Windows Registry is an important database on the Windows operating system, which stores configuration and customization information of the system and the applications on it. It plays an important role in maintaining system stability and performance. On each version of Windows, the Registry always plays an important part in managing and adjusting the system's components. In this article, we are going to explore in more depth the Windows Registry, how it works, and how to take advantage of it effectively.

1. What is the Windows Registry?

The Windows Registry is a hierarchical database used to store configuration information for the Windows system and the applications on it. It contains keys and values organized into a hierarchical tree structure, helping users and the operating system to access and change important information.
In addition, the Registry also supports a multi-profile structure that stores user settings, each user will have a different profile specific to their account, for example, user A installs Unikey to start with Windows, and other use B, do not install that program, Registry will record these and save each user's folder.

2. Structure of the Windows Registry

The Windows Registry is organized into many hives and subkeys within them. The most important entries in the Registry include:

• HKEY_CLASSES_ROOT (HKCR): contains information about file types and their respective utilities

• HKEY_CURRENT_USER: stores configuration information for the currently logged-in user

• HKEY_LOCAL_MACHINE: contains configuration information for specific computers

• HKEY_USERS: store configuration information for all users on the system

• HKEY_CURRENT_CONFIG: contains information about the current hardware configuration

Each entry in the Registry contains keys. Keys are directories in the Registry tree and can contain subkeys and values. The key is usually named after the path, e.g. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
Each key in the Registry can contain one or more values. Values are specific information stored in the key and are used to store configurations and customizations. Values can be of different data types such as string, integer, boolean (true/false), binary, and many other data types.
For example:

• HKCU\Software\Microsoft\Windows\CurrentVersion\Run contains a series of values that are executable files that are started automatically when the user logs on. The root key is HKCU (HKEY_CURRENT_USER), which stores the Subkeys: SOFTWARE, Microsoft, Windows, CurrentVersion, and Run. And the Run key contains the Values. With each root key in particular and keys in general, only certain software will be able to access it for security reasons. Therefore, each user, software, and service will only see the keys that they are allowed to see.

The structure of the Windows Registry allows applications and systems to access and store configuration and customization information in an organized and efficient manner, understanding this structure helps users and developers understand and interact with the Registry correctly and securely.

3. How Windows Registry Works

When the Windows system boots, the Registry is loaded into memory. When applications are active, they will access and change the Registry to get system configuration information or store new information. Here are the basic operations of the Registry:

Configuration storage

When the Windows system is up and running, it reads and writes configuration information to the Registry. This includes system configurations such as network settings, graphics configurations, audio configurations, and more. Each application can also store its configurations in the Registry.

Access and modify the Registry

Windows applications and systems can access the Registry through APIs provided by the operating system. This API allows applications to read, write, edit, and delete keys and values in the Registry. Applications can access and update the Registry to get configuration information, customize behavior, or change settings.

Backup and restore

Windows provides a Registry Editor (regedit) tool to access and manage the Registry. It allows users to backup and restore the Registry, to ensure the stability and safety of the system. It is very important to back up the Registry before making changes so it can be restored to the previous state if necessary.

Interaction with applications and systems

Information in the Registry is used by applications and systems to obtain configurations and custom settings. When an application or system needs to access a value in the Registry, it can query the corresponding key and value to get the necessary information.

4. Using Windows Registry

Windows Registry plays an important role in customizing and tuning the Windows system. Users can access the Registry through the Registry Editor, a built-in tool in the Windows system that allows them to change configuration parameters, disable or enable features, and customize the behavior of the system and applications. In addition, you can use third-party tools to manage and optimize the Registry, to increase system performance.

5. Optimize and Repair Windows Registry

Windows Registry can become large and complex after a period of use, which can affect the performance of the system. To keep the Registry working optimally, there are several possible optimization and repair methods:

• Remove redundant keys and values: during the use of the system, there may be keys and values that are no longer needed. Deleting them will reduce the size of the Registry and improve system performance. However, be careful and only delete keys and values that you understand well and don't need.
• Use Registry optimization tools: Many Registry optimization tools are available to help you automatically find and delete redundant keys and values, repair errors, and optimize the structure of the Registry. These tools can save you time and ensure system stability.
• Backup and restore the Registry: before making any changes to the Registry, it is advisable to make a backup copy of it to ensure that you can restore it to its previous state if necessary. Windows provides a Registry Editor tool for backing up and restoring the Registry.
• Repair Registry errors: if the system encounters Registry-related errors, the System File Checker (SFC) tool can be used to check and repair corrupted system files. SFC also can check and repair Registry errors

6. Some tricks with the Registry

Turn off the lock screen

• The lock screen is an added layer of security on a Windows PC that requires a password or PIN for you to sign in again. If you feel safe, then you can turn off the lock screen completely.
• Open the Registry Editor, go to the HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows folder, right-click Windows in the left panel, select New > Key, and name the new Personalization. Select Personalization, then in the right panel, right-click a space and select New > DWORD (32-bit) Value, name the value NoLockScreen, change Value data to 1, and select OK

Turn off “shake” to minimize windows

• Aero Shake is a feature introduced in Windows 7, that allows you to minimize windows by holding the window you want to open and shaking it. To remove it, open Registry Editor and navigate to Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\Current\Version\Explorer\Advanced
• Here, right-click on the right panel, select New > DWORD (32-bit), name it DisallowShaking, change the value to 1, and click OK

Add your apps to the context menu

The context menu is interesting, but controlling it requires creating registry keys to add specific applications to it. Here we will take Notepad as an example:

• B1: Open regedit, navigate to Computer\HKEY_CLASSES_ROOT\Directory\Background\shell
• B2: in the shell folder, right-click and create a new key named Notepad, which creates a key named command. In the key command folder, right-click the Default string, then in the Value box, type notepad.exe.

Increase network speed

Many of the Registry tweaks on the list will involve design or aesthetic changes that can make Windows smoother and better. But there are also a bunch of registry tricks designed to improve Internet speed. Here are some ways to use the registry to improve Internet speed:

• C1: IRPStackSize: navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters, add IRPStackSize as DWORD value on the right side of the regedit window, and modify the value to 32

• C2: MaxFreeTcbs: navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters, create or edit MaxFreeTcbs and set its value to 65536. If you are using an old computer with low-performance hardware, you can set this to a lower number such as 16000.

7. References

To learn more about the Windows Registry and how to work with it, here are some helpful resources:

• Microsoft Registry for advanced users: https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/windows-registry-advanced-users

• Auslogics Registry Cleaner (free registry cleaner): https://www.auslogics.com/en/software/registry-cleaner/

• How to backup and restore the registry in Windows: https://support.microsoft.com/en-us/topic/how-to-back-up-and-restore-the-registry-in-windows-855140ad- e318-2a13-2829-d428a2ab0692

8. Summary

The Windows Registry is an important component in the Windows system, helping to store system and application configuration and customization information. Understanding and working effectively with the registry can help enhance system performance and stability. However, precautions should be taken and careful editing should be carried out. If you don't have much experience with the registry, get expert help or use reliable registry optimization tools.

By,
VNPT Cyber Immunity - VCI