Registry Organization
In registry organization HIVE is introduced.
HIVE : A registry hive is a group of keys,subkeys,and
values in the registry that has a set of supporting files
that contains back up of its data.
In windows registry,
Hives are utilized by the registry to store data on
its self.
Hives are stored in a variety of files that are
dependent on the Windows Operating System
that is being utilized.
There is Registry Editor in our computer.
And path for Registry Editor is :
C:\Windows\System32\regedt32
And then one window will open. And it will look like
following.
In window we can see some keys.
Key is one type of folder with subkeys and value. Sub
Keys – These are essentially sub directories that exist
under the Root Keys.
There are five keys of registry.
1. HKEY_CLASSES_ROOT (HKCR).
2. HKEY_CURRENT_USER (HKCU).
3. HKEY_LOCAL_MACHINE (HKLM).
4. HKEY_USERS (HKU).
5. HKEY_CURRENT_CONFIG (HKCC).
We will first introduced HKEY_LOCAL_MACHINE(HKLM)
: This key contains machine specific data for device
drivers and applications.
It actually not stored in disk.But maintained in memory
by the system kernel in order to map all other subkeys.
There are four subkeys of this key :
SAM,SECURITY,SYSTEM,SOFTWARE.
And the fifth one is HARDWARE.
It is volatile and created dynamically and not stored in
file.
In this key we can’t create any other subkey for our
application.
Now other key is HKEY_CURRENT_USER(HKCU) :It
contains the profile (settings, etc) about the user that
is logged in. This key is link to the subkey of
HKEY_USERS that corresponds to the user.The same
information is accessible in both locations.
HKEY_CLASSES_ROOT (HKCR) : It contains information
in order that the correct program opens when
executing a file with Windows Explorer.It also contains
information about registered application ,such as file
associations and OLE object class IDs.
HKEY_CURRENT_CONFIG (HKCC) : It contains
information about the hardware profile used by the
computer during start up. It contains information
gathered at runtime. Information stored in this key is
not permanently stored on disk, but rather
regenerated at boot time.
Registry Value Type :
REG_BINARY : Raw binary data
REG_DWORD : 32 bit integers
REG_SZ : string
REG_EXPAND_SZ : Expandable string
REG_MULTI_SZ : Container for null separated strings
Useful Commands For Registry
Commands For HKEY_CURRENT_USER :
To Hide Run :
HKEY_CURRENT_USER/Software/Microsoft/Win
dows/CurrentVersion/Policies/Explorer
Make a new DWORD Value and give name
NoRun and insert value 1 as Value Data.
To Disable Right Click :
HKEY_CURRENT_USER/Software/Microsoft/Win
dows/CurrentVersion/Policies/Explorer
Make a new DWORD Value and give name
NoViewContextMenu and insert value 1 in Value
Data.
To Hide Recent Documents :
HKEY_CURRENT_USER/Software/Microsoft/Win
dows/CurrentVersion/Explorer/Advanced
Double click Start_ShowRecentDocs and insert
value 0 in Value Data.
To Hide Icons From Desktop :
HKEY_CURRENT_USER/Software/Microsoft/Win
dows/CurrentVersion/Explorer/Advanced
Double click at HideIcons and insert value 1 in
Value Data.
To Show Administrative Tools Menu :
HKEY_CURRENT_USER/Software/Microsoft/Win
dows/CurrentVersion/Explorer/Advanced .
Double click at StartMenuAdminTools and insert
1 value data.
Hide Help And Support :
HKEY_CURRENT_USER/Software/Microsoft/Win
dows/CurrentVersion/Policies/Explorer
Make a DWORD Value, and give name
NoSMHelp and fill with value 1 in Value Data.
Restart computer.
To Hide Turn Off Computer Menu:
HKEY_CURRENT_USER/Software/Microsoft/Win
dows/CurrentVersion/Policies/ExplorerEdit >
New > DWORD Value and give name NoClose.
Double click NoClose and give value 1 in Value
Data.
Hide Control Panel From Start Menu :
HKEY_CURRENT_USER/Software/Microsoft/Win
dows/CurrentVersion/Explorer/Advanced
Find value called Start_ShowControlPanel and
double click at those part.
Insert value 0 in Value Data.
Commands For HKEY_LOCAL_MACHINE :
To Hide Recycle Bin :
HKEY_LOCAL_MACHINE/Software/Microsoft/Wi
ndows/CurrentVersion/Explorer/Desktop/Name
Space
Delete subkey {645FF040-5081-101B-9F08-
00AA002F954E}, then Restart computer to see
the result : To show it back, make again the digit
number combination {645FF040-5081-101B-
9F08-00AA002F954E}.
To Show All Software Which Are Installed In
Computer :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\App Paths.
Last Logon :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\WinLogon.
To Show All USB Inserted In PC :
HKEY_LOCAL_MACHINE\SYSTEM\CurrentContro
lSet\Enum\USBSTOR.
