Introduction to NT Registry structure

HKEY_CLASSES_ROOT: It includes information about OLE and file associations. The purpose of this setting is to provide compatibility with the current Windows 3.x.

HKEY_CURRENT_USER: It is used to manage information about the users currently logged on to the system. This information includes:

The user's desktop and the appearance and behavior that the NT Server presents to the user;

Connection to all network devices;

Desktop program items, application parameter selections, screen colors, and other personal interests, as well as security permissions. This information is saved for the system to retrieve and use when the user logs in.

When a user modifies his or her environment device, the information about this item is changed.

HKEY_LOCAL_MACHINE: It includes information about the computers that are running NT, including applications, drivers, and hardware information. There are five separate projects under it:

Hardware: It is used to save computer hardware information, every time the system boots hardware will be recreated, so it is easier to add new hardware to the system. It does not make sense for the user to modify this item without going into effect. There are four additional subprojects under this project: DESCRIPTION: This includes CPU,FPU and system bus, while system buses is about I/O storage and other device information; DeviceMap: The information is related to the keyboard, print port, mouse and other devices Ownermap: Where information is about PCI device based information; Resourcemap: It mainly contains information from the HAL (Hardware abstraction Layer), as well as information about I/O devices, drivers, SCSI adapter cards, system resources and video resources;

Sam: The Security Accounts Manager (SAM) stores users and information in a SAM, and the information in the SAM is inaccessible, regardless of the editor. The system administrator's user management program is used to manage Sam information;

Security: The information in this connection is related to local safety and user rights, including a copy of the SAM information. Of course, it can't be edited in a normal editor. The main content is user rights, password rules and local group members;

SOFTWARE: It contains information about the installed system software and user software, as well as the corresponding descriptive information. corresponding to each installed software product, these items store parameter selection information, configuration information, MRU (most recently used files) list, and other items that can be modified by the application.

System: This includes information about systems startup, device drivers, services, and NT Server configuration.

HKEY_USERS: This includes information about all currently active users who have user profiles. It has two subprojects below:. ID of default and current Logged-on user ... Default is for devices that do not have user profiles for logged-in users.

Hkey_current_config: There is no such item in the previous version of NT 4, and its information comes from HKEY_LOCAL_MACHINE\System and HKEY_LOCAL_MACHINE\Software respectively, But it only holds a subset of the information.

Hkey_dyn_data: It is also the first time in NT 4, it contains the Plug and Play state of the system, because NT 4 does not support Plug and Play, so the content of this item is empty. It may be used in later versions.