wherever possible, use Control Panel or System Policy Editor to ensure values are stored properly in the Registry when changing the configuration. If you use Registry Editor to change values, you will not be warned if any entry is incorrect.

The Windows 95 Registry provides a unified database for storing system and application configuration data in a hierarchical form. Because the Registry contains all settings required to configure memory, hardware peripherals, and Windows 95-supplied network components, you may find that it is no longer necessary to configure settings in startup configuration and initialization files. Also, because settings are stored in a central location, you can provide both local and remote support for system configuration using Windows 95 tools.

The Registry is roughly analogous to the INI files used under Windows 3.x, with each key in the Registry similar to a bracketed heading in an INI file and with Registry values similar to entries under the INI headings. However, Registry keys can contain subkeys, while INI files do not support nested headings. Registry values can also consist of binary data, rather than the simple strings used in INI files.

Although Microsoft discourages using INI files in favor of Registry entries, some applications (particularly 16-bit Windows-based applications) still use INI files. Windows 95 supports INI files solely for compatibility with those applications and related tools (such as setup programs). The AUTOEXEC.BAT and CONFIG.SYS files also still exist for compatibility with real-mode system components and to allow users to change certain default system settings such as the PATH environment variable. New Win32-based applications can store their initialization information in the Registry.

The Registry provides the following benefits in Windows 95:

  • A single source provides data for enumerating and configuring the hardware, applications, device drivers, and operating system control parameters. The configuration information can be recovered easily in the event of system failure.

  • Users and administrators can configure computer options by using standard Control Panel tools and other administrative tools, reducing the likelihood of syntactic errors in configuration information.

  • A set of network-independent functions can be used to set and query configuration information, allowing system administrators to examine configuration data on remote networked computers.

  • The operating system automatically backs up the last good configuration used to start the computer.

Because user-specific Registry information can be maintained on a central network server when user profiles are enabled, users can have access to personal desktop and network access preferences when logging on to any computer, and settings for multiple users can be maintained on a single computer. Also, system policies can be used to enforce certain Registry settings for individuals, workgroups, or all users. For information see Chapter 15, "User Profiles and System Policies."

On This Page

Getting Started with Registry Editor
How Windows 95 Components Use the Registry
Registry Structure
Hkey_Current_User and Hkey_Users
Hkey_Current_Config and Hkey_Dyn_Data
Initialization Files and the Registry

Getting Started with Registry Editor

To get the most out of the material in this chapter, you will want to run Registry Editor while you are reading so that you can see the contents of the Registry on your computer. By default, Registry Editor does not appear in any menu or on the desktop. Notice, also, that Registry Editor (REGEDIT.EXE) is copied to the Windows directory automatically when Windows 95 is installed from a compact disc. Registry Editor is not available with the Windows 95 floppy disks.

Tip You can add the Registry Editor icon to your desktop by using the right mouse button to drag REGEDIT.EXE from Windows Explorer to the desktop.

To run Registry Editor

  • Double-click the Registry Editor icon (from your desktop, or from the Windows directory in Windows Explorer or in My Computer).

    – Or –

    From the Start menu, click Run and type regedit

To find specific data in the Registry

  • In the Registry Editor window, double-click any folder icon for a Registry key to display the contents of that key.

    – Or –

    From the Edit menu, click Find. Then type all or part of the text string you want to find, and click options to specify whether you want to find a key name, an entry name, or data.

    After Registry Editor finds the first instance of the text string, you can press F3 to search for the next instance.

Registry Editor can be used to view or modify a Registry on a local computer or on another computer over a network. Both the administrator's computer and the remote computer require the Microsoft Remote Registry service to allow remote Registry access. For more information about installing and taking advantage of the Microsoft Remote Registry service, see Chapter 16, "Remote Administration."

Tip for Disabling Direct Editing of the Registry

The network administrator can restrict users from being able to use Registry Editor to modify the Registry by setting a system policy named Disable Registry Editing Tools. Notice, however, that this policy does not prevent the administrator or another user from modifying the Registry by using System Policy Editor. For more information about this restriction and about using System Policy Editor to modify the Registry on individual or multiple computers, see Chapter 15, "User Profiles and System Policies."

How Windows 95 Components Use the Registry

With Windows 95, the operating system stores and checks the configuration information in the Registry for most configuration settings during system startup. The following figure provides an overview of how various Windows 95 components and applications use the Registry.


  • Whenever you run Windows 95 Setup, use the Add New Hardware option in Control Panel, or run other setup programs for hardware, the Windows 95 Configuration Manager places hardware configuration data in the Registry. This information includes a list of hardware detected in the computer.

  • When you install Windows 95 in the same directory as an earlier version of Windows, your previous desktop settings are moved from INI files to the Registry. When you make changes to the desktop configuration, the settings are added to the Registry.

  • Each time you add or remove a Plug and Play-compliant device on a computer running Windows 95, configuration data is added to the Registry. For example, new information is added when you install a PCMCIA modem.

  • Device drivers send and receive load parameters and configuration data from the Registry. This data is similar to settings defined under MS-DOS by device= lines in CONFIG.SYS.

  • System policies, user profiles, and administrative tools such as the Windows 95 Control Panel can be used to add or modify configuration data. Registry Editor can be used to view and occasionally change the system configuration.

A set of Registry APIs can make information available through remote procedure calls (RPC) to Windows 95 management tools from other vendors. This permits administrators to view and modify configuration information remotely for hardware and software components that store information in the Registry. Notice that the Registry APIs are accessible remotely using named pipes (client-side only), NetBIOS over NetBEUI, Windows Sockets on IPX, and Windows Sockets on IP.

Registry Structure

Registry Editor displays the contents of the Registry database in six subtrees. The hierarchical structure that appears in Registry Editor is similar to how Windows Explorer displays hierarchical directory structures.

This section describes the hierarchical organization of the Registry and defines the overall structure of keys and value entries. The actual contents or location of a specific Registry subkey may differ from what is described here, depending on the services and software are installed. However, this description of the general organization will help you understand how to navigate the Registry.

Registry Hierarchy

The Windows 95 Registry structure represents database information specific to the computer and to individual users. The computer-specific information includes setting for hardware and software installed on the computer. The user-specific information includes settings in user profiles, such as desktop settings, preferences for certain software, and personal printer and network settings.

In the Registry, each individual key can contain data items called value entries and can also contain additional subkeys, with keys roughly analogous to directories, and value entries analogous to files. Each of the root key names begins with "Hkey_" to indicate to software developers that the key is a unique identifier, called a handle, that can be used by a program to access resources.

The following briefly describes the Registry subtrees. More details are provided later in this chapter.



This key contains computer-specific information about the type of hardware installed, software settings, and other information. This information is used for all users who log on to this computer.


This key points to a branch of Hkey_Local_Machine \Config that contains information about the current configuration of hardware attached to the computer.


This key points to a branch of Hkey_Local_Machine that contains the dynamic status information for various devices as part of the Plug and Play information. This information may change as devices are added to or removed from the computer. The information for each device includes the related hardware key and the device's current status, including problems.


This key points to a branch of Hkey_Local_Machine that describes certain software settings. This key displays the same data as it did in Windows 3.1 — essential information about OLE and association mappings to support drag-and-drop operations, Windows 95 shortcuts (which are, in fact, OLE links), and core aspects of the Windows 95 user interface.


This key contains information about all the users who log on to the computer, including both generic and user-specific information. The generic settings are available to all users who log on to the computer. The information is made up of default settings for applications, desktop configurations, and so on. This key contains subkeys for each user that logs on to this computer.


This key points to a branch of Hkey_Users for the user who is currently logged on.

Value Entries in the Registry Keys

Registry Editor displays data in two panes. The value entries in the right pane are associated with the selected key in the left pane.


A value entry has three parts: the data type of the value (which appears as an icon), the name of the value, and the value itself. A value entry cannot be larger than about 64K. The limit to total Registry size depends on available hard disk space.

The following table lists the data types currently used by the system.

Data type




Binary data. Most hardware component information is stored as binary data, and can be displayed in Registry Editor in binary or hexadecimal format. For example, Int 13: 01.



A sequence of characters representing human-readable text. For example, BitsPerPixel: "8".

Registry Files

The Registry is logically one data store, but physically it consists of two different files to allow maximum flexibility for network configurations:

  • User-specific information is contained in USER.DAT. The information in this file is reflected in user profiles, as described in Chapter 15, "User Profiles and System Policies."

  • Hardware-specific and computer-specific settings are contained in SYSTEM.DAT. This information is reflected in hardware profiles and in the settings displayed in Device Manager, as described in Chapter 19, "Devices."

System policies can override settings in these two .DAT files to enforce user-specific and computer-specific information, as described in Chapter 15, "User Profiles and System Policies."

By default, USER.DAT and SYSTEM.DAT are stored in the Windows SYSTEM subdirectory, but these two files can be located in physically different locations. For example, if user profiles are enabled, SYSTEM.DAT can be stored on the local hard disk and USER.DAT stored in each user's logon directory on the network, allowing "roving" users to maintain the same desktop preferences wherever they log on to the network. For shared installations, these files are stored in the machine directory.

For information about how Windows 95 chooses between local and network versions of USER.DAT when loading a user profile, see Chapter 15, "User Profiles and System Policies."

Recovering Registry Data

In Windows 95, data is written to the Registry only when a flush occurs — that is, when something happens after changed data has aged more than a few seconds or when an application intentionally flushes the data to the hard disk.

Each time Windows 95 successfully starts, the operating system backs up the Registry by copying the current SYSTEM.DAT and USER.DAT files to SYSTEM.DA0 and USER.DA0, respectively. If Windows 95 fails to start, the backed-up Registry from the last successful startup can be copied over the current Registry. This method recovers the last successful settings after a system failure.

Saving and Restoring the Registry

The Registry can be exported, imported, or recreated using either the Windows-based version of Registry Editor or the real-mode version on the Windows 95 emergency startup disk. By using the export capabilities of Registry Editor, a specific branch or the entire Registry can be saved in text format as a .REG file. A branch of or the entire Registry can be restored by importing a .REG file that was created by exporting the Registry.

If you are exporting or importing Registry files using the Windows-based version of Registry Editor, use the Export and Import commands from the Registry menu. The information in online Help can guide you through this process.

In rare circumstances when the Registry is badly corrupted, you can start the computer using the Windows 95 startup disk. Then you can use the real-mode REGEDIT.EXE utility on the startup disk to import a .REG file. In this case, the following command syntax can be used at the command prompt.

regedit [**/L:system] [/R:**user] file1.reg, file1a.reg...

regedit [**/L:system] [/R:user] /e file3.reg [regkey]
regedit [
/L:system] [/R:**user] /c file2.reg



/L: system

Specifies the location of SYSTEM.DAT.

/R: user

Specifies the location of USER.DAT.


Specifies one or more .REG files to import into the Registry.

/e file3.reg

Specifies the filename to which the Registry should be exported.


Optionally, specifies the starting Registry key from which to export a portion of the Registry. If no value is specified, regedit /e exports the entire Registry.

/c file2.reg

Specifies the .REG file to use to replace the entire contents of the Registry.

Caution: Use the regedit /c option with extreme care, and only when you are sure that the specified .REG file contains a complete image of the Registry.

Also, the Windows 95 Resource Kit does not provide sufficient information to guide you through the process of editing an .REG file, so it is recommended that you undertake editing an .REG file only under the guidance of your product support representative.


Hkey_Local_Machine contains the configuration data for the local computer. The information in this database is used by applications, device drivers, and Windows 95 to determine configuration data for the local computer, regardless of which user is logged on and what software is in use.

Hardware devices can place information in the Registry automatically using the Plug and Play interface. Software for installing device drivers can place information in the Registry by writing to standard APIs. Users can place information about hardware in the Registry by using the Add New Hardware option and other options in Control Panel, or by using Device Manager, as described in Chapter 19, "Devices."

Hkey_Local_Machine contains several subkeys, as listed briefly in the following table. The rest of this section provides details about some of these keys.

Subkey name



A collection of configurations for the local computer


Information about hardware devices on the system


Information about serial ports and modems used with the Terminal program


Network information created when a user logs on to a networked computer, including the user name, primary network provider, whether the logon was validated by a server, and information about the system policies processor


Information about the network security provider and remote administration capabilities


The computer-specific information about software installed on the local computer, along with miscellaneous configuration data


The database that controls system startup, device driver loading, Windows 95 services, and operating system behavior

Config Subtree in Hkey_Local_Machine

The Hkey_Local_Machine \Config subtree contains information about alternate hardware configurations for the computer. For example, it can contain information about multiple configurations to be used when the computer is connected to a network, when it is undocked from a docking station, and so on. Each alternate configuration is assigned a unique identifier, and this configuration ID has a subkey under the Config key. Each configuration appears in the list of hardware profiles in the System option in Control Panel.

When Windows 95 checks the hardware configuration at system startup, one of three things occurs:

  • In most situations, the configuration ID is mapped to a unique configuration and Windows 95 selects the appropriate one automatically, and the settings for the related Config subkey are used for system configuration.

  • If the user is starting the computer for the first time with new hardware components, Windows 95 creates a new configuration for the new configuration ID, and a new Config subkey is added to the Registry.

  • If the configuration ID is mapped to more than one configuration (for example, because Windows 95 cannot distinguish between two configurations), the user is prompted to choose which configuration to use.

Enum Subtree in Hkey_Local_Machine

Windows 95 bus enumerators are responsible for building the hardware tree. This includes assigning an identification code to each device on its bus and retrieving the device's configuration information, either directly from the device or from the Registry. For more information about the hardware tree and bus enumerators, see Chapter 18, "Introduction to System Configuration," and Chapter 31, "Windows 95 Architecture."

Bus enumeration information is stored in the Hkey_Local_Machine \Enum subtree. For all types of devices, subkeys contain information such as device type, assigned drive letter, hardware ID, and device manufacturer, plus driver-related information for network components.

The following table shows which devices are enumerated in typical subkeys.


Device enumeration


Fixed disk devices


Floppy disk devices


Plug and Play devices on an ISA bus


Monitor devices


Network protocol, server, and bindings


Legacy devices

Software Subtree in Hkey_Local_Machine

The Hkey_Local_Machine \Software subtree contains configuration information about all installed software that can write information in the Registry. The entries in this key apply for anyone using this particular computer, and include definitions for file associations and OLE information.

The software subkey contains, for example, the information you add when registering an application to use a specific filename extension and information added during installation of Windows-based applications.

The Hkey_Local_Machine \Software subtree contains several subkeys, including the Classes subkey, plus description subkeys for all installed software that can write to the Registry, as described in the following sections.

Classes Subkey

The Hkey_Local_Machine \Software \Classes subkey defines types of documents and provides information about OLE and filename-extension associations that can be used by applications. Hkey_Classes_Root is an alias for this subkey.

Hkey_Classes_Root merely points to Hkey_Local_Machine \Software \Classes. The sole purpose for Hkey_Classes_Root is to provide compatibility with the Windows 3.x registration database.

The Classes subkey contains two types of subkeys:

  • Filename-extension subkeys, which specify the class-definition associated with files that have the selected extension.

  • Class-definition keys, which specify the shell and OLE properties of a class (or type) of document. If an application supports Dynamic Data Exchange (DDE), the Shell subkey can contain Open and Print subkeys that define DDE commands for opening and printing files, similar to the OLE and DDE information stored in the Registry under earlier versions of Windows. In the following illustration, c:\windows\notepad.exe %1 is the print command, and the %1 parameter stands for the selected filename in Windows Explorer when the command is carried out.


Description Subkeys

The various Hkey_Local_Machine \SoftwareDescription subkeys contain the names and version numbers of the software installed on the local computer (if that software writes information to the Registry as part of its installation process). User-specific information about the configuration of an application is stored at the same relative path under Hkey_Current_User.

Important: The information in each subkey is added by the related application. Do not edit entries in these subkeys unless directed to do so by your application vendor.

During installation, applications record this information in the following form:

Hkey_Local_Machine \SoftwareCompanyName\ProductName\Version

The key named Hkey_Local_Machine \Software \Microsoft and its subkey named Windows\CurrentVersion are of particular interest. These subkeys contain information about software that supports services built into Windows 95.


The Setup subkey under Hkey_Local_Machine \Software \Microsoft \Windows \CurrentVersion is used internally by Windows 95 for its Setup program.

System Subtree in Hkey_Local_Machine

The data in Hkey_Local_Machine \System is organized into control sets that contain a complete set of parameters for device drivers and services that can be loaded with Windows 95.

All data that controls startup is described in the CurrentControlSet subtree under Hkey_Local_Machine \System. This control set has two parts:

  • The Control key contains information used to control system startup, including the computer's network name and the subsystems to start.

  • The Services key contains information to control the loading and configuration of drivers, file systems, and so on. The data in the Services key also controls how these services call each other.

Control Subkey

The Control subkey contains startup parameters for the system, including settings for startup and shutdown, file system performance, keyboard layouts and language support, and so on. The following table describes some typical subkeys.




The computer name, which should be set using the Network option in Control Panel


The type and settings of the file system


The identification for the current configuration

Keyboard layouts

A list of the DLLs for the keyboard language, which should be set using the Keyboard option in Control Panel

Media Resources

Descriptions and driver information for multimedia components


Descriptions of the network providers


Information on national language support, including language and locale preferences, which should be set using the Keyboard option in Control Panel


Statistics gathered from system components that can be viewed using System Monitor


Information about the current printers and printing environment, contained in several subkeys:
• Environments, which contains subkeys defining drivers and print processors for operating system environments
• Monitors, which can contain subkeys with data for specific network printing monitors
• Printers, which can contain subkeys describing printer parameters for each installed printer
• Providers, which can contain subkeys describing DLLs for network print services

Session Manager

Global variables that are maintained by the operating system, plus subkeys that list applications that do not run well under Windows 95, DLLs whose version numbers should be checked, and directories and filenames for all the Session Manager DLLs


Values for time zone settings, which should be set using the Date/Time option in Control Panel


Value indicating whether Windows 95 was installed over an earlier version of Windows


The filenames of VxD files combined into the VMM32.VXD virtual device driver

Services Subkey for CurrentControlSet

The Services subkey in CurrentControlSet lists the Kernel device drivers, file system drivers, and Windows 95 service drivers that can be loaded at startup. The Services subkey also contains subkeys with static descriptions of hardware to which drivers can be attached. The following table shows some typical Services subkeys.




Subkeys for each installed system agent, such as Microsoft Network Monitor, SNMP, or network backup agents


Subkeys for arbitrators required to manage resources between competing devices, usually including address, DMA, I/O, and IRQ arbitrators


Subkeys for all classes of devices the operating system supports, such as disk drives, keyboard, display, mouse, and so on


Subkeys for 32-bit, protected-mode network providers, including logon and security provider information


Subkeys for all virtual device drivers, including disk drivers, network components, disk caches, and so on

Caution: Do not change these value entries using Registry Editor. These settings should be maintained only by the system. Settings for drivers that appear under the Services subkeys can be changed by using Control Panel or system policies.

Hkey_Current_User and Hkey_Users

Hkey_Users contains the .Default subkey plus all previously loaded user profiles for users who have logged on. The information in the .Default subkey is used to create the user profile for a user who logs on without a personal user profile. The .Default subkey contains keys for AppEvents, Control Panel, Keyboard layouts, Network, RunMRU, and Software, among others.

Hkey_Current_User contains the database with the user profile of the user who is currently logged on. A user profile ensures that the user interface and operation of Windows 95 will be the same on any computer where that user logs on, if that person's profile is available at that computer. For details about managing user profiles, see Chapter 15, "User Profiles and System Policies."

Hkey_Current_User contains all the information necessary to set up a particular user environment on the computer, such as application preferences, screen colors, and security access permissions. Many of these settings are the same kind of information that was stored in WIN.INI under Windows 3.x. Hkey_Current_User includes several subkeys, some of which are described in the following table.




Subkeys containing the path and filename of the system sound file that plays when specific system events occur

Control Panel

Subkeys containing Control Panel settings, including information stored in WIN.INI and CONTROL.INI under Windows 3.x

Keyboard layouts

A value entry defining the current active keyboard layout, which should be set by using the Keyboard option in Control Panel


Subkeys describing persistent and recent network connections


Subkeys listing the most recently used applications


Subkeys describing the current user's software settings, using the same structure as Hkey_Local_Machine \Software and containing application-specific information stored in WIN.INI or private initialization files under Windows 3.x


Subkeys for the most recently used documents

Whenever similar data exists in Hkey_Local_Machine and Hkey_Current_User, the data in Hkey_Current_User takes precedence. For example, settings for applications and the desktop defined by the current user take precedence over default settings.

Hkey_Current_Config and Hkey_Dyn_Data

The Hkey_Current_Config key points to the current system configuration in the collection of configurations stored in Hkey_Local_Machine \Config.

Some information in Windows 95 must be stored in RAM because it requires fast modification and retrieval that cannot wait for the Registry to flush to the hard disk. All this data can be found under Hkey_Dyn_Data.

The Hkey_Dyn_Data \Configuration Manager subkey, sometimes referred to as the hardware tree, is a record in RAM of the current system configuration. The information is drawn from the devices currently installed and loaded, or that failed loading. The hardware tree is created every time the system starts and updates whenever a change occurs to the system configuration. The information that appears in Registry Editor is provided when this key is displayed, so it is never out of date.

Hkey_Dyn_Data also contains statistics gathered for various network components in the system. These reside under Hkey_Dyn_Data \PerfStats.

VxDs from other vendors can provide dynamic data to this area too. For more information, see the Win32 Software Development Kit for Windows 95 and Windows NT.

Initialization Files and the Registry

Although the Registry replaces the basic function of the initialization files used in earlier versions of Windows, the SYSTEM.INI, WIN.INI, and WINFILE.INI files still appear in the Windows directory. These files continue to be used for compatibility with earlier Windows-based applications and device drivers. For example, entries in WIN.INI and SYSTEM.INI created by Win16-based applications are not updated in the Registry, because such applications do not know how to access the Windows 95 Registry.

If you install Windows 95 as an upgrade over Windows 3.1, some INI file settings are copied into the Registry, including settings from CONTROL.INI, PROGMAN.INI, SYSTEM.INI, and WIN.INI.

Some INI file entries are not moved to the Registry, but remain in the INI file for compatibility with Win16-based applications. Most of these entries can be changed without editing the INI files by using the graphical tools provided with Windows 95. However, some INI entries cannot be set using the Windows 95 user interface. These entries are required for some applications to function properly, but shouldn't need direct modification by users.

WIN.INI Settings in the Registry

Windows 95 migrates settings from configuration files into the Registry during Setup. The following table shows where WIN.INI entries migrated to the Registry. For information about specific WIN.INI entries moved during Windows 95 installation, see Chapter 6, "Setup Technical Discussion."

Registry Paths for Migrated WIN.INI Sections

WIN.INI section

Subkey in Hkey_Current_User


\Control Panel\Desktop


\Control Panel\Desktop



The following tables list entries retained in WIN.INI for compatibility with applications written for earlier versions of Windows. These values can be set using Control Panel and other tools in the Windows 95 interface.

Entries in WIN.INI Retained and Supported in the User Interface

[fonts]: font-name




[ports]: portname




[PrinterPorts]: device



















Entries in WIN.INI Retained but Not Supported in the User Interface

[embedding]: object




[FontSubstitute]: font-name=font-name




[Mail]: MAPI




[mci extensions]: extension




[Windows]: Load and Run




SYSTEM.INI Settings in the Registry

The following table lists SYSTEM.INI entries that are migrated to the Registry when Windows 95 is installed in the same directory as a previous version of Windows 3.x. For information about specific SYSTEM.INI entries related to loading VxDs and configuring network components, see Chapter 6, "Setup Technical Discussion."

Registry Paths for Migrated SYSTEM.INI Entries


Subkey in Hkey_Local_Machine






Software\CurrentControlSet\Services\VxD\transport entry























1 The equivalent of the Reconnect settings is stored in Hkey_Current_User \Persistent.

The following tables list entries that are retained in SYSTEM.INI for compatibility with applications written for earlier versions of Windows.

SYSTEM.INI Entries Retained and Supported in the User Interface



















Entries in SYSTEM.INI Retained but Not Supported in the User Interface





Local Reboot

















Entries written by applications