Windows 注册表^{(Windows Registry)}是存储Microsoft Windows操作系统的设置和选项的目录。它包含所有硬件、操作系统软件、大多数非操作系统软件、用户、PC 偏好等的信息和设置。这篇文章讨论的是Windows 注册表基础知识^{(Windows Registry Basics)}。

每当用户更改控制面板^{(Control Panel)}设置、文件关联、系统策略或大多数已安装的软件时，这些更改都会反映并存储在注册表中。注册表还提供了一个进入内核操作的窗口，显示运行时信息，例如性能计数器和当前活动的硬件。

引入Windows^(Windows)注册表是为了整理大量的每个程序INI文件^(INI)，这些文件以前用于存储Windows程序的配置设置。这些文件往往分散在整个系统中，这使得它们难以追踪。

阅读^(Read)： 何时保存对注册表的更改？

Windows 注册表基础

注册表由以下 5 个^{(The Registry consists of the following 5)} 根键^{(Root Keys)}组成：

• HKEY_CLASSES_ROOT
• HKEY_CURRENT_USER
• HKEY_LOCAL_MACHINE
• HKEY_USERS
• HKEY_CURRENT_CONFIG。

根密钥包含子密钥^(SubKeys)。子键也可能包含它们自己的子键，并且至少包含一个值，称为^{(Subkeys may contain subkeys of their own too and contain at least one value, called as its )}默认值^{(Default Value)}。具有所有子键和值的键称为Hive。

注册表位于 system32/config 文件夹中的磁盘上，作为几个单独的Hive文件。然后，每次 Windows 启动或用户^(User)登录时，这些Hive文件都会被读入内存。^(Hive)要查看Hive的物理存储位置，请参阅：

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\HiveList

您可以阅读有关Windows 注册表文件位置的更多信息。

注册表^(Registry)使用以下数据类型：

• REG_SZ： SZ 表示以零结尾的字符串。这是一个可变长度字符串，可以包含Unicode和ANSI字符。
• REG_BINARY：它包含二进制数据。0 和 1。
• REG_DWORD：此数据类型是双字^(Word)。它是一个 32 位的数值，可以保存 0 到 232 之间的任何数字。
• REG_QWORD：这种数据类型是一个四字^(Word)。它是一个 64 位数值。
• REG_MULTI_SZ：此数据类型包含一组分配给单个值的以零结尾的字符串。
• REG_EXPAND_SZ：此数据类型是一个以零结尾的字符串，其中包含对环境变量的未扩展引用，例如 % SystemRoot %。

Windows 中的注册表虚拟化

从Windows Vista开始，随着文件虚拟化，注册表^(Registry)也被虚拟化，因此与Windows XP不同，不会出现臃肿的问题。在Windows 7中也是如此。

在Windows Vista及更高版本中，UAC利用注册表虚拟化功能^{(Registry Virtualization Feature)}，将写入尝试重定向到

HKEY_LOCAL_MACHINE\Software

当应用程序尝试写入此配置单元时，Vista会将其写入每个用户的位置，

HKEY_CLASSES_ROOT\VirtualStore\Machine\Software

这是谨慎进行的。没有人知道这正在发生！

简而言之，这就是注册表虚拟化，它是一项有用的安全功能。^{(This is, in short, Registry Virtualization, and it is a useful Security feature.)}

顺便提一下，还必须提到Windows Vista及更高版本的另一项新技术：内核事务管理器^{(Kernel Transaction Manager)}，它启用了事务注册表^{(Transactional Registry)}。此功能启用某种注册表^(Registry)回滚。但它没有在Registry Editor中实现。相反，此功能旨在供需要使用事务处理创建健壮应用程序的开发人员使用。

阅读：^(Read:) 如何在 Windows 中创建注册表项。

注册表编辑器

Windows 10/8/7/Vista中直接使用注册表的主要工具是注册表编辑器^{(Registry Editor)}。要访问它，只需在 Vista 的开始菜单搜索栏中键入^{(Start Menu Search Bar)}regedit并按Enter！

使用Registry^(Registry)时必须加倍小心，因为没有确认提示或单击 OK 保存提示。所做的更改将直接合并。

您可以阅读有关Windows 注册表编辑器提示和功能^{(Windows Registry Editor Tips & Features)}的更多信息。Windows 10 v1703 的用户可以使用地址栏直接跳转到任何注册表项。

必须特别提及

HKEY_LOCAL_MACHINE\System\CurrentControlSet

hive，因为这个特殊的键对于Windows启动非常重要，它的备份得到维护，您可以在必要时恢复，只需在安全模式下^{(Safe Mode)}启动并选择Last Known Good Configuration。

您可能还想阅读这些帖子：^{(You might want to read these posts too:)}

1. 如何修复损坏或损坏的注册表^{(How to repair corrupted or damaged Registry)}
2. 开始菜单和任务栏注册表调整
3. 备份和恢复注册表^{(Backup and restore the registry)}
4. 监视对注册表的更改^{(Monitor changes to the Registry)}。
5. 如何打开注册表的多个实例
6. Windows 注册表路径中使用了表情符号；你知道吗！？

Windows Registry Basics: De-Mystifying Windows Registry

The Windows Registry is a directory that stores settings and options for the operating system for Microsoft Windows. It contains information and settings for all the hardware, operating system software, most non-operating system software, users, preferences of the PC, etc. This post talks about Windows Registry Basics.

Whenever a user makes changes to Control Panel settings, file associations, system policies, or most installed software, the changes are reflected and stored in the registry. The registry also provides a window into the operation of the kernel, exposing runtime information such as performance counters and currently active hardware.

The Windows registry was introduced to tidy up the profusion of per-program INI files that had previously been used to store configuration settings for Windows programs. These files tended to be scattered all over the system, which made them difficult to track.

Read: When do changes to the Registry get saved?

Windows Registry Basics

The Registry consists of the following 5 Root Keys:

• HKEY_CLASSES_ROOT
• HKEY_CURRENT_USER
• HKEY_LOCAL_MACHINE
• HKEY_USERS
• HKEY_CURRENT_CONFIG.

Root Keys contain SubKeys. Subkeys may contain subkeys of their own too and contain at least one value, called as its Default Value. A key with all its subkeys and values is called as a Hive.

The Registry is located on the Disk in the system32/config folder as several separate Hive files. These Hive files are then read into memory every time Windows starts or when the User logs on. To see where the Hives are physically stored, see:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\HiveList

You can read more about the location of Windows Registry files.

The Registry uses the following data types:

• REG_SZ : The SZ indicates a zero-terminated string. This is a variable-length string that can contain Unicode as well as ANSI characters.
• REG_BINARY : It contains binary data. 0’s & 1’s.
• REG_DWORD : This data type is a Double Word. It is a 32-bit numeric value and can hold any number from 0 to 232.
• REG_QWORD : This data type is a Quadruple Word. It is a 64-bit numeric value.
• REG_MULTI_SZ : This data type contains a group of zero-terminated strings assigned to a single value.
• REG_EXPAND_SZ : This data type is a zero-terminated string containing an unexpanded reference to an environment variable, like say, %SystemRoot%.

Registry Virtualization in Windows

Starting with Windows Vista, along with File Virtualization, the Registry too, has been Virtualized, and hence unlike Windows XP, does not tend to suffer from bloat. The same has been continued in Windows 7.

In Windows Vista and later, the UAC utilizes the Registry Virtualization Feature, to redirect attempts to write to subkeys of

HKEY_LOCAL_MACHINE\Software

When an application attempts to write to this hive, Vista instead, writes it, to a per-user location,

HKEY_CLASSES_ROOT\VirtualStore\Machine\Software

This is done discreetly. No one gets to know that this is happening!

This is, in short, Registry Virtualization, and it is a useful Security feature.

Incidentally, mention must also be made of another new technology underlying Windows Vista and later: The Kernel Transaction Manager, which enables the Transactional Registry. This feature enables a sort of a Registry rollback. But it’s not implemented in Registry Editor. Instead, this feature is designed for use by developers who need to create robust applications using transactional processing.

Read: How to create a Registry Key in Windows.

Registry Editor

The primary tool in Windows 10/8/7/Vista for working directly with the registry is Registry Editor. To access it, simply type regedit in Vista’s Start Menu Search Bar and hit Enter!

You have to be doubly careful when working with the Registry, as there is no confirmation prompt or a click OK to save prompt. Changes made are directly incorporated.

You can read more about Windows Registry Editor Tips & Features. Users of Windows 10 v1703 can use the Address Bar to jump directly to any registry key.

Mention must specifically be made of the

HKEY_LOCAL_MACHINE\System\CurrentControlSet

hive as the keys in this particular is so essential for Windows to start-up, that its backup is maintained, which you can restore when necessary, simply by booting in Safe Mode and selecting Last Known Good Configuration.

You might want to read these posts too:

1. How to repair corrupted or damaged Registry
2. Start Menu and TaskBar Registry Tweaks
3. Backup and restore the registry
4. Monitor changes to the Registry.
5. How to open multiple instances of the Registry
6. Emojis are being used in the Windows Registry path; Did you know!?

Related posts

• 打开或关闭Windows Spotlight使用Registry or Group Policy Editor

• 如何使用Windows 10的Charmap and Eudcedit内置工具

• Microsoft Visual C++再分配包装：FAQ and Download

• 如何在Windows 10 PC上使用Input Method Editor（IME）

• 如何在Windows 10启用或Disable Archive Apps feature

• Create New，Resize，Extend Partition使用Disk Management Tool

• 在Windows 10打开或Off Caret Browsing Support

• 如何在地图上Network Drive或Windows 11/10添加FTP Drive

• 什么是OOBE或Windows 11/10外的全新体验？

• Local，LocalLow，在AppData上Windows 10漫游文件夹

• 在Windows Mixed Reality中打开或Off Use Speech Recognition

• Windows 10 version 2004 May 2020 Update New功能

• 如何建立一个Internet connection在Windows 11/10

• 如何恢复或重置Windows Firewall设置为默认设置

• 如何在Windows 10中使用Apps启用HDR

• 在Windows 11/10启用硬件加速GPU Scheduling

• 什么是USB Selective Suspend feature？如何启用或禁用它？

• 如何在Windows 11/10中更改News and Interests Feed Language

• 如何在Windows 11/10中运行Windows Memory Diagnostics Tool

• 在Windows 10中启用，Disable Data Collection Reliability Monitor