book

Managing The Windows 2000 Registry

by Paul Robichaux

August 2000

Intermediate to advanced

558 pages

16h 53m

English

O'Reilly Media, Inc.

Read now

Unlock full access

Keys and Values and Classes, Oh My!
A Brief History of the RegistryWindows 3.0The First Registry: Windows 3.1Windows NT 3.1, 3.5, and 3.51Windows 95 and 98Windows NT 4.0Windows 2000
It Holds Lots of Important StuffHardware configuration dataDriver parameters and settingsDynamic dataUser profiles and user-specific settingsSystem and group policiesOLE, ActiveX, and COMApplication settings
It Keeps Everything TidyIt Provides SecurityIt Allows Remote Management

How the Registry Is StructuredThe BasicsRoot keysSubkeysValuesHivesLinksRegistry road mapThe Big SixHKEY_LOCAL_MACHINEHKEY_USERSHKEY_CURRENT_USERHKEY_CLASSES_ROOTHKEY_PERFORMANCE_DATAHKEY_CURRENT_CONFIGHives and FilesAccess Controls and SecurityControl via Registry APIsRemote-access controlOS-level security controlsSystem Key Security (SYSKEY)Major DatatypesREG_DWORDREG_SZREG_MULTI_SZREG_EXPAND_SZREG_BINARYREG_LINKREG_QWORDMinor DatatypesREG_NONEREG_DWORD_BIG_ENDIANREG_FULL_RESOURCE_DESCRIPTORREG_RESOURCE_LIST
Major Subkeys of HKLMHARDWARESECURITYSOFTWARESOFTWARE\PoliciesSYSTEMSYSTEM\CurrentControlSetMajor Subkeys of HKCUAppEventsConsoleControl PanelEnvironmentIdentitiesKeyboard LayoutPrintersRemote AccessSoftwareSYSTEMOtherMajor Subkeys of HKCCWhat About the Other Root Keys?
Don’t Panic!
Make BackupsBe Prudent
What Is an ERD?What ERDs Can and Can’t DoHow to Make an ERDUsing Windows 2000 BackupUsing NT’s RDISK utilityHow to Repair Your Registry with an ERDUsing the Windows 2000 setup utilityUsing the Windows 2000 recovery consoleUsing RegEdt32Using NT ’s setup application
But What Needs Backing Up?The Old-Fashioned WayUsing Windows 2000 BackupUsing Windows NT BackupUsing REGBACKUsing RegEdt32Using Text FilesUsing RegEdt32Using REGDUMPUsing RegEdit
The Old-Fashioned WayUsing Windows 2000 BackupUsing REGRESTUsing RegEdt32 and RegEditLoading hivesReloading saved keysUsing RegEdit files
Know Your Limitations
Don’t I Know You from Somewhere?Interface Trivia
Navigating with the KeyboardUsing the Context Menu
A Word About the ClipboardModifying ValuesModifying a string valueModifying a DWORD valueModifying a binary valueAdding New Keys or ValuesDeleting Keys or ValuesRenaming Keys or ValuesWhat Were They Thinking, or, the Favorites Menu
What’s in a .REG File?Exporting Registry DataImporting Registry DataCreating Your Own .REG FilesA concrete exampleSafely experimenting with .REG files
Exporting DataImporting Data
How RegEdt32 and RegEdit Differ
Manipulating WindowsControlling What You SeeSetting Session Options
Navigating with the Keyboard
Connecting to Remote Computers
Saving KeysRestoring KeysLoading Saved Keys as HivesSaving as TextProviding an Improvised ClipboardA True Story
Viewing Values as Binary DataModifying ValuesModifying a string valueModifying a DWORD valueModifying a multiple-string valueModifying a binary valueModifying a value of a different typeAdding New Keys or ValuesAdding new keysAdding new valuesDeleting Keys and Values
Basic Registry PermissionsApplying ACLs
Setting PermissionsAdding, removing, and changing ACE entriesSeeing and controlling permission inheritanceAuditing Registry ActivityAdding, removing, and changing auditing entriesSeeing and controlling audit control inheritanceChanging Key Ownership
Setting PermissionsAuditing Registry Key ActivityEnabling auditing on an NT machineTelling RegEdt32 what to auditReviewing the audit recordsChanging Key Ownership
All About System PoliciesWhy Is This in a Windows 2000 Book?What’s a Policy?Categories contain one or more policiesPolicies are made of partsHow are policies defined?User versus machine policiesHow Are Policies Stored?How Are Policies Applied?The default policyApplying computer and user policiesApplying group policies
Learning the System Policy Editor InterfaceControlling what you seeNavigating in the policy window
Attaching Policy TemplatesCreating PoliciesCreating a new policy fileCreating a new user policyCreating a new computer policyCreating a new group policyEditing PoliciesSetting user, group, and computer policy optionsRemoving user policiesPolicies and the clipboardSetting group policy prioritiesSaving and Loading PoliciesCreating Your Own Policy Templates
Applying Policies to One Machine at a TimeSetting policies on the local machineSetting policies on other computersApplying Policies to Many MachinesEnabling automatic policy updatesWindows NT policiesWindows 95/98 policiesWindows 2000 policiesSupporting multiple domain controllersPreventing Policy ProblemsMake sure the files are in the right placeIs automatic updating on?Implement policies in all domains or noneCheck group membership and namesVerify which policies are in effect
WINNT.ADMCOMMON.ADMWINDOWS.ADM
Policies for AnybodyPolicies for a Lab NetworkPolicies for an “Ordinary” Office
What Are Group Policies?Elements of a Group PolicyUser Versus Machine PoliciesDefining Group Policy ObjectsThe local GPOPolicies and the Active DirectoryHow Are Policies Stored?The structure of the Group Policy TemplateHow Are Policies Applied?Applying computer and user policiesOrder of policy file application
Adding the Group Policy Snap-inLearning the Group Policy Snap-in InterfaceControlling what you seeNavigating the console treeViewing policy properties
What Is an Administrative Template?Adding Administrative TemplatesEditing PoliciesCreating Your Own Administrative Templates
Understanding How Effective Policies Are CalculatedPolicy InheritanceManaging Dispersal Through Group Policy PoliciesSetting Single Computer Group PoliciesSetting Nonlocal Group Policies
The Registry APIAPI Concepts and ConventionsInput and output parametersRegistry error codesWhy some calls have names ending in “Ex”“Happy families are all alike”New and exciting datatypesNew routines = new datatypesUser-specific keysAn extremely brief exampleOpening and Closing KeysOpening keysOpening a key while impersonating another userOpening the user’s class dataClosing keysCreating KeysGetting Information About KeysEnumerating Keys and ValuesEnumeration strategiesEnumerating keysEnumerating valuesGetting Registry DataGetting a single valueGetting multiple valuesAdding and Modifying ValuesDeleting Keys and ValuesDeleting a keyDeleting a valueUsing Registry Security InformationSetting an item’s security informationConnecting to Remote ComputersMoving Keys to and from HivesSaving keysLoading keysReplacing a loaded keyUnloading a keyGetting Notification When Something ChangesFlushing Registry Changes
Working with File AssociationsGetting a file association key from the RegistryGetting a pointer to the IQueryAssociations interfaceCopying and Deleting Keys and ValuesGetting Key and Value InformationQuerying keys and valuesGetting and setting valuesEnumerating Keys and ValuesWorking with User-Specific KeysCreating and removing keysOpening and closing keysGetting key and value informationReading valuesWriting and deleting valuesLeftovers
Example: Watching a Key for ChangesHow the code worksPossible enhancementsExample: A Stack-Based Wrapper ClassHow the code worksPossible enhancementsExample: Loading a Control with a Set of Values
The Win32API::RegXXX FunctionsWhen to use themThe Win32::TieRegistry ModuleA few Perl-ismsThe code in detailOpening and closing keys and retrieving valuesCreating, adding, and modifying keys and valuesEnumerating keys and valuesDeleting keys and valuesSaving and loading keysMixing Win32API::Registry and Win32::TieRegistryExample: Walking the Registry
Talking with the Outside World in VBDLL interfacesA few more subtletiesUsing the Registry with VBThe VBA functionsUsing WINREG.BASExample: A RegEdit CloneCreating the initial treeExpanding the treeDisplaying values
Setting Defaults for New User AccountsUnder Windows 2000Under Windows NT
How Does Mapping Work?Setting Up Your Own MappingsAdding the mapping keyMapping key tricksA mapping sample
Turning Off Remote Access EntirelyLimiting Access to Authorized UsersCreating the restriction keySetting permissions on the restriction keyAllowing exceptions
What SYSKEY DoesBefore You Enable SYSKEY on Windows NT“What I tell you three times is true”Upgrading domain controllersTurning On SYSKEY ProtectionChanging the Key Storage MethodRestoring a SYSKEY-Protected NT RegistryRestore SYSTEM and SAM hivesGet the right system componentsWhich ERD should I use?
Changing the Registry SizeAuditing Registry AccessMaking sense of the audit logTracking software installations or reinstallationsGuarding against Trojan horses
The Windows 2000 Resource KitThe Windows NT Resource Kit
Using the Windows 2000 Version of regQuerying keysAdding keys and valuesDeleting keys and valuesCopying keys and valuesSaving and restoring keysLoading and unloading hivesComparing keys and valuesExporting and importing Registry dataUsing the Windows NT Version of regQuerying keysAdding new keysUpdating existing keysRemoving a keyCopying keys and valuesSaving and restoring keysLoading and unloading hivesComparing Keys and Values with COMPREGSearching for Keys with regfind
Learning the RegMon InterfaceControlling what you seeSome other useful Edit menu commandsCapturing and FilteringTurning capture on and offUsing capture filtersSaving your captured dataLogging boot-to-boot activity
User Interface TweaksAdd Your Own “Tip of the Day”Disable Window AnimationsSpeed Up the TaskbarEnable Tab for Filename CompletionRun a Different Screen Saver While Waiting for a LogonEnable X Window-Style “Auto Raise”Enable “Snap to Default Button”Suppress Error Messages During Boot and LogonSet NUMLOCK Key During StartupDisplay Version Number
Change Low Disk Space Warning ThresholdUse Longer File ExtensionsTurn Off CD-ROM AutoRunSuppress “Last Access” Timestamp on NTFS Volumes
Clear the System Pagefile at ShutdownPrevent Caching of Logon CredentialsTurn Off “Save Password” Option in Dial-Up NetworkingPrevent Users from Changing Network Drive MappingsControl Who Can See Performance Monitor DataControl Which Drives Are Visible Throughout the SystemChange When the Password Expiration Warning AppearsAllow Members of the Printer Operators Group to Add PrintersSet the Number of Authentication Retries for Dial-Up ConnectionsKeep Users from Changing Video ResolutionsSet the Authentication Timeout for Dial-Up ConnectionsKeep Remote Users from Sharing a Mounted CD-ROM or FloppyKeep Users from Customizing “My Computer”
Automatically Delete Cached User ProfilesEnable Automatic Reboot After a CrashRecord Evidence of a CrashEnabling Automatic Logon After BootPower Off at ShutdownForce Hung Tasks to End When Logging OffSet a Time Limit for Shutting Down TasksSpeed Up System ShutdownsAutomatically Try to Detect Slow Network ConnectionsDon’t Automatically Create 8.3 Names on NTFS VolumesDisable the Printer Browse ThreadForcibly Recover a Crashed PDCHiding Servers from Network Computers
Create a Shared Favorites Folder for All Network UsersAutomatically Use Dial-Up Networking to Log OnEnable the WINS Proxy AgentSet the Number of Rings for Answering Incoming Dial-Up Networking CallsTurn On Logging for Dial-Up NetworkingKeep a Dial-Up Networking Connection up After You Log OutSet the Dial-Up Networking Automatic Disconnect Timer
Keep the Print Spool Service from Popping Up DialogsChange the Print Spool DirectoryStop Print Job Logging in Event Log
What’s Here and What’s Not
HARDWARE\DESCRIPTIONHARDWARE\DEVICEMAPHARDWARE\RESOURCEMAP
SOFTWARE\Classes\CLSIDSOFTWARE\MicrosoftMicrosoft\ActiveSetupMicrosoft\CryptographyMicrosoft\ NtBackupMicrosoft\RASSOFTWARE\Microsoft\Windows NTCurrentVersion\ AeDebugMultimedia driver stuffCurrentVersion\Network CardsCurrentVersion\ ProfileListCurrentVersion\ ShutdownCurrentVersion\Winlogon
SYSTEM\CurrentControlSet\Hardware ProfilesSYSTEM\CurrentControlSet\ControlControl\BackupRestoreControl\BootVerificationProgramControl\ClassControl\CrashControlControl\EnumControl\FileSystemControl\HivelistControl\LSAControl\PrintControl\SecurePipeServersControl\Session ManagerControl\Session Manager\ Memory ManagementSYSTEM\CurrentControlSet\ServicesServices\BrowserServices\DHCPServerServices\EventLogServices\LanmanServerServices\NetBtServices\NetlogonServices\RasManServices\ReplicatorServices\Tcpip
HKU\.DEFAULTHKU\sid
HKCR\extHKCR\ fileTypeHKCR\CLSID
HKCU\ AppEventsHKCU\ConsoleHKCU\Control Panel ItemsHKCU\EnvironmentHKCU\PrintersHKCU\Software\MicrosoftMicrosoft\ NtBackupMicrosoft\ RAS AutodialMicrosoft\RAS MonitorMicrosoft\RAS PhonebookMicrosoft\Windows\CurrentVersionMicrosoft\Windows NT\CurrentVersionHKCU\Microsoft\Windows NT\CurrentVersion
Administrative TemplatesWindows ComponentsNetMeetingInternet ExplorerInternet Control PanelOffline PagesBrowser MenusToolbarsPersistance BehaviorAdministrator Approved ControlsWindows ExplorerCommon Open File DialogMicrosoft Management ConsoleRestricted/Permitted snap-insTask SchedulerWindows InstallerStart Menu & TaskbarDesktopActive DirectoryActive DesktopControl PanelAdd/Remove ProgramsDisplayPrintersRegional OptionsNetworkOffline FilesNetwork and Dial-up ConnectionsSystemLogon/LogoffGroup Policy
Windows SettingsSecurity SettingsRestricted GroupsSystem ServicesRegistryFile SystemAccount PoliciesPassword PoliciesAccount Lockout PolicyKerberos PolicyLocal PoliciesAudit PolicyUser Rights AssignmentSecurity OptionsEvent LogSettings for Event Logs
Windows ComponentsNetMeetingInternet ExplorerTask SchedulerWindows InstallerSystemLogonDisk QuotasDNS ClientGroup PolicyWindows File ProtectionNetworkOffline FilesNetwork & Dial-Up ConnectionsPrinters

Content preview from Managing The Windows 2000 Registry

Introducing the Group Policy Snap-in

For defining and controlling how various components of Windows 2000 behaves for users and computers, Group Policy is used. Group Policy is a Microsoft Management Console (MMC) snap-in that allows you to manage the behavior of programs, network resources, and the operating system.

Tip

Under Windows NT 4.0, the System Policy Editor creates and edits system policies. While this editor is supplied in Windows 2000, its use is limited to supporting downlevel clients. Since it creates Windows NT 4.0-style system policy files, you still need it to support NT domains. Additionally, it’s useful if you have Windows NT 4.0, 95, or 98 clients in your AD domains.

Adding the Group Policy Snap-in

To add the Group Policy snap-in to the MMC, run mmc.exe. From the Console menu in the MMC, choose Add/Remove Snap-in. Click the Add button on the Standalone tab and select Group Policy from the list of snap-ins provided. You’re then required to choose a Group Policy Object to edit. Remember that group policy objects can be stored locally on a computer or can be linked to an Active Directory organizational unit, domain, or site. The Select Group Policy Object dialog defaults to the local computer as the target GPO but allows you to browse through domains, OUs, sites, and computers to select the GPO you’re interested in editing.

Once you’ve decided on a GPO, click the Finish button and close the list of provided snap-ins. If everything went well, you’re back on the Standalone ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Start your free trial

Microsoft® Windows® 2000 Security Handbook

Publisher Resources

ISBN: 1565929438Supplemental Content Catalog Page Errata

Managing The Windows 2000 Registry

by Paul Robichaux

Introducing the Group Policy Snap-in

Tip

Adding the Group Policy Snap-in

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

You might also like

Microsoft® Windows® 2000 Security Handbook

Windows Registry Troubleshooting

Windows Server® 2012 Unleashed

Windows Installation and Update Troubleshooting

Publisher Resources

Introducing the Group Policy Snap-in

Tip

Adding the Group Policy Snap-in

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,and much more.

You might also like

Microsoft® Windows® 2000 Security Handbook

Windows Registry Troubleshooting

Windows Server® 2012 Unleashed

Windows Installation and Update Troubleshooting

Publisher Resources

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.