Editing Windows Registry (section)

=== Keys and values ===
The registry contains two basic elements: '''keys''' and '''values'''. Registry ''keys'' are container objects similar to folders. Registry ''values'' are non-container objects similar to files. Keys may contain values and subkeys. Keys are referenced with a syntax similar to Windows' path names, using backslashes to indicate levels of hierarchy. Keys must have a [[Case sensitivity|case insensitive]] name without backslashes.

The hierarchy of registry keys can only be accessed from a known root key handle (which is anonymous but whose effective value is a constant numeric handle) that is mapped to the content of a registry key preloaded by the kernel from a stored "hive", or to the content of a subkey within another root key, or mapped to a registered service or DLL that provides access to its contained subkeys and values.

E.g. {{code|HKEY_LOCAL_MACHINE\Software\Microsoft\Windows}} refers to the subkey "Windows" of the subkey "Microsoft" of the subkey "Software" of the HKEY_LOCAL_MACHINE root key.

There are seven predefined root keys, traditionally named according to their constant handles defined in the Win32 API, or by synonymous abbreviations (depending on applications):{{Sfn|Hipson|2002|p=5, 41–43}}
* HKEY_LOCAL_MACHINE or HKLM
* HKEY_CURRENT_CONFIG or HKCC
* HKEY_CLASSES_ROOT or HKCR
* HKEY_CURRENT_USER or HKCU
* HKEY_USERS or HKU
* HKEY_PERFORMANCE_DATA (only in Windows NT, but invisible in the Windows Registry Editor)<ref>{{cite book|url=https://books.google.com/books?id=r5tCAwAAQBAJ&pg=PT260|title=Windows Via C/C++|last1=Richter|first1=Jeffrey|last2=Nasarre|first2=Christophe|publisher=[[Microsoft Press]]|date=2008|access-date=August 28, 2021|edition=Fifth|isbn=9780735642461}}</ref>
* HKEY_DYN_DATA (only in Windows 9x, and visible in the Windows Registry Editor)

Like other files and services in Windows, all registry keys may be restricted by [[access control list]]s (ACLs), depending on user privileges, or on security tokens acquired by applications, or on system security policies enforced by the system (these restrictions may be predefined by the system itself, and configured by local system administrators or by domain administrators). Different users, programs, services or remote systems may only see some parts of the hierarchy or distinct hierarchies from the same root keys.

Registry ''values'' are name/data pairs stored within keys. Registry values are referenced separately from registry keys. Each registry value stored in a registry key has a unique name whose letter case is not significant. The [[Windows API]] functions that query and manipulate registry values take value names separately from the key path or handle that identifies the parent key. Registry values may contain backslashes in their names, but doing so makes them difficult to distinguish from their key paths when using some legacy Windows Registry API functions (whose usage is deprecated in Win32).

The terminology is somewhat misleading, as each registry key is similar to an [[associative array]], where standard terminology would refer to the name part of each registry value as a "key". The terms are a holdout from the 16-bit registry in Windows 3, in which registry keys could not contain arbitrary name/data pairs, but rather contained only one unnamed value (which had to be a string). In this sense, the Windows 3 registry was like a single associative array, in which the keys (in the sense of both 'registry key' and 'associative array key') formed a hierarchy, and the registry values were all strings. When the 32-bit registry was created, so was the additional capability of creating multiple named values per key, and the meanings of the names were somewhat distorted.<ref>[[Raymond Chen]], [https://devblogs.microsoft.com/oldnewthing/20080118-00/?p=23773 "Why do registry keys have a default value?"]</ref> For compatibility with the previous behavior, each registry key may have a "default" value, whose name is the empty string.

Each value can store arbitrary data with variable length and encoding, but which is associated with a symbolic type (defined as a numeric constant) defining how to parse this data. The standard types are:{{Sfn|Hipson|2002|pp=207, 513–514}}

{|class="wikitable"
|+ List of standard registry value types
|-
! Type ID  !! Symbolic type name !! Meaning and encoding of the data stored in the registry value
|-
| 0 || {{mono|REG_NONE}} || No type (the stored value, if any)
|-
| 1 || {{mono|REG_SZ}} || A [[string (computer science)|string]] value, normally stored and exposed in [[UTF-16]]LE (when using the Unicode version of Win32 API functions), usually terminated by a NUL character
|-
| 2 || {{mono|REG_EXPAND_SZ}} || An "expandable" string value that can contain [[environment variable]]s, normally stored and exposed in UTF-16LE, usually terminated by a NUL character
|-
| 3 || {{mono|REG_BINARY}} || Binary data (any arbitrary data)
|-
| 4 || {{mono|REG_DWORD / REG_DWORD_LITTLE_ENDIAN}} || A [[Dword (Computer)|DWORD]] value, a 32-bit [[Signedness|unsigned]] [[integer]] (numbers between 0 and 4,294,967,295 [2<sup>32</sup> – 1]) (little-[[Endianness|endian]])
|-
| 5 || {{mono|REG_DWORD_BIG_ENDIAN}} || A [[Dword (Computer)|DWORD]] value, a 32-bit [[Signedness|unsigned]] [[integer]] (numbers between 0 and 4,294,967,295 [2<sup>32</sup> – 1]) (big-[[Endianness|endian]])
|-
| 6 || {{mono|REG_LINK}} || A symbolic link (UNICODE) to another registry key, specifying a root key and the path to the target key
|-
| 7 || {{mono|REG_MULTI_SZ}} || A multi-string value, which is an ordered list of non-empty [[string (computer science)|strings]], normally stored and exposed in Unicode, each one terminated by a null character, the list being normally terminated by a second null character.{{Sfn|Hipson|2002|pp=520–521}}
|-
| 8 || {{mono|REG_RESOURCE_LIST}} || A resource list (used by the ''Plug-n-Play'' hardware enumeration and configuration)
|-
| 9 || {{mono|REG_FULL_RESOURCE_DESCRIPTOR}} || A resource descriptor (used by the ''Plug-n-Play'' hardware enumeration and configuration)
|-
| 10 || {{mono|REG_RESOURCE_REQUIREMENTS_LIST}} || A resource requirements list (used by the ''Plug-n-Play'' hardware enumeration and configuration)
|-
| 11 || {{mono|REG_QWORD / REG_QWORD_LITTLE_ENDIAN}} || A [[Word_(computer_architecture)#Size_families|QWORD]] value, a 64-bit integer (either big- or little-endian, or unspecified) (introduced in [[Windows 2000]]){{Sfn|Hipson|2002|p=7}}
|}