3. Find the Registry Key That Does...So, now you know how to change an item in the Registry, but how do you find which item to change? Sometimes
it's obvious. Say you want to reduce the time it takes to load your
favorite application, and it occurs to you that maybe you could disable
the program's splash screen (the friendly logo you stare at while the
program loads, which takes time to load itself). Sure enough, there's a
value called ShowSplashScreen in the application's Registry key in HKEY_Current_User\Software. Set it to 1 (one) to turn it on, or 0 (zero) to turn it off. Zero and one, with regard to Registry settings, typically mean false and true (or off and on), respectively. However, sometimes the value name negates this—if the value in the example were instead called DontShowSplashScreen, then a 1 (one) would most likely turn off the feature. |
|
Other
times it's not so easy. You might see a long, seemingly meaningless
series of numbers and letters, or perhaps nothing recognizable at all.
Although there are no strict rules as to how values and keys are named
or how the data therein is arranged, there's a trick you can use to
uncover how a particular setting—any setting—is stored in the Registry. What's the point? Once you find the Registry value(s) responsible for a particular setting, you can:
Find hidden settings.
Not
all application settings have tidy little checkboxes in a Preferences
dialog window; some things can only be changed in the Registry. By
finding out where an application saves its settings, you can uncover
others nearby and even learn how they work.
Reproduce settings.
By
finding the Registry keys and values responsible for one or more
settings, you can consolidate them into a Registry patch file , and then apply them to any number of other PCs.
This is particularly useful for network administrators and software
developers.
Enter values not permitted by the software.
For
instance, say you've configured a virus scanner to scan your system
once a week. You'd rather have it perform a scan every 10 days, but the
program only lets you choose a multiple of 7. If you find the Registry
value responsible, you may be able to enter any arbitrary number.
Fix bugs in software.
If an
application won't save a particular setting properly in the Registry,
you can fix it by hand if you know where it's stored.
Prevent changes to certain settings.
Some
programs—including Windows Vista itself—have a habit of "forgetting"
certain settings, reverting them to their default values for no apparent
reason. Once you know where the setting is stored, you can change the
permissions (more on that later) to prevent further changes without your
consent.
The idea is to take "snapshots" of your entire Registry before and after
you make a change in Windows. By comparing the two snapshots, you can
easily see which Registry keys and values were affected. Here's how you
do it: Close
all applications except the one you wish to examine. Any unnecessary
running applications—including those in the system tray/notification
area—could write to the Registry at any time, adding unexpected changes. Open the Registry Editor, and select the HKEY_CURRENT_USER branch. Select Export from the Registry menu. Type User1.reg for the filename, select your desktop or another convenient location to put the file, and click Save to export the entire branch to the file. Next, select the HKEY_LOCAL_MACHINE branch and repeat step 3, exporting it instead to Machine1.reg. Although the Registry has five main branches, the others are simply "mirrors," or symbolic links of portions of HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE.
|
|
Now make the change you want to track. For
instance, say you want to find the value responsible for showing hidden
files in Windows Explorer. In this case, you'd go to Control Panel → Folder Options, choose the View tab, and in the Advanced Settings list, turn on the Hidden Files and Folders option. Click OK when you're done. Immediately—and before doing anything else—switch back to the Registry Editor, and re-export the HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE branches into new files named User2.reg and Machine2.reg, respectively, as described earlier in steps 2 and 3. What you now have is a snapshot
of the entire Registry taken before and after the change was made. It's
important that the snapshots be taken immediately before and after the
change, so that other trivial settings, such as changes in window
positions, aren't included with the changes you care about. All that needs to be done now is to distill the changed information into a useful format. Windows comes with the command-line utility File Compare (fc.exe), which quite handily highlights the differences between the before and after files. There are several Windows-based third-party alternatives that are easier to use or offer more features than fc.exe, such as UltraEdit (available at http://www.ultraedit.com); even Microsoft Word can do text comparisons (although you'll need to remember to save the results as plain text). |
|
Open a Command Prompt window (type cmd in the Start menu Search box and press Enter), and then at the Command Prompt, use the cd command to change to the directory containing the Registry patches. For instance, if you saved them to your desktop, type: cd %userprofile%\desktop
To perform the comparison, type the following two lines: fc /u user1.reg user2.reg > user.txt
fc /u machine1.reg machine2.reg > machine.txt
At this point, the File Compare utility scans the two pairs of files and spits out only the differences between them. The > character redirects the output, which normally would be displayed right in the Command Prompt window, into new text files: user.txt for the changes in HKEY_CURRENT_USER and machine.txt for the changes in HKEY_LOCAL_MACHINE. Examine the results. The user.txt file should look something like this: Comparing files user1.reg and USER2.REG
***** user1.reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Explorer\Advanced]
"Hidden"=dword:00000001
"ShowCompColor"=dword:00000000
***** USER2.REG
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Explorer\Advanced]
"Hidden"=dword:00000002
"ShowCompColor"=dword:00000000
*****
From this example listing, you can see that the only applicable change was the Hidden value, located deep in the HKEY_CURRENT_USER
branch. (There may be some other entries, but if you inspect them,
you'll find that they relate only to MRU lists from RegEdit and can be
ignored.) Note that for the particular setting explained in step 5, no changes were recorded in the HKEY_LOCAL_MACHINE branch, so machine.txt ends up with only the message, "FC: No differences encountered". This means that the changes were made only to keys in the HKEY_CURRENT_USER branch. The
lines immediately preceding and following the line that changed are
also included by FC as an aid in locating the lines in the source files.
As luck would have it, one of the surrounding lines in this example
happens to be the section header (in brackets), which specifies the full
path of the Registry key in which the value is located. In this case, the value that changed was located in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\.
If you take a peek in that key, you'll find that it contains other
settings, some of which aren't included in the Folder Options dialog
box. Experiment with some of the more interesting-sounding values, such
as CascadePrinters and ShowSuperHidden. Or, search the Web for the value name to see what others have discovered about it. |
|
If
you don't see the line in square brackets, you'll have to do a little
more reconnaissance. To find out where the value is located, open one of
the source files (User1.reg, User2.reg, Machine1.reg, or Machine2.reg) and use your text editor's Search tool to find the line highlighted in step 9. For this example, you'd search User2.reg for "Hidden"=dword:00000002 and then make note of the line enclosed in square brackets ([...]) most immediately above the changed line. This represents the key containing the Hidden value. Sometimes,
changing a setting results in a Registry value (or key) being created
or deleted, which could mean an entire section may be present in only
one of the two snapshots. Depending on the change, you may have to do a
little digging, or perhaps try the document comparison feature in your
favorite word processor for an easier-to-use comparison summary. |
|
This
last step is optional. If you want to create a Registry patch that
activates the Registry change, you can either convert FC's output to the
correct format. Because
the FC output is originally derived from Registry patches, it's already
close to the correct format. Start by removing all of the lines from user.txt, except the second version of the changed line—this would be the value in its after setting, which presumably is the goal. You'll end up with something like this: "Hidden"=dword:00000002
Next, paste in the key (in
brackets) immediately above the value. (In the case of our example, it
was part of the FC output and can simply be left in.) You should end up
with text that looks like this: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Explorer\Advanced]
"Hidden"=dword:00000002
Finally, add the text Windows Registry Editor Version 5.00 followed by a blank line at the beginning of the file, like this: Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Explorer\Advanced]
"Hidden"=dword:00000002
When you're done, save this as a new file with the .reg filename extension (e.g., User-final.reg).
If the settings you've changed also resulted in changes in the HKEY_LOCAL_MACHINE branch, simply repeat this step for the machine.txt file as well. You can then consolidate both files into one, making sure you have only one instance of the Windows Registry Editor Version 5.00 line. |
|
For
some settings (such as the one in this example), you may want to make
two patches: one to turn it on, and one to turn it off. Simply
double-click the patch corresponding to the setting you desire. There
are some caveats to this approach, mostly in that the File Compare
utility will often pull out more differences than are relevant to the
change you wish to make. It's important to look closely at each key in
the resulting Registry patch to see whether it's really applicable and
necessary.
|
