Microsoft

Comparing the Windows 98 and the Windows NT registries

Ever want to know how registries differ between Windows 98 and NT? In this Daily Drill Down, Brien Posey points out the key differences.


As you no doubt already know, both Windows 98 and Windows NT rely heavily on a massive database called the Windows registry. At first glance, it would seem that both registries are identical. However, critical differences exist between the two registries. In this Daily Drill Down, I’ll discuss the similarities and differences between the two registries.

Before we begin
Before I get started, it’s important to point out that editing the registry is dangerous. All those stories you’ve heard about destroying Windows and your programs if you make a mistake are true. If you decide to edit your registry, you should make sure that you have a good backup first.

The second thing that I need to explain is that almost every computer’s registry is different. Every time you add hardware or software, or change a Control Panel option, the registry changes. Although every registry is different, there are still elements that all registries have in common. It’s those common factors that I’ll be focusing on in this Daily Drill Down.

Space doesn’t permit me to discuss each common registry key. Doing so would produce a very large book. Rather, my goal is to provide you with enough information that you understand the biggest similarities and differences in the Windows 98 and Windows NT registries.

The registry editors, Regedit and Regedt32
The primary tool for making manual registry changes is the Registry Editor. Because of the Registry Editor’s destructive capability, Microsoft didn’t create an icon for it within Windows. Therefore, you must either create your own icon or run the Registry Editor from the command prompt. If you’re running Windows NT, you should make sure that you’re logged in as the Administrator before trying to use the registry editor. If you’re logged in with an account other than the Administrator, certain portions of the registry may be invisible or inaccessible.

Windows NT version 4.0 actually has two different registry editors. Regedt32 mimics the Registry Editor found in previous versions of Windows NT. It displays each main section of the registry in a different window.

The other registry editor is identical to the one used in Windows 98. You can access this registry editor in both versions of Windows by using the Regedit command. Although this is the only version of the registry editor that’s available in Windows 98, it’s the preferred version in Windows NT. That’s because it contains some handy search tools that aren’t found in Regedt32.

Viewing keys in Regedit
In Regedit, the registry is displayed as primary registry keys beneath My Computer. Each of these primary keys has a plus sign beside it that you can click to expand the key. Any time that you see a plus sign, you can further expand the registry. When you reach the deepest key in a given path, you can click on the key to see the key’s values.

In Windows 98, there are six keys. In Windows NT, the sixth key, the HKEY_DYN_DATA section, is virtually nonexistent. In fact, it doesn’t exist in the Regedt32 program, and although it is visible in the Regedit program, it’s inaccessible.

Each key’s value is made up of a name and the value’s data. Any time you need to make a change to an existing value, simply right-click it. Doing so brings up a context menu that lets you modify or delete a value. Modifying a value allows you to edit only the data portion of the value.

To create a new key or value, navigate to the desired location and select the New command from the Edit menu. Creating a new key works exactly like creating a new folder under Windows Explorer. However, you can create three different types of values: String, Binary, and DWORD.

Two other features of the Registry Editor deserve mention. First, the Registry Editor has the ability to edit a remote computer’s registry via the Connect Network Registry command on the Registry menu. Second, the Find and Find Next commands on the Edit menu allow you to locate specific keys and values throughout the registry. You can even search for a partial word or value. As you become more comfortable with editing the registry, you’ll use the Find feature a lot, since the registry tends to be very large and can potentially contain multiple instances of a given value.

The registry structure
Each registry key is responsible for controlling a different portion of Windows. In the sections that follow, I’ll explain the function of each key.

HKEY_CLASSES_ROOT
The HKEY_CLASSES_ROOT section works similarly under both versions of Windows. Its primary purpose is the registration of file extensions. For example, the Windows Write program registers the .wri file extension here. If you look under the WRI key, you’ll observe that it has a default value of WRIFILE.

Locate the WRIFILE entry, which is also located in the HKEY_CLASSES_ROOT section of the registry. There are multiple entries below this key. The CLSID entry contains a reference number associated with the Windows Write program. The Default Icon entry contains the actual location of the program’s executable file.

The WRIFILE key also contains a Shell subkey, which has subkeys beneath it. These subkeys have names such as Open, Print, and Printto. Each of these subkeys has a command subkey beneath it. The command subkeys control the behavior of some of the corresponding program’s context menu options. For example, if you right-click a file that has the .wri extension, the resulting context menu will contain commands that correspond to the keys found in this section of the registry. Figure A shows how the WRI key looks in Regedit under HKEY_CLASSES_ROOT.

Figure A
The WRI key in HKEY_CLASSES_ROOT shows the structure of registry entries.


I mentioned earlier that one of the subkeys was the CLSID key, which contains the program’s reference number. Any program’s reference number also corresponds to another registry entry under HKEY_CLASSES_ROOT | CLSID. This entry establishes another point of reference to the program’s physical location.

HKEY_CURRENT_USER
The HKEY_CURRENT_USER key contains the options available to the user who’s currently logged in. Although the Windows 95 and Windows 98 registries contain a key with an identical name, the HKEY_CURRENT_USER key does much more in Windows NT than in Windows 98. For example, in Windows 98, this registry key holds the recently opened documents list and the keyboard layout settings. In Windows NT, however, this registry key is directly linked to the user’s security profile. This isn’t the case in Windows 98 unless you have profiles enabled. Even so, the Windows NT implementation is more extensive. For example, in Windows NT, this key contains information on which Control Panel applets the user is allowed to run. In Windows NT or in Windows 98 with profiles enabled, when a user logs in, Windows uses that user’s profile information to build this registry key.

Another variation in the Windows registries is the AppEvent subkey. Although both versions of Windows contain this subkey, the Windows NT implementation is much more extensive than that found in Windows 98. This subkey contains a registry entry for various system actions, such as emptying the Recycle Bin or receiving a general protection fault. You can use these registry keys to assign sounds to the various events and, in some cases, to set an automated system response to the action. Keep in mind, though, that any such parameters found in this section apply only to the user who’s currently logged in.

HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE controls aspects that relate specifically to the physical computer and the software loaded on it. Because Windows NT is so strict about every aspect of your computer’s hardware, it should come as no surprise that this registry key is much more complex than its Windows 98 counterpart.

The first subkey is the Hardware key. Although the Hardware subkey is of relatively little importance in Windows 98, it’s absolutely crucial to Windows NT. Perhaps the most interesting section of the Hardware subkey is the RESOURCEMAP subkey. Beneath it is configuration information for many of the hardware devices in your system.

Another main section under HKEY_LOCAL_MACHINE is the SOFTWARE section. The SOFTWARE subkey contains information about most software that’s installed on your system. Keep in mind that only software designed for Windows NT or Windows 98 will make an entry in this section. Also, some simpler programs may not require registry entries. Programs that depend on registry entries each have their own subkey below HKEY_LOCAL_MACHINE | SOFTWARE. Some software manufacturers, such as Microsoft, may rely on an additional subkey containing the name of the company. For example, software published by Microsoft places its registry keys under HKEY_LOCAL_MACHINE | SOFTWARE | Microsoft.

If you look deeper into the SOFTWARE | Microsoft subkey, you’ll see that there’s an entry for Windows or Windows NT, depending on which operating system you’re using. The Windows or Windows NT subkey stores registry entries relating to add-ons to the operating system. For example, in Windows NT the HKEY_LOCAL_MACHINE | SOFTWARE | Microsoft | Windows NT | CurrentVersion key contains information about which fonts and drivers are installed and about such aspects as network configurations, time zones, and port configurations. In Windows 98, similar information is found under HKEY_LOCAL_MACHINE | SOFTWARE | Microsoft | Windows | CurrentVersion.

Another section of HKEY_LOCAL_MACHINE worth discussing is the SYSTEM subkey. Although everything under the SYSTEM subkey is critical to the operation of Windows, the area of most interest is usually the CurrentControlSet subkey. Beneath CurrentControlSet are several other subkeys.

The HKEY_LOCAL_MACHINE | SYSTEM | CurrentControlSet | Control key stores such crucial information as the computer name and what to do in the event of a crash. Both versions of Windows contain this subkey; however, each version contains keys within this section that are version specific.

Other areas of interest in the Windows NT HKEY_LOCAL_MACHINE | SYSTEM | CurrentControlSet key are the Enum and the Hardware Profiles keys. The Enum key contains configuration information that tells Windows NT how to respond, then a program attempts to make a direct call to a device. The configuration information found in this section tells Windows NT to intercept the call and deal with it in a manner that won’t be harmful to other programs. The Hardware Profiles section allows you to set up multiple hardware profiles. For example, you might have a docked and an undocked profile for a notebook computer. In Windows 98, similar information is found under HKEY_LOCAL_MACHINE | ENUM and under HKEY_LOCAL_MACHINE | Hardware. However, keep in mind that Windows 98 works with hardware much differently than Windows NT does. In the Windows 98 implementation, these sections contain plug-and-play information and basic processor and serial port configuration information.

Another key found beneath the CurrentControlSet key in Windows NT is the Services key. This key contains information about Windows NT’s various services. The information found in subkeys beneath Services includes the services’ location and startup type. Because the Service Control Manager is specific to Windows NT, Windows 98 doesn’t contain an equivalent to this section.

HKEY_USERS
The HKEY_USERS key stores profiles for each user with an account that resides on the computer. When a user logs in, his or her settings are read from HKEY_USERS and copied to HKEY_CURRENT_USER. In Windows NT, the registry uses each user’s SID number rather than a login name for the name of the related key. In Windows 98, this key contains only user-specific information if you’ve enabled profiles. Otherwise, the default system profile is the only one that’s stored in this section.

HKEY_CURRENT_CONFIG
In both versions of Windows, the main purpose of the HKEY_CURRENT_CONFIG key is to store video and Internet settings. All of the aspects relating to your video card’s resolution and refresh rate are stored under this key. Likewise, you can find information about the way your physical Internet connection is configured under HKEY_CURRENT_CONFIG | SOFTWARE | Microsoft | Windows | CurrentVersion | Internet Settings.

HKEY_DYN_DATA
As I mentioned earlier, the HKEY_DYN_DATA section is virtually nonexistent in Windows NT. In Windows 98, it controls some of the operating system’s low-level functions. For example, plug-and-play information and other device settings are stored under this key. However, in Windows NT, plug and play doesn’t exist, and much of the other information normally stored in this key is stored beneath other keys instead.

Conclusion
There are critical differences between the Windows NT and Windows 98 registries. In this Daily Drill Down, I’ve explained some of the similarities and differences between registry settings in the two OSs.

Brien M. Posey is an MCSE who works as a freelance technical writer and as a network engineer for the Department of Defense. If you’d like to contact Brien, send him an e-mail. (Because of the large volume of e-mail he receives, it's impossible for him to respond to every message. However, he does read them all.)

The authors and editors have taken care in preparation of the content contained herein, but make no expressed or implied warranty of any kind and assume no responsibility for errors or omissions. No liability is assumed for any damages. Always have a verified backup before making any changes.

Editor's Picks

Free Newsletters, In your Inbox