Chapter 31 - Windows 98 Registry

Article
02/20/2014

Archived content. No warranty is made as to technical accuracy. Content may contain URLs that were valid when originally published, but now link to sites or pages that no longer exist.

This chapter describes how Microsoft Windows 98 components use the registry, provides an overview of registry tools, including Registry Checker, Registry Editor, and Profile Editor, and describes how to backup and restore the registry. It provides an overview of the structure of the registry, and describes the registry keys. It also describes how values from Windows 3.x INI files are stored in the registry, and includes registry entries for modems, Transmission Control Protocol/Internet Protocol (TCP/IP), and other components.

This chapter is designed for system and network administrators and for "power users." It is not intended for registry programmers (see the Microsoft Windows 98 Software Development Kit for that information).

Note This chapter assumes that your Windows 98 files are in the \Windows folder, which is the default folder where Setup copies the system files.

Caution Making a mistake in editing the registry can cause your system to become unstable and/or unusable.

Wherever possible, use the administrative tools, such as Control Panel or System Policy Editor, to make configuration changes, rather than editing the registry. This is to ensure values are stored properly in the registry when changing the configuration.

If you use Registry Editor to change values, you will not be warned if any entry is incorrect. Editing the registry directly by using Registry Editor can cause errors in loading hardware and software, and can prevent users from being able to start the computer.

Overview of the Windows 98 Registry

The structure of the Windows 98 registry has not changed significantly from the Windows 95 registry. What has changed is that the code that handles the registry has become faster and more robust, and the registry now detects when certain problems arise, and automatically fixes them.

The registry is the central storage for all configuration data. The Windows 98 system configuration, the computer hardware configuration, configuration information about Win32-based applications, and user preferences are all stored in the registry. For example, any Windows 98 computer hardware configuration changes that are made with a Plug and Play device are immediately reflected in a configuration change in the registry. Because of these characteristics, the registry serves as the foundation for user, system, and network management in Windows 98.

The registry stores the data in a hierarchical form. Because the registry contains all settings required to configure memory, hardware peripherals, and Windows 98 – supplied network components, you will find that it is no longer necessary to configure settings in startup configuration and initialization files. Also, because all settings are stored in a central location, you can provide both local and remote support for system configuration using Windows 98 tools.

To properly manage resources, such as interrupt requests (IRQs), I/O addresses, and direct memory accesses (DMAs), Windows 98 uses the registry to track devices and resources allocated for both Plug and Play–compliant devices, ACPI mechanisms, and* *legacy devices. The registry provides a centralized, dynamic data store for all Windows settings, with a "current configuration" branch that stores information on a per-configuration basis. For example, the Display option in Control Panel stores per-configuration information about display resolution changes and the Print option in Control Panel stores per-configuration information about the default printer.

Device Manager—which is accessed from the System option in Control Panel—provides a graphical representation of devices configured in Windows 98, and allows properties used by these devices to be viewed and changed, as appropriate. Device Manager also shows resources allocated for the configured devices. Through the resource configuration information maintained in the registry, Windows 98 is able to automatically identify and resolve device resource conflicts for Plug and Play – compliant devices. For legacy devices, Device Manager helps users quickly identify and resolve resource conflicts with devices in the system.

The registry is roughly analogous to the INI files used under Windows 3.x, with each key in the registry similar to a bracketed heading in an INI file and with registry values similar to entries under the INI headings. However, registry keys can contain subkeys, while INI files do not support nested headings. Registry values can also consist of binary data, rather than the simple strings used in INI files.

Although Microsoft discourages using INI files in favor of registry entries, some applications (particularly 16-bit, Windows-based applications) still use INI files. Windows 98 supports INI files solely for compatibility with those applications and related tools (such as setup programs). The Autoexec.bat and Config.sys files also still exist for compatibility with real-mode system components and to allow users to change certain default system settings, such as the PATH environment variable. New Win32-based applications can store their initialization information in the registry.

The Windows 98 registry provides the following benefits:

Registry services use less real-mode memory and less protected-mode memory. This translates to faster startup times and an overall increase in system performance.
Registry services have much better caching support. This dramatically improves the time used to look up values in the registry. This also translates to an overall increase in system performance.
Windows 98 automatically detects many sources of corruption. For example, if a computer does not shut down completely due to power failure, Windows 98 detects the improper shutdown and automatically runs Registry Checker to find and fix any registry errors that may have occurred due to improper shutdown.
Registry Checker is a system maintenance program that finds and fixes registry problems. Each time you start your computer, Registry Checker automatically scans the registry for inconsistent structures, and if no problem is found, Registry Checker backs up the registry once per day. If a problem is found in the registry, Registry Checker can restore the registry from a good backup copy. Registry Checker maintains five compressed backups of the registry that have successfully started the computer. Registry Checker attempts to fix the registry if a backup cannot be found. Registry Checker also removes unused space in the registry, reducing the size of the registry file, and therefore improving performance.
As with Windows 95, a single source provides data for enumerating and configuring the hardware, applications, device drivers, and operating system control parameters. The configuration information can be recovered easily in the event of system failure.
As with Windows 95, users and administrators can configure computer options by using standard Control Panel tools and other administrative tools, reducing the likelihood of syntactic errors in configuration information.
A set of network-independent functions can be used to set and query configuration information, allowing system administrators to examine configuration data on remote networked computers.
The registry key size limit of approximately 64 KB that existed in Windows 95 has been removed in Windows 98. This allows you to install more applications with shared dynamic link libraries (DLLs) in your computer.

Because user-specific registry information can be maintained on a central network server when user profiles are enabled, users can have access to personal desktop and network access preferences when logging on to any computer, and settings for multiple users can be maintained on a single computer. Also, system policies can be used to enforce certain registry settings for individuals, workgroups, or all users.

For more information about system policies, see Chapter 8, "System Policies."

Overview of the Registry Files

Although the registry is logically one data store, physically it consists of three different files to allow maximum network configuration flexibility. Windows 98 uses the registry to store information in three major categories. Table 31.1 lists the files and describes the categories.

Table 31.1 Registry files

File	Description
User.dat	User-specific information, in the form of user profiles, is contained in the User.dat file. It contains logon names, desktop settings, Start menu settings, and so on. During Windows Setup, User.dat is automatically stored as a hidden file in the \Windows directory, but the file does not necessarily remain there. If User Profiles are enabled, users can have their own settings stored in \Windows\Profiles. In a network, this file may be located on a central server.
System.dat	Hardware or computer-specific settings (the hardware profile) are contained in the System.dat file. It contains all the hardware configuration, Plug and Play settings, and application settings. It is always stored as a hidden file on the local machine in the Windows 98 directory.
Policy.pol	System policies are designed to provide an override for any settings contained in the other two registry components. System policies can contain additional data specific to the network or corporate environment, as established by the network administrator. The system policies themselves are contained in the Policy.pol file. Unlike System.dat and User.dat, Policy.pol is not a mandatory component of a Windows 98 installation.

Benefits of the Registry Structure

Breaking the registry into three logical components provides several benefits, which are described in this section.

The registry components can be located in physically different locations. For example, the System.dat component and other Windows 98 system files might be located on the computer's hard disk, and the User.dat component can be stored in one master network directory, and then copied to the hard disk during log on. With this configuration, users can log on to various computers on the network and still have their unique network privileges and desktop configuration, allowing the "roving user" network configuration for Windows 98.

The registry and all of the system files can be installed on the local hard disk. With this configuration, multiple users can share a single computer running Windows 98. Each user has a separate logon user name, separate user profile, separate privileges, and separate desktop configuration.

The network administrator can manage an entire network's user privileges by having a single, global Policy.pol file. Or, the network administer can establish these policies on a server basis or on a per-user basis. In this fashion, a network administrator can centrally enforce a "common desktop configuration" for each user type. For example, a data-entry computer running Windows 98 can be configured so that only two applications (the data entry application and e-mail) can be run. Additionally, the network administrator can specify that data-entry users cannot modify this desktop configuration. In spite of this configuration, the computer running Windows 98 can fully participate in the network and is fully configurable if a different user with more network privileges logs on to the same computer.

Separate privileges can be assigned to users and to a computer. For example, if a user who has sharing privileges logs on to a computer running Windows 98 that has no sharing (no peer services), the user cannot access the computer's resources. This feature is useful if certain computers contain sensitive data that should not be available to everyone on the corporate network.

How Windows 98 Components Use the Registry

The registry contains ordered pairs of keys and their associated values that are manipulated through the Win32 registry application programming interfaces (APIs). For example, the registry might have a Wallpaper key with an associated value of Work.bmp, meaning that the current desktop background is configured to use the Work bitmap.

Additionally, a special category of keys known as dynamic keys points to either a memory location or a callback function. Dynamic keys are used by device drivers or Windows 98 subsystems that want to register a dynamic data type, such as a counter, in the registry. In the case of network cards, the dynamic keys represent data, such as data transfer rates, number of framing errors, packets dropped, and so on. In general, dynamic keys are used for reporting data, not for storage in the disk-based registry. Because the dynamic keys exist only in memory, their data can be quickly updated and accessed. The data can be accessed by the system performance tools in Windows 98, which call upon the registry for the data they are monitoring.

Keys and values can be created either programmatically or by using the Registry Editor (REGEDIT) tool. The APIs for programmatically managing the registry are the Win32 registry APIs, which can be remotely invoked by the Microsoft remote procedure call (RPC) (distributed computing environment [DCE] – compliant) support built into Windows 98. Windows 98 includes both the client and server portions of Microsoft RPC, making the registry manageable remotely from another computer running Windows 98. In this scenario, the network administrator's system is the RPC client. It accesses the registry APIs on the target computer running Windows 98 through the RPC server running on the target machine. This RPC access to the registry is secure, and network administrators can limit access to either specified privileged users or a group of network administrators.

With Windows 98, the operating system stores and checks the configuration information in the registry for most configuration settings during system startup. Windows 98 components and applications also use the registry for storing and accessing configuration information:

Whenever you run Windows 98 Setup, use the Add New Hardware option in Control Panel, or run other setup programs for hardware, the Windows 98 Configuration Manager places hardware configuration data in the registry. This information includes a list of hardware detected in the computer.
If you install Windows 98 in the same directory as Windows 3.x, your previous desktop settings are moved from INI files to the registry. When you make changes to the desktop configuration, the settings are added to the registry.
Each time you add or remove a Plug and Play – compliant device on a computer running Windows 98, configuration data is added to the registry. For example, new information is added when you install a PC Card modem.
Device drivers send and receive load parameters and configuration data from the registry. This data is similar to what you might find on the device= lines in the Config.sys file in Windows 3.x. A device driver must report system resources that it uses (such as hardware interrupts and direct memory access channels) so the system can add this information to the registry. Applications and device drivers can access this registry information to provide users with smart installation and configuration programs.
System policies, user profiles, and administrative tools (such as the Control Panel) can be used to add or modify configuration data in the registry indirectly. Registry Editor can be used to view and occasionally change the system configuration.

Figure 31.1 provides an overview of how Windows 98 components and applications use the registry.

Cc768201.wrkoo01(en-us,TechNet.10).gif

Figure 31.1 Windows 98 registry overview

Windows 98 registry APIs can be used to get information into and out of the registry, and examine system, application, and user information stored in the registry.

A set of registry APIs can make information available through remote procedure calls (RPCs) to Windows 98 management tools from other vendors. This permits administrators to view and modify configuration information remotely for hardware and software components that store information in the registry. Notice that the registry APIs are accessible remotely using named pipes (client-side only), NetBIOS over NetBEUI, Windows Sockets on IPX, and Windows Sockets on Internet Protocol (IP).

Overview of the Main Registry Tools

This section contains a brief overview of tools you can use to modify the registry. The tools are described in more detail later in this chapter.

The simplest and safest way (and the recommended way) to modify the registry is to use the tools listed in Table 31.2.

Table 31.2 Recommended tools to modify the registry

Method	Settings
Control Panel	Most system settings. For example, you use Display properties to modify the appearance of screen elements.
System Policy Editor	User settings, some system settings.
Third-party utilities	Application-specific settings.

You can also modify the registry using Registry Editor, but use it sparingly and carefully. If you use Registry Editor, always back up the registry using Registry Checker before changing anything. See "Backing Up and Recovering the Registry" later in this chapter.

Wherever possible, use administrative tools, such as Control Panel or System Policy Editor to make configuration changes, rather than Registry Editor. This is to ensure values are stored properly in the registry when changing the configuration.

Registry Editor

The registry can be edited using the Registry Editor. The registry consists of various parallel "trees." Registry Editor is built on the RPC support and can edit the local Windows 98 registry as well as registries on remote computers running Windows 98. Registry Editor is powerful, yet rudimentary in design, and is intended for use by knowledgeable computer and network support staff, or power users. Most users will never use Registry Editor because registry entries are usually modified through the Control Panel, by applications, or by Plug and Play. Assigning an incorrect value to a registry entry or adding or deleting certain entries can result in a completely disabled operating system.

Windows 98 writes much of its configuration information into two hidden files: System.dat and User.dat. These files are located in the directory specified during Setup that contains the Windows 98 files, which in most cases is C:\Windows. If the system is configured for multiple users, a separate User.dat file is created for each user, and each file is found in the user's custom profiles area (Windows\Profiles\User_Name\User.dat). You can use the Registry Editor to edit the System.dat and User.dat files. The registry is automatically edited whenever the user makes changes through the Control Panel or from some other Windows 98 applet or application.

Any change made through the Registry Editor takes place immediately, and the new information is written into System.dat or User.dat, as appropriate.

Registry Checker

Registry Checker is a new system maintenance program that finds and fixes registry problems and that regularly backs up the registry. Windows 98 provides an MS-DOS-based program for scanning the registry, backing up, and restoring the registry and system configuration files. It also provides a Windows-based program for scanning and backing up the registry.

Registry Checker backs up the registry at startup, maintaining one backup for each day. It maintains up to five compressed backup copies of the registry. If a serious registry problem is found, Registry Checker restores the most recent registry from a backup copy. If a backup is not available, or if you type scanreg /fix at the command prompt, Registry Checker tries to repair the registry (you must exit Windows and run ScanReg from an MS-DOS command prompt).

Registries tend to grow in size, and the bigger the registry, the slower the performance. Registry Checker removes unused space in the registry, reducing the size of the registry file, and thus improving performance. During each boot, Registry Checker determines the amount of free space in the registry files. If there is an excess of free space, it compacts the registry, removing the excess.

Profile Editor

A user profile consists of user-specific information contained in the User.dat file, which is one of the three files in the Windows 98 registry. Optionally, a user profile can also contain special Windows 98 directories. You can enable user profiles after Windows 98 is installed, either locally on a single computer or for multiple computers. You can avoid having to go to each computer to enable user profiles by creating a system policy that can be downloaded automatically when the initial Windows 98 installation is complete. Profile Editor controls these user components of the registry.

System Policy Editor

The System Policy Editor (Poledit.exe) generates the system policies file, Policy.pol. This tool allows network administrators to define specific network policies or user configurations for Windows 98. A global system policy file can centrally enforce a common system configuration for all your users.

System Policy Editor is extensible by third parties; the ADM (administration configuration files) format is a text file that can be extended by network tool vendors or by network administrators as needed. The System Policy Editor works through local file I/O and is not RPC-enabled. Because the system policies file is located centrally on a network server, each server usually needs a copy. All the network administrator needs to do is connect to the network server and edit the system policies file.

Remote Registry Access

Many of the Win32 registry APIs use the remote procedure call (RPC) mechanism in Windows 98 to provide remote access to registry information across a network. As a result, desktop management applications can aid in the management and support of Windows-based computers, and the contents of the registry on a given computer can be queried over a network. Industry management mechanisms, such as Simple Network Management Protocol (SNMP) or DMI, can easily be integrated into Windows 98, simplifying the management and support burden of a management information systems (MIS) organization.

Overview of Other Registry Tools

The following is a description of additional tools for changing registry settings. These are the recommended tools for changing the registry.

Open With Use the Open With dialog with the Windows shell to change the registered file types.

File Types Select Folder Options from the View menu in Windows Explorer to access the File Types tab, which lets you inspect and alter registry settings for registered file types.

Control Panel Control Panel contains several icons that, when double-clicked, will open property sheets. Registry settings can be altered with the property sheets.

Property sheets of applications Some applications store their settings in the registry. You can update these settings by modifying the options in the appropriate application property sheet.

Device Manager Use Device Manager to make direct modifications to system hardware and resource settings. Device Manager displays all the hardware on your computer, and gets this information from the registry.

Getting Started with the Registry Tools

This section describes how to get started with the tools that you can use to display, modify, back up, and recover the registry.

Getting Started with Registry Checker

Registry Checker is a system maintenance program that finds and fixes registry problems. Each time you start your computer, Registry Checker automatically scans the registry for inconsistent structures, and if no problem is found, Registry Checker makes one backup for each day. Registry Checker consists of two executable files, Scanreg.exe and Scanregw.exe, which are automatically copied to the \Windows\Command and \Windows folders, respectively, when Windows 98 is installed.

If a problem is found in the registry, Registry Checker can restore the registry from a good backup copy. Registry Checker maintains five compressed backups of the registry that have successfully started the computer. Registry Checker attempts to fix the registry if a backup cannot be found. Registry Checker also removes unused space in the registry, reducing the size of the registry file, and therefore improving performance.

Once per day at startup a new CAB file containing a backup of the registry is created by Registry Checker. The file name is Rbxxx.cab (where xxx is a unique number assigned when the file is created). The new file replaces the oldest file. These files are located in the \Windows\Sysbckup folder (a hidden folder). Registry Checker always maintains at least the last configuration from which the system was successfully booted.

The Registry Checker utility is actually two executable files: Scanreg.exe (ScanReg) is a real-mode, MS-DOS executable file and Scanregw.exe (ScanRegW) is a protected-mode, Windows executable file. They store copies of the entire registry, both User.dat and System.dat, as well as Win.ini and System.ini, into a compressed file (filename.cab).

ScanRegW scans the registry for corruption and determines if it requires optimization, and then backs up the following system configuration files: User.dat, System.dat, Win.ini, and System.ini. This scan occurs automatically when the system is started. On the first successful boot, a CAB file is created and marked as a registry backup that is capable of booting the system. You can run ScanRegW when you want to force a scan and backup of these files. ScanRegW backs up the registry and configuration files using the Rbxxx.cab file.

To run Registry Checker (ScanRegW)

From the Start menu, click Run.
Type scanregw.exe, and click OK.

ScanReg runs when ScanRegW detects a problem with the registry and it prompts you to restart the computer to fix the problem. ScanReg either restores the registry from a known good backup, or, if no backups are available, it repairs the current registry. If ScanRegW detects that optimization is required, ScanReg optimizes the registry on the next startup. With some severe types of registry damage, Io.sys will detect the problem and the MS-DOS mode configuration menu appears, warning you that a registry corruption has been detected.

For more information about how to run ScanReg, see "Backing up and Restoring the Registry" later in this chapter.

Getting Started with Registry Editor

Registry Editor is a tool for displaying and editing the registry database. Registry Editor (Regedit.exe) is copied to the \Windows directory automatically when Windows 98 is installed.

Caution Making a mistake in editing the registry can cause your system to become unstable and/or unusable.

To run Registry Editor

On the Start menu, click Run and type regedit. Click OK.

Both mouse and keyboard commands can be used to navigate in Registry Editor.

To find specific data in the registry

In the Registry Editor window, double-click any folder icon for a registry key to display the contents of that key.

– Or –

From the Edit menu, click Find. Then type all or part of the text string you want to find, and click options to specify whether you want to find a key name, a value name, or data.

After Registry Editor finds the first instance of the text string, you can press F3 to search for the next instance.

Registry Editor can be used to view or modify a registry on a local computer or on another computer over a network. Both the administrator's computer and the remote computer require the Microsoft Remote Registry service to allow remote registry access.

For more information about the Microsoft Remote Registry service, see "Managing Remotely" later in this chapter and Chapter 23, "System and Remote Administration Tools."

Tip The network administrator can restrict users from being able to use Registry Editor to modify the registry by setting a system policy named Disable Registry Editing Tools. However, this policy does not prevent the administrator or another user from modifying the registry by using System Policy Editor.

For more information about this restriction and about using System Policy Editor to modify the registry on individual or multiple computers, see Chapter 7, "User Profiles," and Chapter 8, "System Policies."

The values of the active key appear in the right pane of the Registry Editor window. Each key contains at least one value with the name Default. Each additional value for a key must have both a name and a data value.

Cc768201.wrkoo09(en-us,TechNet.10).gif

Valid characters to include in a name are A through Z, 0 through 9, blank, and underscore (_). The values appear under Data. In Windows 98, the size of the subkey is unlimited. For better efficiency, use a file to store large amounts of data (subkeys over 64 KB), and then maintain a pointer to this file in the subkey. Individual values within a subkey are restricted to 16 KB of data.

The Registry Editor can handle the data types shown in Table 31.3.

Table 31.3 Windows 98 registry data types

Data type	Description
String	Stored as characters enclosed in quotation marks, it is a variable length, null-terminated set of characters.
Binary	Represented as a sequence of hex bytes (0–9 and A–F), a defined value can be 1 KB–16 KB in size.
DWORD	A binary value that is restricted to 4 bytes, and the value is shown in both hexadecimal and decimal formats: 0x00000000 (0). The first number, 0x00000000, is the hex representation of the value, and the number in parenthesis, (0), contains the decimal representation.

If the Default entry contains no value, the following string is shown:

(value not set)

The representation and meaning of the value's data depends on the key. A binary sequence can be interpreted as a single byte, a double byte, or a byte sequence. Some numerical values are stored as strings.

Important Before modifying registry values, always back up your system. See "Backing Up and Restoring the Registry" later in this chapter.

To change any value

Click the key in the left pane of the Registry Editor window to display its values in the right pane.
Double-click the value. The Registry Editor displays one of three types of dialog boxes, depending on the type of value you are changing. Table 31.4 describes the three value types.

Table 31.4 Registry Editor value types

Value type	Description
Text value	The Edit String dialog box appears. Type a new value into the Value Data box. Text values are automatically displayed in quotation marks ("") and the new value is stored immediately in the registry.
Binary value	The Edit Binary Value dialog box appears with the value data in hexadecimal format. Select a value to type a new value. When you click OK, the value is stored in the registry.
DWORD	The Edit DWORD Value dialog box appears. Select a Base option, and enter the value into the Value Data box. A DWORD can never exceed 32 bits.

To add a new value

Click a key, and then right-click in the right pane of the Registry Editor windows to display the context menu.
Select New and then select the value type.

A new entry called New Key #1 is inserted into the registry. New Value #1 represents the value type you chose in step two.

To delete any entry

Select the entry, and then select Delete from the shortcut menu.

Caution Registry Editor does not have an Undo function. All changes are written directly to the disk. If you want to remove an item from the registry, consider renaming it as opposed to deleting it. However, use caution when renaming because this can affect system functionality.

To rename an entry

Select the entry, and then select Rename from the shortcut menu.

Getting Started with Profile Editor

Each time a user logs on to a computer, Windows 98 searches the registry under the following key to determine whether the user has a local profile:

HKEY_LOCAL_MACHINE \Software \Microsoft \Windows \CurrentVersion \Profile List

Windows 98 also checks for the user profile in the user's home directory on the server. If the user profile on the server is the most current, Windows 98 copies it to the local computer for use during the current session, and then it loads the settings in this local copy into the registry. If no local user profile exists, Windows 98 copies the server version to the local computer. If no profile is found, Windows 98 creates a new user profile on the local computer using default settings. If the user does not log on, then Windows 98 automatically uses the default user profile.

You can enable user profiles after Windows 98 is installed, either locally on a single computer or for multiple computers. You can avoid having to go to each computer to enable user profiles by creating a system policy that can be downloaded automatically when the initial Windows 98 installation is complete. For more information about enabling user profiles centrally on multiple computers, see Chapter 8, "System Policies."

To enable user profiles on a local computer after setup

In Control Panel, double-click Passwords, and then click the User Profiles tab.
Click Users can customize their preferences and desktop settings.
Select the options you want under User profile settings. These options describe what should be included as part of the user profile.
Shut down and restart the computer.

Tip If you include desktop icons in your user profile, only the shortcuts (icons that represent links) will be available when you log on to the network from another computer. Actual files on your desktop are part of your local user profile only.

To disable user profiles on a local computer after setup

In Control Panel, double-click Passwords, and then click the User Profiles tab.
Click All users of this computer use the same preferences and desktop settings.

Note If an application is installed after user profiles are enabled with the option to include the Start menu and Programs in the profile, only the user who was logged on when the application was installed will have an entry for that application on the Programs menu. Other users will have to create shortcuts to the application on their Programs menus.

For more information about using user profiles, see Chapter 7, "User Profiles."

Getting Started with System Policy Editor

During Startup, Windows 98 reads the data stored in System.dat and in User.dat, which can be different for each user. System administrators customize user settings in User.dat. For example, they might restrict access to certain desktop components or Start menu commands, or change the location of the User.dat file. System policies are a powerful method to manage computers on a network.

The tool for changing these settings is the System Policy Editor, which is shipped on the Windows 98 compact disc.

To install System Policy Editor

In Control Panel, double-click Add/Remove Programs, click the Windows Setup tab, and then click Have Disk.
In the Install From Disk dialog box, click Browse and specify the Admin\Apptools\Poledit directory on the Windows 98 compact disc.
Click OK, and then click OK again in response to the dialog boxes.
In the Have Disk dialog box, select the System Policy Editor check box, and then click Install.

To run System Policy Editor

On the Start menu, click Run.
Type poledit, and then click OK.

The System Policy Editor can be used to directly access the registry to create and edit POL files.

To access registry settings through System Policy Editor

On the File menu, click Open Registry.

The Local User and Local Computer icons appear in the System Policy Editor. Using this local mode changes registry entries on the current machine in use. No POL file is created when you use local mode. If a POL file already exists, local changes may be overwritten during the next log on.
Click either Local Computer or Local User.

If you want to use group policies, you must install that capability on each computer running Windows 98, either when you install Windows 98 using a custom setup script or by using the Add/Remove Programs option in Control Panel.

To set up capabilities for group policies using Add/Remove Programs

In Control Panel, double-click Add/Remove Programs, click the Windows Setup tab, and then click Have Disk.
In the Install From Disk dialog box, click Browse and specify the Admin\Apptools\Poledit directory on the Windows 98 compact disc.
Click OK, and then click OK again in response to the dialog boxes.
In the Have Disk dialog box, select the Group Policies check box, and then click Install.

Windows 98 Setup places Grouppol.dll in the \Windows\System directory on the client computer, and makes the required registry changes.

For more information about adding the ability to use group policies when installing Windows 98 using custom setup scripts, see Chapter 4, "Automated Installations."

Before you can use individual user profiles, you must enable them in Windows 98.

To enable user profiles

In the Control Panel, double-click Passwords, and then click the User Profiles tab.
Click Users can customize their preferences and desktop settings.
Click OK.

For more information about using System Policy Editor, see Chapter 8, "System Policies."

Administrating with the Registry

This section describes tasks and tips for managing the registry, and for using the registry to manage your system.

Managing the Registry

The following tasks help you manage the registry itself.

Finding Information in the Registry

The registry contains thousands of entries, so it can be difficult to find a desired key or value. Scrolling through the hierarchy could take some time. The most efficient approach to find data in the registry is to use Registry Editor.

To find information in the registry

Start Registry Editor.
On the Edit menu, click Find.
Type what you want to look for in the Find what field. You can enter a key, a subkey, a value name, or an actual value (text or binary).
Click Find Next.

Backing Up and Restoring the Registry

The registry is critical to your Windows 98 – based computer because Windows 98 and Windows 98 – based applications store their configuration information in the registry. Therefore, it is crucial to back up the registry regularly and frequently so that this information can be recovered in the event that the registry is damaged. It is also a good idea to back up the registry before installing a new application or new hardware.

Registry Checker automatically backs up and restores the registry. You can also run it manually at any time using the following procedure.

To manually back up the registry using Registry Checker

On the Start menu, click Run.
Type scanregw.exe, and click OK.

First Registry Checker verifies that the registry is structurally sound. If the registry is sound, Registry Checker offers to back it up. Registry Checker will back up the registry and store the compressed CAB file in \Windows\Sysbckup (a hidden directory).

If the registry structure is sound but a content change is keeping the computer from booting, then you need to manually restore from a backup using the following procedure.

To restore the backup manually

On the Start menu, click Shut Down.
Select Restart in MS-DOS mode and click OK.
At the MS-DOS command prompt, type scanreg /restore.
Select the latest known good backup.

Backed up, compressed registry files are listed with the name Rbxxx.cab. The files show the time and date of backup. Next to each CAB file are the words Started or Not Started. Started means that the file has successfully started Windows 98, and is a known good file. Not Started means that the file has never been used to start Windows 98, so it is not a known good file.

The Registry Checker scan and backup tools can be configured with the Scanreg.ini file. Table 31.5 includes some configurable settings in the Scanreg.ini file.

Table 31 .5 Configurable settings in the Scanreg.ini file

Setting	Description
Backup=	Enables and disables Registry Checker. Backup=0 disables backups Backup=1 enables backups
MaxBackupCopies=	Specifies the maximum number of backups to store in the backup folder. MaxBackupCopies=5 is the default.
BackupDirectory=	Changes the location of the backup folder where the CAB files are stored. For example, BackupDirectory=C:\RegBackup.
Files=	Adds system files to be backed up.
Optimize=	Enables and disables automatic registry optimization. Optimize=0 disables optimization Optimize=1 enables optimization

Table 31.6 describes command line options for the ScanReg and ScanRegW utilities of Registry Checker.

Table 31.6 Command line options for Registry Checker

Command line option	Description	Available for
/backup	Backs up the registry with no prompts to the user.	ScanReg and ScanRegW
/restore	Displays a list of backup files available, sorted by date and time of the backup.	ScanReg
"/comment="	Specifies that a comment is attached to the backup, which is displayed with /restore.	ScanReg and ScanRegW
/fix	Repairs the registry files.	ScanReg
/autoscan	Scans the registry files every time it is run, but only backs up once per day.	ScanRegW
/scanonly	Scans the registry files and returns an error level. Does not back up.	ScanRegW

Table 31.7 identifies the error levels returned by ScanReg.

Table 31.7 ScanReg error levels

Error level	Error
2	The registry is bad.
0	No problems found.
-2	Not enough memory; free some memory. In real mode, Registry Checker may require more memory, or high memory (HIMEM) needs to be installed (ScanReg does not work in Safe Mode command prompt only). In protected mode, the Windows drive may be full.
-3	File not found; one or both of the registry files are missing.
-4	Unable to create User.dat or System.dat.
-5	Reading the registry failed.
-6	Writing to the registry failed.
-7	Sharing violation (protect mode only); another application has the registry open.

Caution You may have backed up core configuration files using the Emergency Recovery utility and CfgBack utilities from the Windows 95 compact disc. If these Windows 95 backup registries are restored to the Windows 98 system, the computer will not boot.

For more information about Registry Checker, see Chapter 27, "General Troubleshooting."

Importing and Exporting Registry Data

The registry can be exported, imported, or recreated using the MS-DOS-based version of Registry Editor on either the Windows 98 startup disk or in the \Windows directory. By using the export capabilities of Registry Editor, a specific branch or the entire registry can be saved in text format as a REG file. A branch of or the entire registry can be restored by importing a REG file that was created by exporting the registry.

You can import and export using Registry Editor. All the information required to import the data must be in the imported file and the files need a REG extension. Valid Windows 98 REG files contain only ASCII characters in a predefined format and contain the word REGEDIT4 in the first line. The second line must be blank. The following format is valid for a REG file:

REGEDIT4

[HKEY_CLASSES_ROOT.bmp]
@="Paint.Picture"
"Content Type"="image/bmp"

[HKEY_CLASSES_ROOT.bmp\ShellNew]
"NullFile"=""

All the lines that follow the first blank line can contain entries for registry settings. Each entry starts with the name of the destination key enclosed in square brackets [].The next line or lines are used for the values of a key (which are the values shown later in the right pane of Registry Editor). The value names are included in quotation marks (for example, "NullFile"). Some lines start with @= followed by a value in quotes. The @ character indicates a default value for an entry. These entries are marked as Default in the right pane of the Registry Editor.

Caution The Microsoft Windows 98 Resource Kit does not provide sufficient information to guide you through the process of editing a REG file, so it is recommended that you undertake editing a REG file only under the guidance of your product support representative.

Also, use the regedit /c option with extreme care, and only when you are sure that the specified REG file contains a complete image of the registry.

To import with Registry Editor

In Registry Editor, click Import Registry File on the Registry menu.
Click a folder, and then click a file name (or enter a file name).
Click Open.

Tip You can also just double-click a filename.reg file. The extension is associated with Regedit and will be imported automatically.

After a REG file is successfully imported, a message box informs you that the REG file was valid, indicating that it was formatted properly, that it was a valid Windows 98 REG file, and that all information contained in the file and entered into the registry is valid.

To export a REG file using Registry Editor

In Registry Editor, select the branch or subkey that you want to export.
On the Registry menu, click Export Registry File.
In the Export Registry File dialog box, select the folder in which you want to save the REG file.
Enter the new file name.
Click Save.

The Registry Editor creates a REG file containing the information of the selected branch. This REG file can now be imported as previously described.

By default, the Registry Editor exports only the active branch. You can export the whole registry by selecting All in the Export range section, but keep the file size in mind.

Accessing the Registry in Real Mode

Registry Editor runs in MS-DOS real mode. If you can boot your computer to MS-DOS mode, you can access Registry Editor. The file Regedit.exe is on the Windows startup disk and in the \Windows folder. For more information about using Regedit, type Regedit with no command line options at the command prompt, and a help screen appears advising you how to use this tool.

To import a registry file into the registry in MS-DOS Registry Editor

On the Start menu, click Shut Down.
Select Restart in MS-DOS mode and click OK.
At the MS-DOS command prompt, type:

REGEDIT /L:system /R:user filename

L:system is optional and specifies the location of the System.dat file.

/R:user is also optional and specifies the location of the User.dat file.

Filename is the name of the registry file that will be imported.

For example, the following command will import the contents of Global.reg into User.dat and System.dat:

REGEDIT /L:C:\Windows\ /R:C:\Windows\Profiles\ A:\Global.reg

Managing Your System with the Registry

This section describes tasks that you can use to manage your system with the registry, including disabling Registry Editor, disabling a user's ability to use any computer but his or her own, and registering file name extensions.

Disabling Registry Editor for a User

You can disable the Registry Editor for a user so that the user cannot change entries that you have set to limit user access.

To disable Registry Editor for a user

Start System Policy Editor, and click Local User.
Click System, and then click Restrictions.
Select Disable Registry Editing Tools.

Note An experienced user can still change registry settings by importing a REG file.

Disabling a User's Ability to Roam

You can keep a user from using any computer but his or her own.

To disable a user's ability to roam

In Registry Editor, create a DWORD value in HKEY_LOCAL_MACHINE Network\Logon.
Enter UseHomeDirectory as the value.

Removing Existing User Profiles

You can remove one or all existing user profiles so that all users of the Windows 98 – based system will see the same desktop and icons.

To remove existing user profiles

Start Registry Editor.
Remove the appropriate <username> keys from the following registry key:

HKEY_LOCAL_MACHINE \Software \Microsoft \Windows \CurrentVersion \Profilelst< username >

– Or –

To remove all profiles, remove the \ProfileLst subkey.
Quit Registry Editor.
Double-click My Computer.
On the View menu, click Folder Options.
On the View tab, click Show all files, and then click OK.
Remove the appropriate Windows\Profiles\<username> folder(s).

Registering File Name Extensions

When you select a file name in Windows 98, the file opens in an application associated with that file type. The file is opened with the appropriate application because the file extension is stored in the registry with an association to that application.

File types and their associations to specific applications are stored in the registry during the installation of new software. An application's setup program registers the file extension of the file type and the commands that are applied to this type of file type. All this information is stored in the HKEY_CLASSES_ROOT branch of the registry.

Each file type must have two entries in HKEY_CLASSES_ROOT. The first entry defines the file extension and a name (name_ID) for this file type. This name is then used in a second entry to define the commands for this file type. In other words, one entry describes its extension and the other contains its properties.

The structure is as follows:

HKEY_CLASSES_ROOT

.ext = "name_ID"

name_ID = <"Description">

shell

verb = <menu item text>

command = command string

…

Structure and Description for a BAT File

The BAT key defines the file extension (BAT) and the associated value name_ID. The associated value name_ID is set to string "batfile," which is the unique name identifier for the second key.

Although the BAT extension is registered by the inclusion of the BAT key, Windows 98 needs additional information about what to do with a BAT file, such as executable commands that enable the user to open the file by clicking it. This is handled by the second key, batfile. The default value that contains the description "MS-DOS Batch File" defines this type of file. The description is what you see in Microsoft Windows Explorer in the Type column and the Registered file types list on the File Types property page of the Folder Options dialog box. The EditFlags value enables and disables the edit options in the Edit File Type dialog box.

The DefaultIcon subkey contains the value for the path and file name that contains the associated icon. The shell subkey contains information that Windows 98 retrieves about actions associated with the BAT file. The shellex subkey contains information about shell extensions that handle the BAT file.

Registering a new file type lets you manipulate how you access and enable functions, applications, and so on.

The preferred methods to register a file type are listed below:

The File Types tab on the Folder Options property sheet from the Windows Explorer View menu.
The Open With dialog box, which appears if you have selected a file that is unregistered.

You can also use the Registry Editor to register a file type. Be sure to make a backup copy of the registry before you begin, and be sure to manage every component of the process correctly.

To register a file type with Registry Editor

Make sure you have a backup copy of the registry.
Start the Registry Editor, and expand the HKEY_CLASSES_ROOT branch.
Add a new subkey with the name of the file extension in HKEY_CLASSES_ROOT (you must include the dot, as in .bat).
Set the default value of this key to the name_ID (this is the name of the second key you need to define the properties).
Use the previously defined name_ID to add the second subkey in HKEY_CLASSES_ROOT.
Add the shell subkey, and expand this branch with the verbs for the required commands (Open, Print, and so on).
Add a command key to each verb key.
Add the command string (path and name of the executable) in the Default value.
Close the Registry Editor, and then test the registered file type in Windows Explorer.

Using Per User Settings for User Profiles

Microsoft Internet Explorer 4 browsing software allows multiple users to use a single installation of Internet Explorer 4 browsing software, while retaining unique individual settings for each user.

In general, user settings are put in the HKEY_CURRENT_USER key, and machine settings go under HKEY_LOCAL_MACHINE. Per machine settings that might change when a portable computer is in its docking station versus when it is undocked go under the HKEY_CURRENT_CONFIG key.

When multiple users log on to a workstation, they each get their own profile. A profile is a folder for each user that contains user specific files and configuration information, including their own copy of the HKEY_CURRENT_USER registry key (User.dat). A user's profile is in a folder with the user's name, and has a subfolder of \Windows\Profiles.

Cc768201.wrkoo10(en-us,TechNet.10).gif

If a network is used, this profile can roam, meaning the user's copy of User.dat is stored on a central server and downloaded to any computer the user logs on to. This way the user can see the same environment no matter which computer he or she is logged on to on the network. It also allows administrators central control over individual user settings.

In addition to containing that user's copy of User.dat, a browsing software profile contains folders for Cookies, Recent, History, Favorites, Desktop, and Application Data.

Setup does not initialize any components in HKEY_CURRENT_USER settings during installation. This happens when Internet Explorer browsing software is installed on a machine by a user, and another user (who has never used Internet Explorer browsing software before) logs on at a later time, their profile will have no Internet Explorer browsing software settings.

In addition to simply logging on with a new user name, there is a new way to create a user profile. You will notice a new "Users" icon in Control Panel. This is a new interface and wizard for adding and configuring user profiles. This is simply an alternative user interface for creating a new profile. A reboot is still required.

The first time you click on this icon a wizard will run.

After clicking Next, you will be prompted for a new user name and a password for that user. The machine will then reboot. The User Profile Wizard runs only once. After that, the User List is displayed when the User icon in Control Panel is clicked, and the correct supervisor password is entered.

The first user that logs on to a machine is automatically the administrator of all consecutive user profiles on that machine. Non-administrators need the administrator's password to change the settings in their profile. The prompt for the supervisor's password is displayed as soon as the User icon in Control Panel is clicked. The supervisor is specified in:

HKEY_LOCAL_MACHINE \SOFTWARE \Microsoft \Windows \CurrentVersion \ProfileList \Supervisor

If the supervisor's password in the PWL file is null, then no supervisor key is created. Registry Editor lets you set up for more than one supervisor.

Managing Initialization Files

Although the registry replaces the basic function of the initialization files used in earlier versions of Windows, the System.ini, Win.ini, and Winfile.ini files still appear in the \Windows directory. These files continue to be used for compatibility with earlier Windows-based applications and device drivers. For example, entries in Win.ini and System.ini created by Win16-based applications are not updated in the registry because such applications do not know how to access the Windows 98 registry.

If you install Windows 98 as an upgrade over Windows 3.x, some INI file settings are copied into the registry, including settings from Control.ini, Program.ini, System.ini, and Win.ini.

Some INI file entries are not moved to the registry, but remain in the INI file for compatibility with Win16-based applications. Most of these entries can be changed without editing the INI files by using the graphical tools provided with Windows 98. However, some INI entries cannot be set using the Windows 98 user interface. These entries are required for some applications to function properly, but should not require manual modification by users.

Win.ini Settings in the registry. Windows 98 migrates settings from configuration files into the registry during Setup. Table 31.8 shows where Win.ini entries migrated to the registry.

Table 31.8 Registry paths for migrated Win.ini entries

Win.ini entry	Subkey in HKEY_CURRENT_USER
[desktop]	\Control Panel\Desktop
[Windows]	\Control Panel\Desktop
[sounds]	\AppEvents\Schemes\Apps\event\current

The following lists show entries retained in Win.ini for compatibility with applications written for earlier versions of Windows. These values can be set using Control Panel and other tools in the Windows 98 interface.

Win.ini entries retained and supported in the user interface

[Windows]:
CursorBlinkRate Device DoubleClickHeight DoubleClickSpeed	DoubleClickWidth KeyboardDelay KeyboardSpeed	MouseSpeed MouseTrails SwapMouseButtons
[Intl]:
iCountry iCurrDigits iCurrency iDate iDigits iLZero iMeasure	iNegCurr iTime iTLZero s1159 s2359 sCountry sCurrency	sDecimal sLanguage sList sLongDate sShortDate sThousand sTime

[fonts]: font-name

[ports]: portname

[PrinterPorts]: device

Win.ini entries retained but not supported in the user interface

[embedding]: object

[FontSubstitute]: font-name=font-name

[Mail]: MAPI

[mci extensions]: extension

[Windows]: Load and Run

System.ini settings in the registry. The following lists show System.ini entries that are migrated to the registry when Windows 98 is installed in the same directory as a previous version of Windows 3.x.

Registry paths for migrated System.ini entries

System.ini entry	Subkey in HKEY_LOCAL_MACHINE
[386Enh]:
Network	System\CurrentControlSet\Services\VxD\Vnetsetup
Transport	Software\CurrentControlSet\Services\VxD\transport entry
[network]:
Comment	System\CurrentControlSet\Services\VxD\Vnetsetup
ComputerName	System\CurrentControlSet\Control\ComputerName
EnableSharing	System\CurrentControlSet\Services\VxD\Vnetsetup
LMAnnounce	System\CurrentControlSet\Services\VxD\Vnetsetup
LogonDomain	Network
LogonValidated	Network
MaintainServerList	System\CurrentControlSet\Services\VxD\Vnetsetup
Reshare	System\CurrentControlSet\Network\LanMan\sharename1
Username	Network\Logon
WorkGroup	System\CurrentControlSet\Services\VxD\Vnetsetup

1 The equivalent of the Reconnect settings is stored in Hkey_Current_User \Persistent.

The following lists show entries that are retained in System.ini for compatibility with applications written for earlier versions of Windows.

System.ini entries retained and supported in the user interface

[386Enh]:
AllEMSLocked AllXMSLocked AltKeyDelay AltPasteDelay Display DMABufferSize DOSPromptExitInstructions	Keyboard KeyPasteCRSkipCount KeyPasteKeyDelay KeyPasteTimeout MaxDMAPGAddress MaxPagingFileSize MinPagingFileSize	MinUserDiskSpace Mouse Paging PasteSkipCount PagingDrive ScrollFrequency
[boot]:
display.drv keyboard.drv	mouse.drv network.drv	sound.drv
[NonWindowsApps]:
CommandEnvSize
[386Enh]:
Device=filename KeybdPasswd Local Local Reboot	MessageBackColor MessageTextColor PagingFile	NetAsynchFallback NetAsyncTimeout NetDMASize
[boot]:
386grabber=filename comm.drv=filename drivers=filename fixedfon.fon=filename	fonts.fon=filename language.dll=library-name oemfonts.font=filename	shell=filename system.drv=filename TaskMan.Exe=filename
[drivers]:
alias=driver-filname
[mci]:
Entries written by applications

Managing Remotely

Keys and values can be created either programmatically or by using the Registry Editor. The APIs for programmatically managing the registry are the Win32 registry APIs, which can be remotely invoked through the RPC (DCE-compliant) support built into Windows 98.

Windows 98 includes both the client and server portions of Microsoft RPC, making the registry manageable remotely from another computer running Windows 98. In this scenario, the network administrator's system is the RPC client. It accesses the registry APIs on the target computer running Windows 98 through the RPC server running on the target machine. This RPC access to the registry is secure, and network administrators can limit access to specified users.

To access the Connect Network Registry command from the Registry Editor, you must install the Remote Registry service on both computers, enable user-level security, and then enable the Remote Administration feature.

To set up the Remote Registry service from the Windows 98 compact disc

In Control Panel, click Network, and then click Add on the Configuration property page.
Select Service in the Select Network Component Type dialog box and click Add.
In the Select Network dialog box, click Have Disk, and then enter the CD-ROM drive and \Admin\Nettools\Remotreg.
Click OK. Windows 98 installs the Remote Registry components.
When installation is complete, click the Access Control tab on the Network property sheet.
Set the option box to User-Level access control, and click OK.
Open Registry Editor, and click Connect Network Registry from the Registry menu.
Enter the name of the remote computer, and then click OK.

Understanding the Registry Structure

This section describes the hierarchical organization of the registry and defines the overall structure of keys and value entries.

The primary building blocks for the registry are keys, values, and data. The database for the registry is organized into a hierarchical structure. It is first organized into keys, and each key contains one or more keys or one or more values.

Key 1
Key 1 value
Key 2 value
Key 3
Key 4 value

Key 2
Key 3

The Registry Editor displays the contents of the registry database in six root keys. The hierarchical structure that appears in Registry Editor is similar to how Windows Explorer displays hierarchical directory structures. Each of the root key names begins with "HKEY_" to indicate that the key is a unique identifier, called a handle.

The HKEYs contain one or more subkeys, and each of the subkeys may contain subkeys. Key and subkey names can contain visible characters, including spaces, underscores, letters, and symbols, but cannot contain backslashes (\). The keys are case-aware, but are not case-sensitive, meaning the keys will recognize upper and lower case, but not require them.

A key's data is contained in the value. The data can be in the form of text, binary, or DWORD. Table 31.9 outlines the data types in the registry.

Table 31.9 Data types in the Windows 98 registry

Value	Description
Text	Variable length null-terminated set of characters
Binary	Variable length of hexadecimal digits
DWORD	Single 32-bit value that appears as an 8-digit hexadecimal number (DWORD stands for double word value)

The actual contents or location of a specific registry subkey may differ from what is described here, depending on the services and software installed. However, this description of the general organization will help you understand how to navigate the registry.

The Windows 98 registry structure represents database information specific to the computer and to individual users. The computer-specific information includes setting for hardware and software installed on the computer. The user-specific information includes settings in user profiles, such as desktop settings, preferences for certain software, and personal printer and network settings.

In Windows 98, data is written to the registry when a flush occurs—that is, after changed data has aged more than a few seconds, or when an application intentionally flushes the data to the hard disk.

Figure 31.2 shows the registry subtrees.

Cc768201.wrkoo02(en-us,TechNet.10).gif

Figure 31.2 Windows 98 registry subtrees

The following briefly describes the registry root keys. Root keys are described in greater detail in "Working with the Registry Keys" later in this chapter.

HKEY_LOCAL_MACHINE This key contains computer-specific information about the type of hardware installed and software settings. This information is used for all users who log on to this system. HKEY_LOCAL_MACHINE has several subkeys, described later in this chapter.

HKEY_CURRENT_CONFIG This key handles Plug and Play and contains information about the current configuration of a multiple hardware configuration computer (for example, settings for a docking station). This key is a pointer to one of the configuration keys of HKEY_LOCAL_MACHINE \Config—the configuration key (000x for example, 0001) that contains information about the current configuration of hardware attached to the computer.

HKEY_DYN_DATA Dynamic data (data stored in RAM on the system) is contained in this key. This information may change as devices are added to or removed from the computer. The information for each device includes the related hardware key and the device's current status, including problems. The Device Manager uses this data to show the current hardware configuration, and this data is used to constantly update the System Monitor.

HKEY_CLASSES_ROOT This key points to HKEY_LOCAL_MACHINE Software\Classes, which describes certain software settings. This key displays essential information about OLE and association mappings to support drag-and-drop operations, Windows 98 shortcuts (which are OLE links), and core aspects of the Windows 98 user interface.

HKEY_USERS This key contains information about all the users who log on to the computer, including both generic and user-specific information. The generic settings are available to all users who log on to the computer. The information is made up of default settings for applications, desktop configurations, and so on. This key contains subkeys for each user that logs on to this computer.

HKEY_CURRENT_USER This key points to a branch of HKEY_USERS for the user who is currently logged on.

Interpreting Value Entries in the Registry Keys

Registry Editor displays data in two panes. The value entries in the right pane are associated with the selected key in the left pane.

A value entry has three parts: the data type of the value (which appears as an icon), the name of the value, and the value itself. A value's data cannot be larger than 16 KB. The limit to total registry size depends on available hard disk space and available memory.

Table 31.10 lists the data types currently used by the system.

Table 31.10 Current data types

Data type	Description
	Binary data. Most hardware component information is stored as binary data, and can be displayed in Registry Editor in binary or hexadecimal format. For example, Reboot Flag: 0x00000000.
	A sequence of characters representing human-readable text. For example, BitsPerPixel: "8".

Analyzing the Registry Files

The registry is logically one data store, but physically it consists of two different files to allow maximum flexibility for network configurations:

User-specific information is contained in User.dat. The information in this file is reflected in user profiles.
Hardware-specific and computer-specific settings are contained in System.dat. This information is reflected in hardware profiles and in the settings displayed in Device Manager.

By default, User.dat and System.dat are stored in the \Windows folder, but these two files can be located in physically different locations. For example, if user profiles are enabled, System.dat can be stored on the local hard disk and User.dat stored in each user's logon directory (\Windows\Profiles\user_name) or on a server, allowing "roving" users to maintain the same desktop preferences wherever they log on to the network.

For information about how Windows 98 chooses between local and network versions of User.dat when loading a user profile, and how system policies can override settings in DAT files to enforce user-specific and computer-specific information, see Chapter 8, "System Policies."

Working with the Registry Keys

Each branch of the registry contains information that logically belongs together. Each root key reflects a different aspect of the configuration data (that is, the user data and machine-dependent settings). Each of the root key names begins with "HKEY_", which stands for Key Handle.

The registry contains keys with values that can change depending on the user and the system. It would be impossible to describe all registry settings, but what follows is a general description of the registry root keys and some of the more significant subkeys.

HKEY_CLASSES_ROOT

This branch of the registry is stored in the System.dat file. This key contains all data used for backward compatibility with Windows 3.x OLE and Dynamic Data Exchange (DDE) support. It also contains all the names of registered file types and their properties (icons and commands), and information about Quick Viewers, property sheet handlers, copy hook handlers, and other ActiveX components. An application's setup program registers the file extension of the file type and the commands that are applied to this file type in subkeys of HKEY_CLASSES_ROOT.

HKEY_CLASSES_ROOT is a pointer to HKEY_LOCAL_MACHINE \Software\Classes subkey, meaning that HKEY_CLASSES_ROOT points to all the subkeys in HKEY_LOCAL_MACHINE \Software \Classes.

The Classes key contains two types of keys:

File name extension keys, which specify the class-definition associated with files that have the selected extension.
Class definition keys, which specify the shell and OLE properties of a class (or type) of document. If an application supports Dynamic Data Exchange (DDE), the Shell key can contain Open and Print keys that define DDE commands for opening and printing files, similar to the OLE and DDE information stored in the registry under earlier versions of Windows. In the following example, c:\windows\notepad.exe %1 is the open command, and the %1 parameter stands for the selected file name in Windows Explorer when the command is carried out.

Note It is sometimes necessary to put quotation marks around the %1, such as "%1", for long file names. This is needed for some programs to work with long file names. For example, with Registry Editor, if quotes are not placed around the file name, you cannot open a REG file that contains a space in the name, such as Name With A Space.reg.

File Name Extension Keys

The file name extension keys pertain to the file extensions. For each of those keys, a second file type (batfile, exefile, and so on) exists. Most of these keys are identified by a leading period, followed usually by three characters of a file name extension, such as .bmp. Windows 98 begins a search for any file type by looking in this registry key for a key name that matches the file extension.

Class Definition Keys

The CLSID (Class Identifier) key contains ActiveX object properties. This 16-byte value corresponds to a specific ActiveX module. The default value of the key is usually a description of the ActiveX class, such as General Property Page Object and identifies the object associated with that CLSID number.

The asterisk (*)key signifies a file extension wild card. The information found here applies to all files regardless of their extensions. You can specify shell extensions, such as context menu items, that apply to all applications with this key.

This key also contains a type of action that can be performed on an object, such as print, open, or edit. This is called a verb in the registry. For example, the Shell key of HKEY_CLASSES_ROOT contains keys that define the actions edit, open, or print, all of which can be performed on a BAT file type. If you right-click a BAT file in Windows Explorer, you find the commands Edit, Open, and Print on the context menu. Also, double-clicking a BAT file in Windows Explorer invokes the open verb.

HKEY_CURRENT_USER

HKEY_CURRENT_USER contains the configuration information of the user profile for the currently logged on user. A user profile ensures that the user interface and operation of Windows 98 will be the same on any computer where that user logs on, if that person's profile is available at that computer.

HKEY_USERS contains the profile configuration information for a default user and the user defined with a user profile that is currently logged on. HKEY_CURRENT_USER points to either the default user or the user that is currently logged on.

HKEY_CURRENT_USER contains all the information necessary to set up a particular user environment on the computer, such as application preferences, screen colors, and security access permissions. Many of these settings are the same kind of information that was stored in Win.ini under Windows 3.x. HKEY_CURRENT_USER has several subkeys, some of which are described in the Table 31.11.

Table 31.11 HKEY_CURRENT_USER subkeys

Subkey	Contents
AppEvents	Contains subkeys holding the path and file name of the system sound files that play when specific system events occur. The EventLabels subkey contains the labels for sounds. The Schemes subkey contains the wave file for the sounds.
Control Panel	Contains subkeys for Control Panel settings, including information stored in Win.ini and Control.ini under Windows 3.x.
InstallLocationsMRU	Contains the locations that applications were most recently installed from (MRU stands for "most recently used").
Keyboard layout	Contains subkeys that contain values defining the current active keyboard layout, which should be set by using the Keyboard option in Control Panel.
Network	Contains subkeys describing persistent and recent network connections.
RemoteAccess	Contains address and profile subkeys for remote network access.
Software	Contains subkeys describing the current user's software settings and containing application-specific information stored in Win.ini or private initialization files under Windows 3.x.

HKEY_LOCAL_MACHINE

HKEY_LOCAL_MACHINE contains the configuration data for the local computer. The information in this database is used by applications, device drivers, and Windows 98 to determine configuration data for the local computer, regardless of which user is logged on and what software is in use. The configuration data in this key is stored in the System.dat file.

Hardware devices can place information in the registry automatically using the Plug and Play interface. Software for installing device drivers can place information in the registry by writing to standard APIs. Users can place information about hardware in the registry by using the Add New Hardware option in Control Panel, or by using Device Manager, as described in Chapter 24, "Device Management."

HKEY_LOCAL_MACHINE contains several subkeys, as listed briefly in Table 31.12. The rest of this section provides details about some of these keys.

Table 31.12 HKEY_LOCAL_MACHINE subkeys

Subkey	Contents
Config	A subkey of Config is mapped to HKEY_CURRENT_CONFIG as the current configuration. A collection of hardware configuration profiles for the local computer. The profiles are found on the Hardware Profiles tab in the System option from the Control Panel.
Enum	Contains information about hardware devices connected to the system.
Hardware	Contains information about serial ports and modems used with the HyperTerminal program.
Network	Network information created when a user logs on to a networked computer, including the user name, primary network provider, whether the logon was validated by a server, and information about the system policies processor.
Security	Contains information about the network security access, provider, and remote administration capabilities.
Software	The computer-specific information about software installed on the local computer, along with miscellaneous configuration data.
System	The database that controls system startup, device driver loading, Windows 98 services, and operating system behavior.

Config Subtree in HKEY_LOCAL_MACHINE

A subkey of Config is mapped to HKEY_CURRENT_CONFIG as the current configuration. HKEY_LOCAL_MACHINE \Config contains information about alternate hardware configurations for the computer. For example, it can contain information about multiple configurations to be used when the computer is connected to a network, when it is undocked from a docking station, and so on. Each alternate configuration is assigned a unique identifier, and this configuration ID has a subkey under the Config key. Each configuration appears in the list of hardware profiles in the System option in Control Panel.

When Windows 98 checks the hardware configuration at system startup, one of three things occurs:

In most situations, the configuration ID is mapped to a unique configuration and Windows 98 selects the appropriate one automatically, and the settings for the related Config subkey are used for system configuration.
If the user is starting the computer for the first time with new hardware components, Windows 98 creates a new configuration for the new configuration ID, and a new Config subkey is added to the registry.
If the configuration ID is mapped to more than one configuration (for example, because Windows 98 cannot distinguish between two configurations), the user is prompted to choose which configuration to use.

Enum Subtree in HKEY_LOCAL_MACHINE

Windows 98 bus enumerators are responsible for building the hardware tree. This includes assigning an identification code to each device on its bus and retrieving the device's configuration information, either directly from the device or from the registry. For more information about the hardware tree and bus enumerators, see Chapter 28, "Windows 98 Architecture."

Bus enumeration information is stored in the HKEY_LOCAL_MACHINE \Enum subtree. For all types of devices, subkeys contain information, such as device type, assigned drive letter, hardware ID, and device manufacturer, plus driver-related information for network components.

Information about the following types of devices is stored in these subkeys (this is not an inclusive list):

Subkey	Device enumeration
ESDI	Fixed disk devices
FLOP	Floppy disk devices
ISAPNP	Plug and Play devices on an ISA bus
Monitor	Monitor devices
Network	Network protocol, server, and bindings
Root	Legacy devices

Software Subtree in HKEY_LOCAL_MACHINE

The HKEY_LOCAL_MACHINE \Software subtree contains configuration information about all installed software that has written its configuration information in the registry. The entries in this key apply for anyone using this particular computer, and include definitions for file associations and OLE information.

The Software subkey contains, for example, the information you add when registering an application to use a specific file name extension and information added during installation of Windows-based applications.

The HKEY_LOCAL_MACHINE \Software subtree contains several subkeys, including the Classes subkey, plus Description subkeys for all installed software that has registered itself in the registry, as described in the following sections.

Classes subkey. The HKEY_LOCAL_MACHINE \Software \Classes subkey defines types of documents and provides information about OLE and file name extension associations that can be used by applications. HKEY_CLASSES_ROOT is an alias for this subkey.

HKEY_CLASSES_ROOT is a pointer to HKEY_LOCAL_MACHINE \Software\Classes. The sole purpose for HKEY_CLASSES_ROOT is to provide compatibility with the Windows 3.x registration database.

Description subkeys The various subkeys of HKEY_LOCAL_MACHINE Software\Description contain the names and version numbers of the software installed on the local computer (if that software writes information to the registry as part of its installation process). User-specific information about the configuration of an application is stored at the same relative path under HKEY_CURRENT_USER.

Important The information in each subkey is added by the related application. Do not edit entries in these subkeys unless directed to do so by your application vendor.

During installation, applications record this information in the following form:

HKEY_LOCAL_MACHINE \Software CompanyName \ ProductName \ Version

The key named HKEY_LOCAL_MACHINE \Software \Microsoft and its subkey named Windows\CurrentVersion are of particular interest. These subkeys contain information about software that supports services built into Windows 98.

The Setup subkey under HKEY_LOCAL_MACHINE \Software \Microsoft \Windows\CurrentVersion is used internally by Windows 98 for its Setup program.

System Subtree in HKEY_LOCAL_MACHINE

The data in HKEY_LOCAL_MACHINE \System is organized into control sets that contain a complete set of parameters for device drivers and services that can be loaded with Windows 98.

All data that controls startup is described in the CurrentControlSet subtree under HKEY_LOCAL_MACHINE \System. This control set has two parts:

The Control key contains information used to control system startup, including the computer's network name and the subsystems to start.
The Services key contains information to control the loading and configuration of drivers, file systems, and so on. The data in the Services key also controls how these services call each other.

Control subkey. The Control subkey contains startup parameters for the system, including settings for startup and shutdown, file system performance, keyboard layouts and language support, and so on. Table 31.13 describes some typical Control subkeys.

Table 31.13 Typical Control subkeys

Subkey	Contents
ComputerName	The computer name, which should be set using the Network option in Control Panel.
FileSystem	The type and settings of the file system.
IDConfigDB	The identification for the current configuration.
Keyboard layouts	A list of the DLLs for the keyboard language, which should be set using the Keyboard option in Control Panel.
Resources	Descriptions and driver information for multimedia components.
NetworkProvider	Descriptions of the network providers.
Nls	Contains information on national language support, including language and locale preferences, which should be set using the Keyboard option in Control Panel.
PerfStats	Statistics gathered from system components that can be viewed using System Monitor.
Print	Contains information about the current printers and printing environment, contained in several subkeys: · Environments, which can contain subkeys defining drivers and print processors for operating system environments. · Monitors, which can contain subkeys with data for specific network printing monitors. · Printers, which can contain subkeys describing printer parameters for each installed printer. · Providers, which can contain subkeys describing DLLs for network print services.
SessionManager	Global variables that are maintained by the operating system, plus subkeys that list applications that do not run well under Windows 98, DLLs whose version numbers should be checked, and directories and file names for all the Session Manager DLLs.
TimeZoneInformation	Values for time zone settings, which should be set using the Date/Time option in Control Panel.
Update	Value indicating whether Windows 98 was installed over an earlier version of Windows.
VMM32	The file names of VxD files combined into the Vmm32.vxd virtual device driver.

Services subkey for CurrentControlSet. The Services subkey in CurrentControlSet lists the Kernel device drivers, file system drivers, and Windows 98 service drivers that can be loaded at startup. The Services subkey also contains subkeys with static descriptions of hardware to which drivers can be attached. Table 31.14 shows some typical Services subkeys.

Table 31.14 Typical Services subkeys

Subkey	Contents
Agent_name	Subkeys for each installed system agent, such as Microsoft Network Monitor, SNMP, or network backup agents.
Arbitrators	Subkeys for arbitrators required to manage resources between competing devices, usually including address, DMA, I/O, and IRQ arbitrators.
Class	Subkeys for all classes of devices the operating system supports, such as disk drives, keyboard, display, mouse, and so on.
MSNP32, NWNP32	Subkeys for 32-bit, protected-mode network providers, including logon and security provider information.
VxD	Subkeys for all virtual device drivers, including disk drivers, network components, disk caches, and so on.

Caution Do not change these value entries using Registry Editor. These settings should be maintained only by the system. Settings for drivers that appear under the Services subkeys can be changed by using Control Panel or system policies.

HKEY_USERS

HKEY_USERS contains all current user information (the Default subkey), plus all previously loaded user profiles for users who have logged on in the past. The information in the Default subkey is used to create the user profile for a user who logs on without a user profile. The Default subkey contains keys for AppEvents, Control Panel, Keyboard layouts, Network, RunMRU, and Software, among others.

If the HKEY_USERS key shows a Default subkey only, then HKEY_ CURRENT_USER points to that key in HKEY_USERS. If a second key with a user name exists, then HKEY_CURRENT_USER points to that second key.

Whenever similar data exists in HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER, the data in HKEY_CURRENT_USER takes precedence. For example, settings for applications and the desktop defined by the current user take precedence over default settings.

This subkey includes the same subkeys as HKEY_CURRENT_USER.

HKEY_CURRENT_CONFIG

This branch of the registry is stored in the System.dat file. The HKEY_ CURRENT_CONFIG key points to the current system configuration in the collection of configurations stored in HKEY_LOCAL_MACHINE \Config\000x, which contains the current hardware configuration. The number x refers to the configuration number. For example, if you have a docked and an undocked mode for your portable computer, you would have a subkey for each configuration: 0001 and 0002.

The Display subkey specifies screen fonts and screen settings, such as resolution. The Enum subkey contains subkeys that specify Plug and Play BIOS and the System subkey contains subkeys that list available printers.

HKEY_DYN_DATA

Some configuration information in Windows 98 must be stored in RAM because it requires fast modification and retrieval that cannot wait for the registry to flush to the hard disk. All this data can be found under HKEY_DYN_DATA. This information under this key is newly created every time Windows 98 starts.

The Config Manager subkey, sometimes referred to as the hardware tree, is a record in RAM of the current system configuration. The information is drawn from the devices currently installed and loaded, or that failed loading. The hardware tree is created every time the system starts and updates whenever a change occurs to the system configuration. The information that appears in Registry Editor is provided when this key is displayed, so it is never out of date.

HKEY_DYN_DATA also contains statistics gathered for various network components currently in use on the system. These reside under HKEY_DYN_ DATA\PerfStats.

VxDs from other vendors can provide dynamic data to this area too. For more information, see the Win32 Software Development Kit for Windows 98 and Windows NT.

Plug and Play and the Registry

Plug and Play is both a design approach and a set of personal computer architecture specifications with the goal of making the personal computer, add-in hardware devices, drivers, and the operating system work together automatically without user intervention. In order to achieve this goal, all the components must be Plug and Play. The components of a Plug and Play system include:

A Plug and Play operating system.
A Plug and Play basic input/output system (BIOS) or ACPI BIOS.
Plug and Play hardware devices with drivers.

Depending on whether any of these components are Plug and Play or not, the level of ease-of-use and dynamic operation varies. At the lowest level, where all three components are legacy, or not Plug and Play, the system lacks any dynamic operation and is difficult to use because card jumpers and switches need to be manually set and drivers manually loaded.

At the next level, when a Plug and Play operating system (such as Windows 98) is used with legacy hardware, the system supports dynamic operation of PCMCIA devices and is relatively easy to use.

Hardware setup is made simple by the Device Wizard (which helps to detect, identify, and configure devices), consistent user interface of device property sheets, and availability of device information through the registry and Device Manager. Additional ease-of-use is achieved due to automatic loading of drivers using the Device Installer, and due to smart software that reacts to configuration changes to give dynamic hardware event messages.

At the highest level, where all three components are Plug and Play, installing new devices is as easy as plugging them in and turning on the computer. Hardware setup is completely silent and transparent, and you do not need to modify expansion card jumper settings, or even modify operating system configuration files. Also, the system supports full dynamic operation, including hot docking, Advanced Power Management (APM) 1.1 power management, automatic configuration of boot devices, and programming of motherboard devices.

The registry is the backbone for Plug and Play specifications. It contains hardware-specific information so that when a user plugs a new piece of hardware into the computer, Windows 98 automatically configures the hardware device, or helps the user set it up with a Setup Wizard.

Windows 98 uses the device ID to search the INF files for that device. It then creates an entry in the HKEY_LOCAL_MACHINE key and copies information from the INF file into the key. Enum keys refer to the Windows 98 enumeration process that checks the hardware device. HKEY_CURRENT_CONFIG subkey Enum contains various subkeys (BIOS, Root, and so on) that specify Plug and Play BIOS or other elements. HKEY_DYN_DATA subkey Enum contains EISA: ISA Plug and Play bus. HKEY_DYN_DATA \ConfigManager \Enum defines the allocation of the resource, problems with the device, and configuration information.

The HKEY_LOCAL_MACHINE \Enum key contains subkeys for the specific hardware components used by the computer. Windows 98 uses this information to allocate resources, such as IO addresses and interrupts, for the devices. All values in the \Enum branch are vendor- and device-specific, so specific information can vary from machine to machine. The following list briefly describes entries in the \Enum subkey.

BIOS This subkey contains entries for Plug and Play components of the BIOS (which includes timers, controllers, and direct memory access [DMA] chips). Each BIOS subkey starts with the string *PNP and is followed by a four-digit number that represents classes by which the components are grouped: *PNP0000. Each *PNPxxxx key contains subkeys (00, 01) that contain the data (such as class name, device description string, driver name, and hardware ID) for the device configuration. See Table 31.15 for more details.

ESDI This subkey contains the configuration data of the IDE-controller used for hard disk drives and other devices.

FLOP This subkey contains the configuration data of the floppy disk controllers used in the system.

HTREE This subkey is reserved.

ISAPNP This subkey contains entries for Plug and Play equipment enumerated on an ISA bus.

MF This subkey defines manufacturer-specific information about hardware components.

Monitor This subkey contains information about the monitor used in the system. If setup cannot detect the monitor type, the selection is set by the user.

Network This subkey contains information about the network (for example, redirectors, services, and NetBEUI). The network adapter is specified in the Root\Net subkey.

PCI This subkey contains entries for Plug and Play equipment on a peripheral component interconnect (PCI) bus.

Root This subkey contains *PNPxxxx entries for legacy, non–Plug and Play hardware, such as the CPU, BIOS, network adapters, and printer drivers.

SCSI This subkey contains configuration data for small computer system interface (SCSI) devices.

Table 31.15 \Enum\BIOS values for Plug and Play components

Value	Description
PNP0000 – PNP0004	Interrupt controllers
PNP0100 – PNP0102	System timers
PNP0200 – PNP0202	DMA controllers
PNP0300 – PNP0313	Keyboard controllers
PNP0400 – PNP0401	Printer ports
PNP0500 – PNP0501	Communication ports
PNP0600 – PNP0602	Hard disk controllers
PNP0700	Standard floppy disk controller
PNP0800	System speaker
PNP0900 – PNP0915 PNP0930 – PNP0931 PNP0940 – PNP0941	Display adapters
PNP0A00 – PNP0A04	Expansion buses
PNP0B00	CMOS real-time clock
PNP0C01	System board extension for Plug and Play BIOS
PNP0C02	Reserved
PNP0C04	Numeric data processor
PNP0E00 – PNP0E02	PCMCIA controllers
PNP0F01	Serial Microsoft mouse
PNP0F00 – PNP0F13	Mouse ports
PNP8xxx	Network adapters
PNPA030	Mitsumi CD-ROM controller
PNPB0xx	Miscellaneous adapters

Plug and Play codes are grouped in classes according to their four-digit code. You can view and modify the device configuration used on your computer with Device Manager, which is located under the System option in the Control Panel.

Detection and enumeration are the two processes that Windows 98 uses to configure devices. Detection is the process Windows 98 uses during its search for legacy or non-Plug and Play devices on a computer. Detection is used during Windows 98 Setup and any time you use the Add New Hardware Wizard to search for new hardware installed in your computer. Detection does not run each time you start Windows 98. During the detection process, Windows 98 creates a log file called Detlog.txt in the root directory of the boot drive. This file is commonly referenced when troubleshooting problems with hardware detection.

Enumeration is the process Windows 98 uses to identify Plug and Play devices in your computer, including those devices on Plug and Play buses, such as ISAPNP, PCI, and PC Card (PCMCIA) devices. Enumeration occurs each time Windows 98 starts and whenever Windows 98 receives notification that a change has occurred in the computer's hardware configuration, such as when you remove a PC Card.

View Preferences and the Registry

This section describes how Windows 98 stores View preferences for the desktop and windows that you open. View preferences include icon size, position, layout.

Windows 98 stores up to 28 entries containing View preferences for the desktop and windows that you open in a most-recently-used (MRU) list. When you close a window, the View preferences are written to subkeys with the names 0, 1, 2, and so on, located in the following registry key:

HKEY_CURRENT_USER \Software \Microsoft \Windows \CurrentVersion \Explorer \Streams

The MRU list in the following registry key defines the order of the 28 entries:

HKEY_CURRENT_USER \Software \Microsoft \Windows \CurrentVersion \Explorer \StreamMRU

When the desktop or one of the windows is no longer included in the MRU list, the desktop or window uses the default settings the next time the desktop or window is redrawn or refreshed.

When you make a change to the desktop or a window, the View preferences for the desktop or window are moved to the top of the MRU list. That item remains on the MRU list until it reaches the 28th spot. When an item reaches the 28th spot and another window is closed, the 28th item is removed from the MRU list.

Modem Registry Key Entries

The following section describes information stored in specific modem registry keys that might help advanced users correct problems with the commands that Windows 98 uses to control a modem. To identify modem problems, you can enable Windows 98 to create a Modemlog.txt file (as described in Chapter 21, "Modems and Communications Tools"), which contains responses to and from a modem when a connection was made. The Modemlog.txt file might indicate when Windows 98 is sending an incorrect command string to a modem, or when a response code is not being correctly interpreted. After consulting the documentation for the modem, you might be able to adjust the modem's registry keys to restore proper operation.

Modem registry keys are stored under the following key:

HKEY_LOCAL_MACHINE \System \CurrentControlSet \Services \Class Modem

For each installed modem, Windows 98 creates one registry key (starting with \0000); additional subkeys, which contain AT commands that Windows 98 uses to initialize, dial, and answer the modem; plus other entries that communications and modem drivers use.

Some of the more important entries that you can use to correct or optimize modem operation are described in the following sections. The full set of modem registry keys and the INF file format are documented in the Microsoft Windows 98 Device Development Kit.

Init Key

The multiple, modem-command string entries in the Init key initialize the modem before Windows 98 uses it. The name of each entry is its sequence number, starting with the number 1, and its data is the command that is sent to the modem. Usually, the Init key entry 1 is AT<cr>, which starts the modem. Init entry 2 usually contains &F or a similar command to restore the modem to its default settings. Subsequent Init key entries contain miscellaneous commands to configure the modem so it is compatible with Windows 98.

Responses Key

The Responses key contains strings that the modem might report to Windows 98 in response to a command or during the connection process. The name of each subkey is the text of a single modem response, and its data is a 10-byte binary value specifying the meaning of the response to Windows in a coded format. The first two characters (byte 0) specify the meaning of the response code, using one of the following values.

Value	Type	Description
00	OK	The modem accepted the previous command.
01	Negotiation Progress	Status information about a new connection is being reported.
02	Connect	A call is connected; the modem is in data mode.
03	Error	The modem rejected the previous command.
04	No Carrier	The call was disconnected.
05	No Dial Tone	No dial tone is present.
06	Busy	The dialed modem is busy.
07	No Answer	The dialed modem did not answer.
08	Ring	There is an incoming call.
1C	Blacklisted	The remote number does not answer as a modem.
ID	Delayed	The user should wait before trying this call again.

The second two characters (byte 1) specify information about a connection that is being made. It is used only for response codes of type Negotiation Progress or Connect, and is one of the following values.

Value	Error control negotiated	Compression negotiated	Cellular protocol negotiated
00	–	–	–
01	–	X	–
02	X	–	–
03	X	X	–
08	–	–	X
09	–	X	X
0A	X	–	X
0B	X	X	X

The next eight characters (bytes 2 – 5) specify the modem-to-modem line speed negotiated in bits per second (bps). The characters represent a 32-bit integer, doubleword format (byte and word reversed). Common examples for this value include the following.

Bits per second	String
2400	60 09 00 00
9600	80 25 00 00
14400	40 38 00 00
19200	00 4b 00 00
28800	80 70 00 00
33600	40 83 00 00
56000	C0 DA 00 00

The last eight characters (bytes 6 – 9) indicate that the modem is changing to a different port or Data Terminal Equipment (DTE) speed. Usually, this field is not used, because modems make connections at a "locked" port speed, regardless of the modem-to-modem or Data Communications Equipment (DCE) speed. However, for modems that support only "direct" modes, you can lower the DTE speed by specifying a negotiated DTE speed for a response code, using the same format as the DCE speed described in the preceding table.

Settings Key

The Settings key contains commands for configuring various modem settings. After the Init key commands are sent, Windows 98 builds a dynamic configuration command string by concatenating various entries shown in Table 31.16. The command string depends on the settings selected in the modem's properties.

Table 31.16 Settings key entries

Subkey	Description	Example
Prefix	Configuration command prefix	AT
Terminator	Configuration command suffix	<cr>
DialPrefix	Dial command prefix	D
Dial_Pulse	Use pulse dialing	P
Dial_Tone	Use tone dialing	T
Blind_Off	Detect dial tone before dialing	X4
Blind_On	Do not detect dial tone before dialing	X3
CallSetupFailTimeout	Specify call setup time-out	S7=<#>
InactivityTimeout	Specify inactivity time-out	S30=<#>
SpeakerVolume_Low	Low speaker volume	L1
SpeakerVolume_Med	Medium speaker volume	L2
SpeakerVolume_High	High speaker volume	L3
SpeakerMode_Off	Speaker always off	M0
SpeakerMode_Dial	Speaker on during dial and negotiation	M1
SpeakerMode_On	Speaker always on	M2
SpeakerMode_Setup	Speaker on only during negotiation	M3
FlowControl_Off	No flow control	&K0
FlowControl_Hard	Hardware flow control	&K1
FlowControl_Soft	Software flow control	&K2
ErrorControl_Off	Error control disabled (normal mode, not direct)	+Q6S36=3S48=128
ErrorControl_On	Error control enabled (auto reliable)	+Q5S36=7S48=7
ErrorControl_Forced	Error control required to connect (reliable)	+Q5S36=4S48=7
ErrorControl_Cellular	Cellular protocol enabled	\N3-K1)M1-Q1*H1
Compression_On	Compression enabled	S46=138
Compression_Off	Compression disabled	S46=136
Modulation_CCITT	Use CCITT modulations for 300 and 1200 bps	B0
Modulation_Bell	Use Bell modulations for 300 and 1200 bps	B1
SpeedNegotiation_Off	Connect only at default modem speed; do not fall back	N0
SpeedNegotiation_On	Use lower DCE speed to connect, if necessary	N1

Supporting Phone Message Record and Playback

To support the telephone answering machine functions of recording incoming phone messages and playing the messages back through the handset when there is no active call, you must use your modem INF file to put values in the different registry keys outlined in Table 31.17.

Table 31.17 Phone message record and playback registry keys

Registry key	Value
AbortPlay	Command that stops playing audio data immediately (does not play the rest of the audio buffer contents). This command is not used for modems that are not using a serial wave device.
CloseHandset	Command that resets the modem to Class 0.
HandsetSetPlayFormat	Command that sets the modem's handset playback format.
HandsetSetRecordFormat	Command that sets the modem's handset recording format.
LineSetPlayFormat	Command that sets the modem's line playback format.
LineSetRecordFormat	Command that sets the modem's line recording format.
OpenHandset	Command that puts modem in a mode that enables audio to be played back through the handset when there is no active call.
StartPlay	Command that starts playing audio (wave files) out of the modem. If a serial wave driver is being used, a bit in the VoiceProfile key controls whether the baud is set prior to the StartPlay command or after the StartPlay command.
StartRecord	Command that starts recording audio (wave files) from the modem. If a serial wave driver is being used, a bit in the VoiceProfile key controls whether the baud is set prior to the StartRecord command or after the StartRecord command.
StopPlay	Command that can be used to reset the modem's baud after an AbortPlay or TerminatePlay command. A bit in the VoiceProfile key indicates whether Unimodem/V has to reset the UART's baud.
StopRecord	Command that stops recording audio (wave files) from the modem. If a serial wave driver is being used, a bit in the VoiceProfile key controls whether the baud is set prior to the StopRecord command or after the StopRecord command.
TerminateRecord	Command that causes the modem to finish recording its local buffer and stop recording audio data. This command is not used for modems that are not using a serial wave device.
TerminatePlay	Command that causes the modem to finish playing the contents of its local buffer and stop playing audio data after that. This command is not used for modems that are not using a serial wave device.

TCP/IP Registry Key Entries

This section documents the Windows 98 registry entries for TCP/IP.

Configuration settings for Microsoft TCP/IP are stored in the Registry as part of the protocol installation process. If Dynamic Host Configuration Protocol (DHCP) is used on the network, configuration information can also be provided by DHCP client service. DHCP-provided information is stored in the registry in binary format and cannot be altered by editing it. However, static information can be entered in the registry, which overrides DHCP default values.

TCP/IP Registry Entries in the MSTCP Subkey

The value entries are added to the following registry key:

HKEY_LOCAL_MACHINE \System \CurrentControlSet \Services \VxD\MSTCP

Descriptions of the TCP/IP values in the MSTCP are described in Table 31.18 (all data types are DWORD).

Table 31 .18 TCP/IP registry entries

Value	Description
BroadcastAddress = broadcast address in hexadecimal	Specifies the address to use for NetBIOS name query broadcasts. The default is based on the Internet Protocol (IP) address and the subnet mask.
BcastNameQueryCount = integer	Specifies the number of times the system will retry NetBIOS name query broadcasts. The default is 3.
BcastQueryTimeout = milliseconds	Specifies the period of time the system will wait before timing out broadcast name queries. The minimum value is 100. The default is 750.
BSDUrgent = 0 or 1	If this value is 1, it specifies that Microsoft TCP/IP is to treat urgent data the way some UNIX systems do (with a maximum of 1 byte of urgent data, for example). If this value is 0, it specifies that the stack is to handle urgent data as specified by RFC 1122. The default is 1.
CacheTimeout = milliseconds	Specifies how long NetBIOS names are cached. The minimum is 60,000 milliseconds (1 minute). The default is 360,000 milliseconds (6 minutes).
DeadGWDetect = 0 or 1	Specifies whether Microsoft TCP/IP will use another gateway if the current default gateway seems to be down. The default is 1.
DefaultRcvWindow = 16-bit number	Specifies the default receive window advertised by TCP. The default is 8192.
DefaultTOS = 8-bit number	Specifies the default type of service (TOS) for IP packets initiated by Microsoft TCP/IP. The default is 0.
DefaultTTL = 8-bit number	Specifies the default time to live (TTL) for IP packets initiated by Microsoft TCP/IP. The default is 128.
DnsServerPort = port	Specifies which DNS server port to send queries to when resolving a name using DNS. The default is 53.
EnableProxy = 0 or 1	If this value is 1, it specifies that this computer is a Windows Internet Naming Service (WINS) proxy agent. The default is 0.
EnableRouting = 0 or 1	Specifies whether to enable static routing. Microsoft TCP/IP does not supply a routing protocol, so all route table entries must be entered using the route command. The default is 0.
IGMPLevel = 0, 1, or 2	Specifies the level of support allowed for IP multicast, corresponding to the levels in RFC 1112. The default is 2.
InitialRefreshT.O. = milliseconds	Specifies the interval over which to contact WINS to refresh the name. The minimum is 16 minutes, and the maximum is approximately 50 days (0xFFFFFFFF). The default is 960,000 milliseconds (16 minutes).
KeepAliveTime = 32-bit number	Specifies the connection idle time in milliseconds before TCP will begin sending keepalives, if keepalives are enabled on a connection. The default is 2 hours (7,200,000 milliseconds).
KeepAliveInterval = 32-bit number	Specifies the time in milliseconds between retransmissions of keepalives, once the KeepAliveTime has expired. Once KeepAliveTime has expired, keepalives are sent every KeepAliveInterval milliseconds until a response is received, up to a maximum of MaxDataRetries before the connection is aborted. The default is 1 second (1000 milliseconds).
LmhostsTimeout = milliseconds	Specifies the period of time the system will wait before timing out when seeking LMHOSTS for name resolution. The minimum value is 1000 milliseconds (1 second). The default is 10,000 milliseconds (10 seconds).
MaxConnections = 32-bit number	Specifies the maximum number of concurrent connections. The default is 100.
MaxConnectRetries = 32-bit number	Specifies the number of times a connection attempt (SYN) will be retransmitted before giving up. The initial retransmission timeout is 3 seconds, and it is doubled each time up to a maximum of 2 minutes. The default is 3.
MaxDataRetries = 32-bit number	Specifies the maximum number of times a segment carrying data or FIN will be retransmitted before the connection is aborted. The retransmission timeout itself is adaptive and will vary according to link conditions. The default is 5.
NameServerPort = port	Specifies the User Datagram Protocol (UDP) port on the name server to which to send name queries or registrations. The default is 137.
NameSrvQueryCount = integer	Specifies the number of times the system will try to contact the WINS server for NetBIOS name resolution. The default is 3.
NameSrvQueryTimeout = milliseconds	Specifies how long the system waits before timing out a name server query. The minimum is 100 milliseconds. The default is 750 milliseconds.
NameTableSize = integer	Specifies the maximum number of names in the NetBIOS name table. The minimum allowable value is 1 and the maximum is 255. The default is 17.
NodeType = 1, 2, 4, or 8	Specifies the mode of NetBIOS name resolution used by NetBIOS over TCP/IP, where 1 = b-node, 2 = p-node, 4 = m-node, and 8 = h-node. This value can be configured using DHCP. The default is 1 (b-node) if no value is specified; if WINS servers are specified and NodeType is not, the default is 8 (h-node).
PMTUBlackHoleDetect = 0 or 1	Specifies whether the stack will attempt to detect Maximum Transmission Unit (MTU) routers that do not send back Internet Control Message Protocol (ICMP) fragmentation-needed messages. Setting this parameter when it is not needed can cause performance degradation. The default is 0.
PMTUDiscovery = 0 or 1	Specifies whether Microsoft TCP/IP will attempt to perform path MTU discovery as specified in RFC 1191. The default is 1.
RandomAdapter = 0 or 1	For a computer with multiple network adapters, specifies whether to respond with an IP address selected randomly from the set of addresses on the computer or whether to return the IP address of the adapter that the request came in upon. The default is 0 (not random; that is, return the address of the adapter that the request came in upon).
RoutingBufSize = 32-bit number	Specifies the total amount of buffer space to allocate for routing packets. This parameter is ignored if EnableRouting=0. The default is 73,216.
RoutingPackets = 32-bit number	Specifies the maximum number of packets that can be routed simultaneously. This parameter is ignored if EnableRouting=0. The default is 50.
SessionKeepAlive = milliseconds	Specifies how often to send session keepalive packets on active sessions. The minimum is 60 seconds. The default is 3,600,000 milliseconds (1 hour).
SessionTableSize = integer	Specifies the maximum number of sessions in the NetBIOS session table. The minimum allowable value is 1 and the maximum is 255. The default is 255.
SingleResponse = 0 or 1	For a computer with multiple network adapters, specifies whether to send all IP addresses on a name query request from WINS. If this value is 1, the system will send one address in a name query response; if 0, it will return all the addresses of its adapters. The default is 0.
Size/Small/Medium/Large = 1, 2, or 3	Specifies how many buffers of various types to pre-allocate and the maximum that can be allocated, where 1 = small, 2 = medium, and 3 = large. The default is 1; the default is 3 if the WINS proxy is enabled.

TCP/IP Registry Entries in the MSTCP\ServiceProvider Subkey

This section describes variables for subkeys that appear in the following registry key:

HKEY_LOCAL_MACHINE \System \CurrentControlSet \Services \VxD \MSTCP \ServiceProvider

The Class and ProviderPath values are used by the service resolution and registry APIs in Windows Sockets. The Class parameter indicates that TCP/IP is a name service provider, and its binary value (8) should not be changed. The ProviderPath parameter is a string that defines the location and file name for the 32-bit Windows Sockets DLL (the default is %windir%\system\wsock32.dll).

The following keys describe the order used to resolve host names. A lower number sets a higher priority for name resolution. These settings are used for 16-bit Windows Sockets, which need to rely on the resolvers that are expected to take the least time. The numbers indicate the default values specified in Windows 98.

LocalPriority = 0x1F3 (499)
HostsPriority = 0x1F (500)
DNSPriority = 0x7D0 (2000)
NetbtPriority = 0x7D1 (2001)

TCP/IP Registry Entries in the NetTrans Subkey

The entries in this section must be added to the following registry key, where n represents the particular TCP/IP-to-network adapter binding.

HKEY_LOCAL_MACHINE \System \CurrentControlSet \Services \Class \netTrans \000n

Value	Data type	Description
MaxMTU = 16-bit integer	DWORD	Specifies the maximum size datagram IP that can pass to a media driver. Subnetwork Access Protocol (SNAP) and source routing headers (if used on the media) are not included in this value. For example, on an Ethernet network, MaxMTU will default to 1500. The actual value used will be the minimum of the value specified with this parameter and the size reported by the media driver. The default is the size reported by the media driver; an Ethernet network defaults to 1500 bytes and a Point-to-Point (PPP) Protocol dial-up connection defaults to 576 bytes.
ZeroBroadcast = 0 or 1	String	If this parameter is set to 1, then IP will use zeros-broadcasts (0.0.0.0.) instead of ones-broadcasts (255.255.255.255). Most systems use ones-broadcasts, but some systems derived from BSD implementations use zeros-broadcasts. Interoperation will not work well on the same network for systems that use different broadcasts. Valid Range 0 or 1 (false or true); Default: 0

Changing TCP/IP Node Types

The TCP/IP node type can be manually changed by editing the Windows 98 registry. The location is under the HKEY_LOCAL_MACHINE key under the following subkey:

\System\CurrentControlSet\Services\VxD\MSTCP\NodeType

The four TCP/IP node types are defined by number:

Number	Node Type	Description
1	b-node	Broadcast only
2	p-node	WINS only
4	m-node	Broadcast, then WINS
8	h-node	WINS, then broadcast

The default Windows 98 TCP/IP node types are:

If DHCP=False, and WINS is disabled, then NodeType=1 (b-node)
If DHCP=False, and WINS is manually set, then NodeType=8 (h-node)
If DHCP=True, and DHCP sets WINS, then NodeType=4 (m-node)
If DHCP=True, and WINS is manually set, then NodeType=8 (h-node)
If DHCP=True, and WINS is disabled, then NodeType=1 (b-node)

Troubleshooting the Registry

This section provides some tips for troubleshooting registry problems, and for troubleshooting your system using the registry.

Understanding Operating System Load and Desktop Initialization

Understanding this phase of the boot process can help when you need to troubleshoot registry and operating system problems.

The Windows 98 operating system load sequence is as follows:

Sequence	Component	Description
1	Registry	Base system information
2	System.ini	Legacy system configuration
3	Kernel32.dll	Main operating system code
4	Gdi.exe and Gdi32.dll	Graphical device interface; graphics engine
5	User.exe and User32.exe	Code for managing the user interface including the window manager
6	Resources and fonts
7	Win.ini	Legacy system program and user configuration

The Windows 98 desktop initialization sequence is as follows:

The Windows shell loads and machine policies are enforced.
The desktop components load.
If connected to a network, a logon prompt appears. Once the user is logged on, the logon scripts are carried out and policies are enforced for the user.
Once the user logs on, the system can process user-specific configuration information and load any user-specific policy files. If the user does not log on, default settings are used to determine user preferences. If network logon is set, the user is logged on to the network during this process.

Troubleshooting Registry Startup Errors

Accessing system registry.

When you start Windows 98, you receive one of the following error messages:

Windows encountered an error accessing the system Registry. Windows will restart and repair the system Registry for you now.

Windows 98 will restart your computer and run Registry Checker in MS-DOS mode (Scanreg.exe) to fix the problem.

Not enough memory.

When you start Windows 98, you receive the following error message:

Windows was unable to process the registry. This may be fixed by rebooting to Command Prompt Only and running SCANREG /FIX. Otherwise there may not be enough conventional memory to properly load the registry.

If you see this message after you run ScanReg /Fix, then you need to free up conventional memory in your computer.

Error When Removing a Program with Add/Remove Programs

When you remove a program using the Add/Remove Programs option in Control Panel, you receive the following error message:

An error occurred while trying to remove <Program Name>.
Uninstallation has been canceled.

This error can occur if you have manually deleted a program that is listed in the Install/Uninstall list in the Add/Remove Programs Properties dialog box. To remove a program from the Install/Uninstall list, delete the appropriate key under the following registry key:

HKEY_LOCAL_MACHINE \Software \Microsoft \Windows \CurrentVersion \Uninstall

Windows 98 Cannot Find a Needed Device File

When you start Windows 98, you receive an error message telling you that Windows 98 cannot find a device file that may be needed to run Windows or a Windows-based application. Sometimes a specific file name is specified.

This error message can occur for either of the following reasons:

A Windows virtual device driver (VxD) referenced in the System.ini file or registry is missing or damaged.
One of the StaticVxD values in the registry contains invalid data. For example, the value is blank or contains only spaces. In this case, the missing device driver is not named in the error message.

To resolve this problem, follow each step below until the error no longer occurs:

If you recently removed a program or component, reinstall the program or component, then run the uninstall program if one is available. If no uninstall program is available for the program or component, contact the manufacturer to obtain instructions on uninstalling.
If the missing device driver has a .386 extension, disable the line referring to this device driver in the System.ini file by placing a semicolon (;) at the beginning of the line.

For example, if the line referencing the missing device driver reads:
```
device=Example.386
```

change the line to read: 

<pre IsFakePre="true" xmlns="https://www.w3.org/1999/xhtml">;device=Example.386

If the missing device driver has a .vxd extension, it is a driver designed for use with Windows 98 and is referenced in the registry. In most cases, a program or component with drivers designed for use with Windows 98 will also be listed in the Add/Remove Programs option in Control Panel. Following the instructions in step 1 should correct the problem.

If the error occurs after following the instructions in step 1, you need to locate the value that references the missing device driver in the registry, and delete that registry value.

If a specific device driver is not named in the error message, one of the StaticVxD values in the registry is probably blank or contains only spaces. The StaticVxD values are located in the registry keys below the following key:

HKEY_LOCAL_MACHINE \System \CurrentControlSet \Services \VxD

Use Registry Editor to locate and delete any StaticVxD value in the registry that contains invalid data, is blank, or contains only spaces.

When Windows 98 starts, the System.ini file and the registry are read to obtain a list of device drivers to load. When Windows 98 cannot locate a virtual device driver that it is attempting to load, an error message is generated.

Virtual device drivers are files required by various programs to communicate with your computer's hardware.

The following sample registry key contains a StaticVxD value:

HKEY_LOCAL_MACHINE \System \CurrentControlSet \Services \VxD \COMBUFF

The data for this StaticVxD value is "*COMBUFF" (without the quotation marks; the quotation marks appear in Registry Editor, but are not part of the VxD name). The asterisk (*) preceding the VxD name indicates that the VxD is internal to the Vmm32.vxd file. If the VxD referenced by the StaticVxD value is not internal to the Vmm32.vxd file, its name is not preceded by an asterisk and typically has a .vxd extension.

Additional Resources

For more information about	See this resource
Windows 98 registry	Inside the Microsoft Windows 98 Registry by Günter Born
Windows NT registry	The Microsoft Windows NT Workstation Resource Kit The Microsoft Windows NT Server Resource Kit
Programming the registry	The Microsoft Windows 98 Software Development Kit Win32 Software Development Kit for Windows 98 and Windows NT

Value	Error control negotiated	Compression negotiated	Cellular protocol negotiated
00	–	–	–
01	–	X	–
02	X	–	–
03	X	X	–
08	–	–	X
09	–	X	X
0A	X	–	X
0B	X	X	X

Value	Error control negotiated	Compression negotiated	Cellular protocol negotiated
00	–	–	–
01	–	X	–
02	X	–	–
03	X	X	–
08	–	–	X
09	–	X	X
0A	X	–	X
0B	X	X	X