So, that's it for Registry basics. The real fun
begins with the various Registry tools you can use, and what you can do
with them.1. Search the RegistryThe
Registry Editor has a simple (to a fault) Search feature, allowing you
to search through all the keys and values for text. Just select Find from the Registry Editor's Edit menu, type the desired text (Figure 1), and click Find Next.
The
Registry Editor's Search feature is pretty terrible. For one, it's
hopelessly slow, and doesn't show a history of past searches. But its
biggest drawback is that it only shows one match at a time; you have to
click Find Next repeatedly to cycle through all the search results, one by one. And if you accidentally double-click Find Next, there's no going backward. Finally, there's no search-and-replace feature, but more on that later. Press Ctrl-F or select Edit → Find to begin a search at the selected key. (Scroll to the top and select Computer beforehand to search the entire Registry.) In the Find window, make sure that all three options in the Look at section are checked, unless you know specifically that what you're looking for is solely a Key, a Value (value name), or Data (value contents). You'll also usually want the Match whole string only option turned off, unless you're searching for text that commonly appears in other words; searching for handle might otherwise trigger entries like PersistentHandler and TeachAndLearn. The Registry Editor stops once it finds the first match to your search term; just press F3
to continue searching for the next match. If you want to show all the
matches at once, use Registry Agent, introduced in the next section. |
|
You may need to employ some tricks to find certain types of things in the Registry, such as:
Context menu items
Context menu items are usually stored in the HKEY_CLASSES_ROOT branch. When searching for any menu items, keep in mind
that most of them have underlined characters to signify keyboard
shortcuts, even though, ironically, Windows Vista doesn't display them
by default. For instance, the Datasheet action associated with Access Form Shortcuts in Microsoft Office 2007 is actually stored as Data&sheet in the Registry. This allows it to be displayed as Datasheet if you manage to open the menu with the keyboard (an increasingly difficult task in Windows Vista). The &Data&sheet instructs Windows to underline the character that follows it (the s in this case), and since it's present in the Registry value, you'll need to include the & character in your searches; if you don't, the Search tool won't find it. character in Text searches are not case-sensitive, so you don't have to worry about capitalization when typing your search terms. |
|
File and folder names
Despite
the fact that long filenames (those longer than the archaic 8-dot-3
standard left over from the early days of DOS) had been in wide use on
the PC platform for well over a decade before Windows Vista was
released, short filenames still have a role in modern Windows computing, particularly in the Registry. Specifically, a folder path like C:\Program Files may be occasionally represented in its short 8.3 form: C:\PROGRA~1. Why,
even Microsoft still uses short filenames; a fresh installation of
Office 2007 (introduced alongside Windows Vista) placed a reference in
the Registry to C:\PROGRA~1\MICROS~2\Office12\1033\ACCESS12.ACC.Unfortunately,
this means you need to search for both the long and short versions of a
file or folder name if you want to find them all. For example, say you
want to move your Program Files folder
from one drive to another. When you install Windows, any settings
pertaining to this folder may be stored in the Registry as C:\Program Files or C:\Progra~1. Make sure you search for both. Now, when searching the Registry for both Program Files and Progra~1, it may occur to you to just search for progra, which will indeed catch both variations. Because this will stumble upon other instances of the word program, try limiting the results by placing a backslash (\) in front of the text (e.g., \progra) to limit the search to only directory names beginning with those letters. Neato. |
|
DLLs, classes, components, extensions, and CLSIDs
Windows
and all your applications are constructed from smaller building blocks,
sometimes referred to as classes, extensions, or objects. I'll spare
you a tirade on COM components, .NET architecture, and a bunch of other
developer jargon (sorry). Suffice it to say, the majority of these
building blocks are registered in the HKEY_CLASSES_ROOT\CLSID
branch of your Registry, and are identified by a 32-digit (16-bit hex)
code called a Class ID, or CLSID. CLSIDs are formatted like this: {AC0EEBCA-73FA-4EB3-87FF-96E58401FA1F}
Why is this important? It
means that you can track down where a class is referenced (in other
words, where in Windows it's used) as well as where it's registered, all
by searching the Registry for the CLSID. For instance, configuration data for the aforementioned class is located in: HKEY_CLASSES_ROOT\CLSID\{AC0EEBCA-73FA-4EB3-87FF-96E58401FA1F}
If a component isn't working,
odds are you can fix the problem, or at least help diagnose it, by
fussing with the values in this key. Or, delete the key altogether to
effectively unregister the class with Windows. For instance, to turn off
Vista's support for "compressed folders" (ZIP files appearing as
folders in Windows Explorer), you need to delete two such CLSID
branches.
Windows comes with a utility, regsvr32.exe,
that you can use to register or unregister DLL files manually. For
instance, you can repair a CLSID branch for a specific component by
opening a Command Prompt window and typing regsvr32 "c:\program files\my app\some file.dll" and pressing Enter. Or, to remove all the entries used by a DLL, type regsvr32 /u "c:\program files\my app\some file.dll" and press Enter.
|
|
If a CLSID is found elsewhere (even within another key under HKEY_CLASSES_ROOT\CLSID), it means that the program that owns the key is using said component. Delete the reference, and the link is broken.
2. Search and Replace Registry DataThe
Registry Editor has no search-and-replace feature, seemingly with good
reason: a single poorly chosen replace operation could make Windows
inoperable. But there are times when you do need to replace all
occurrences of, say, a folder name like C:\Program Files\My Program with another folder name like D:\My Folder. Depending on the number of occurrences, such an operation could take hours. Registry Agent (part of Creative Element Power Tools, available at http://www.creativelement.com/powertools)
not only gives you a better way to search the Registry (search results
are shown in a list, instead of one at a time), but supports
search-and-replace operations as well. Here's how to move an application
from one drive to another without having to reinstall it: Type text to search (e.g., c:\program files\acme), and click Find Now. The results are shown in a list (Figure 2)
with three columns. The left column shows the location (key) where the
text was found; you can click it to open the Registry Editor at that
location. The middle and righthand columns show the value name and
contents, respectively. Choose the Replace tab. Replacing a common word like Microsoft
in your Registry is a really bad idea. Don't try it at home. I mean it.
Ordinary searching with Registry Agent is harmless, but the Replace feature can be as dangerous as it is handy if you're not careful. |
|
Place
a checkmark next to the found items you wish to replace. Use the
checkmark at the top of the list to check or uncheck all of them. Type the new text—which will replace the old text in each selected item in the search results—in the With field (e.g., d:\new acme). You don't have to replace the same text you searched. For instance, you can search for c:\program files\acme, and then do a search and replace within these results for anything you like, such as acme by itself, or even portmeirion. |
|
Choose which types of text you'd like to replace by checking or unchecking the Keys, Values, and Data options. Note that the Keys checkbox is grayed-out (disabled) by default for safety reasons; click Help for instructions to lift this restriction. The
Replace tool has no "undo" feature, which means that if you screw up
something here, the only way to recover is to restore your Registry from
a backup. Want a shortcut? Use the Export
tab to create a Registry patch
containing the selected values, which can be used as a quick and dirty
backup. |
|
Click the Replace button to perform the search and replace.
Even
if you don't use the search-and-replace feature, Registry Agent is a
pretty slick searching tool, as it overcomes the annoying hunt-and-peck
approach of the Registry Editor's Search feature and ends up being much
faster, too.
|