Editing the Windows Vista Registry with Regedit
When a computer is not working properly, there are situations where editing the registry is the best troubleshooting technique. My primary aim is to give you the skill, the practice, and above all, the confidence to launch regedit and change the registry settings. My secondary aim is to persuade you to take sensible precautions, for example, export at least that particular branch before editing any registry values.
As usual, I have lots of worked examples, which I urge you to try on your own machine. Each registry tweak has two aims; to solve a specific problem, and to provide general learning points, which help you to master regedit. Most of the tweaks work equally well on Vista, XP and Windows Server 2003 registries, where there are differences I will explain what happens in each operating system.
Introduction to the Registry
There will be times when your research reveals that there is simply no GUI to configure a particular Vista setting. Consequently, the only hope of solving the problem is to edit a value in the registry. Another reason to acquire confidence at editing the registry, is so that you can repair a defective machine remotely.
Officially, you edit the Vista registry by adding keys, or modifying values, colloquially, this process is called 'tweaking the registry', or 'hacking the registry'. If I have a hidden agenda it is that in general, learning should be fun, and in particular, that tweaking the registry should be satisfying. To reinforce this 'let's have fun' message, many of my examples also have amusing anecdotes.
- A collection of all the operating system's configurable settings.
- A replacement for all those ancient .ini files.
- A database for Group Policy settings.
- A no-go area for amateurs!
- A tool for troubleshooting operating system problems.
- A back-end for Control Panel's front-end.
- A vehicle for having fun while you tweak Vista's performance and appearance.
To become expert at any task you need to acquire a range of skills. Because the registry is live, with no 'Simulate' button, and no safety catch, I have arranged the following techniques as a progression. Here is my sequence for mastering the registry along with examples of how to develop the corresponding technique.
1. Launch Regedit
I will be giving you clear instructions to help you master tweaking the registry. Nevertheless, do take precautions. The best defence against a mistake would be to experiment with the registry on a test machine. My favorite technique for recovering from mini-disasters is to export the registry key BEFORE I start editing values. What I do in regedit is click on the File menu, Export, Selected Branch. Every other expert will tell you to backup the System State before you begin.
Let us assume that your mission is to change a setting in Vista by using the registry editor.
- Click on the Vista Start Orb
(Button) - Click in the Start Search Dialog Box
- Type regedit
- Press enter (or double click Program: regedit)
- See screenshot opposite
Note 1: Unlike other Vista executables, if you type just the first few letters, 'reg' or 'reged', Vista does not auto-complete the name of the program, you have to type the full name - regedit.
Note 2: Another clue that amateurs are not supposed to open the registry, is that the special editor, Regedit, does not appear on any Vista menu.
Note 3: The actual executable is called regedit, but for backwards compatibility with NT 4.0, it also responds to the name of regedt32.
- Before you make any changes to the registry settings, get into the habit of exporting at least that branch of the registry.
- Backup the system state before you try anything radical in the registry.
- Check out the .sav files in the \system32\config folder.
- Research Volume Shadow Copy, and test how it restores a previous version of your registry files.
- If your computer has a serious problem, which requires pressing F8 at boot-up, remember to try Last Known Good as your first recovery option.
- Seek alternative methods; think laterally. Instead of risking making changes with your registry editor, what else could you do? I urge you to consider configuring a Group Policy rather than tweaking the registry. Occasionally Vista may provide a new GUI to configure a setting, for example, instead of launching regedit and changing the value for AutoAdminLogon, you could launch the Control Panel --> Users and un-tick the setting called, 'Users must enter a user name and password.'
- Learn how to perform a remote registry edit with: Connect Network Registry.
- As you work through my registry examples, make a point of studying each page's 'Key Learning Points'.
2. Find Settings, Values and Data
Vista Registry - CachedLogonsCount
A security hack may be a contradiction in terms! However, I once had a client who wanted to improve their laptop security, for them, minimizing cached logons was the answer. Another user with a different laptop wanted to increase their cached logons to 50; in both cases tweaking the registry was the only solution.
The default number of cached logons for a client such as Vista or XP is 10 (shortly to be increased to 25 in Longhorn). With a registry edit of CachedLogonsCount, we can reduce this to value zero. My client had laptops which operated on an Active Directory domain, and they did not want users (or hackers) to logon unless the laptop could authenticate with a domain controller. Since there is no GUI to reset the cached logons, this is a job for a registry tweak.
Topics for CachedLogonsCount
I have divided our task into two parts. Our first task is to find the correct part of the registry; our second task is to edit the actual registry value.
Method 1) Flashy Launch Regedit. Click on the Edit menu and then select 'Find'. Now type Winlogon in the 'Find what:' dialog box. Put a tick in only the 'Keys' box, see screenshot to the right. The purpose of this technique is to navigate to the folder containing CachedLogonsCount as quickly as possible.
Note: If you don't tick 'Match whole string only', you may have to press F3 two or three times until you see the following path at the very bottom of the regedit screen:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\winlogon
Method 2) Safe and sure If Method 1 fails, then here is an alternative method, launch regedit and manually drill down to:
HKLM**\Software\Microsoft\Windows NT\CurrentVersion\winlogon.
The default value for the cached logons count is 10 (maybe increased to 25). Our job is to edit this REG_SZ value from 10 to zero. Before you go any further, check the path; there are at least four instances of 'Winlogon' in the registry.
Let us assume that you have reached: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\winlogon. The next task is to double-click CachedLogonsCount. If this setting is not present, no worries, just right-click in the right hand pane, and create a new REG_SZ called CachedLogonsCount.
For increased security, double-click and change the value for CachedLogonsCount to 0 (zero). Alternatively, to give a laptop the maximum cached logons when it is away from its domain controller, set the value = 50 (maximum number)
CachedLogonsCount
- Were you able to master: Find - 'Keys'?
- Do you find the CachedLogonsCount value in HKCU** or HKLM?
Answer: HKLM - Do you have to add a value, or modify an existing setting?
Answer: Modify changing 10 --> 0. (or 10 --> 50) - Is it a String Value or a DWORD?
Answer: REG_SZ (String value). - Do you need to Restart, or merely Logoff / Logon?
Answer: Restart - This example merely edits an existing value.
- Tip: F3 speeds up searching when using 'Find'.
** HKLM is an abbreviation of HKEY_LOCAL_MACHINE, and HKCU is shorthand for HKEY_CURRENT_USER. These acronyms are so well known that you can even use them in .reg files, Vista will understand and obey the registry instruction.
- Before you make any changes to the registry settings, get into the habit of exporting at least that branch of the registry.
- Backup the system state before you try anything radical in the registry.
- Check out the .sav files in the \system32\config folder.
- Research Volume Shadow Copy, and test how it restores a previous version of your registry files.
- If your computer has a serious problem, which requires pressing F8 at boot-up, remember to try Last Known Good as your first recovery option.
- Seek alternative methods; think laterally. Instead of risking making changes with your registry editor, what else could you do? I urge you to consider configuring a Group Policy rather than tweaking the registry. Occasionally Vista may provide a new GUI to configure a setting, for example, instead of launching regedit and changing the value for AutoAdminLogon, you could launch the Control Panel --> Users and un-tick the setting called, 'Users must enter a user name and password.'
- Learn how to perform a remote registry edit with: Connect Network Registry.
- As you work through my registry examples, make a point of studying each page's 'Key Learning Points'.
3. Add setting to 'Favorites' - (Any, and every example)
4. Export a registry key - (Any, and every example)
5. Change an existing value
Registry Tweak to Display the Windows Vista (TM) Build 6000
During the Vista Beta program it was important to display the correct Build number, that way you could see which version you were testing. Many 'techies' were disappointed because the final production version of Vista did not display its badge of honour - 'Build 6000', or 6001 after apply SP1. This omission prompted me to do a little exploring in the Vista registry, and I came up with a value called PaintDesktopVersion.
Instructions for PaintDesktopVersion 
- Launch Regedit See more details on starting regedit
Navigate to this key: - HKEY_CURRENT_USER\Control Panel\Desktop
- Scroll down and find the existing entry called PaintDesktopVersion. Double click and change its value to numeric one. Please note that there is no need to create this DWORD, as it's already there.
- Check you now see: PaintDesktopVersion = 1
- The default is PaintDesktopVersion = 0 meaning do not display the build number. Incidentally, this DWORD is also found in XP and Windows Server 2003.
- A simple registry tweak to change a value from zero (setting disabled) to one (setting enabled)
- Do you find the PaintDesktopVersion value in HKCU** or HKLM?
Answer: HKCU - Should you add a value, or modify an existing setting?
Answer: Modify 0 --> 1 - Is PaintDesktopVersion a String Value or a DWORD?
Answer: DWORD. - Do you need to Restart, or merely Log Off / On?
Answer: Log Off --> Log On and view: Build 6000 (or 6001 after applying SP1). - Tip: Add this Value, PaintDesktopVersion to Regedit's Favorites menu
- Tip: To find the value that controls the build number quickly; launch regedit, click on the Edit menu, Find, type PaintDesktopVersion.
By rights I should remove this section because it just does not work in Vista. The reason that I am leaving it here, is as an example of a registry settings that works in XP, but not in Vista. I thank RBL for alerting me to this difference in behavior.
As far as I can see the Aero Graphics by-passes the MenuShowDelay setting. To tell the whole story, MenuShowDelay works in Vista, but only if you Personalize the Theme, and change the appearance from Windows Vista to say, Windows Classic. However, in my opinion, disabling the Aero graphics would be a sacrilege.
While you are at **HKEY_CURRENT_USER\Control Panel\Desktop, have some fun with a cheeky little registry entry called MenuShowDelay. When you click on the Start menu or the 'All Programs' and select an item with an arrow, there is a fractional delay before the submenu pops out. The default delay is 400 milliseconds, before the submenu appears. Here is where you could have some fun:
Set the value for MenuShowDelay to 50, and claim to impressionable friends that you have a faster edition of XP called: 'XP SuperDo'.
Alternatively, you could set the value to 4000 and con non-technical managers that you need a faster machine! Show them how slowly the Vista menus open.
Instructions for MenuShowDelay
- Launch Regedit and navigate to this key:
- HKEY_CURRENT_USER\Control Panel\Desktop
- Scroll down and find the existing entry called MenuShowDelay. Double click and change its value to 50 (fast) or 4000 (slow). Please note that there is no need to create this REG_SZ, as it's already there.
- The default is MenuShowDelay = 400 meaning do not display the submenu for 4/10 of a second.
Key Learning Points
- Do you find the MenuShowDelay value in HKCU** or HKLM?
Answer: HKCU - Should you add a value, or modify an existing setting?
Answer: Modify 4000 --> 40 - Is MenuShowDelay a String Value or a DWORD?
Answer: REG_SZ. - Do you need to Restart, or merely Log Off / On?
Answer: Log Off --> Log On and test the Start submenus - Tip: Add this Value, MenuShowDelay to Regedit's Favorites menu
** HKLM is an abbreviation of HKEY_LOCAL_MACHINE, and HKCU is shorthand for HKEY_CURRENT_USER. These acronyms are so well known that you can even use them in .reg files, Vista will understand and obey the registry instruction.
Vista Registry - RegisteredOwner and RegisteredOrganization
When you buy a machine with Vista pre-installed, sometimes OEM's leave their name in your copy of Vista (or XP). A little research reveals that such names are stored in registry values called: RegisteredOwner and RegisteredOrganization. Here is a registry hack to edit the value to reflect your organization.
As a bonus, I have an amusing story featuring Evans Twp and his experience of RegisteredOwner.
To see what I am talking about call for 'winver'. In Vista, click in the Start Search dialog box, and then type: winver.
- Launch Regedit (See more details on starting regedit)
- Navigate to:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\. Alternatively, in Regedit, click the Edit menu, Find, and then type: RegisteredOwner in the dialog box. - Double click on the REG_SZ called RegisteredOwner.
- Change the value to a name of your choice.
- Repeat the above instructions for RegisteredOrganization.
- Exit Regedit and launch Start Search, type winver in the dialog box.
- Is RegisteredOwner a value in HKCU** or HKLM?
Answer: HKLM - Do you have to add a value, or modify an existing setting?
Answer: Modify - Is it a String Value or a DWORD?
Answer: String (REG_SZ). - Do you need to Restart, or merely Logoff / Logon?
Answer: neither, just type 'Winver' in Vista's Start Search dialog box.
** HKLM is an abbreviation of HKEY_LOCAL_MACHINE, and HKCU is shorthand for HKEY_CURRENT_USER. These acronyms are so well known that you can even use them in .reg files, Vista will understand and obey the registry instruction.
In my homeland of Wales, Twp (pronounced Tupp) means a stupid person. The IT manager of a company I was working with was called Evans, and in common with many mangers, he was not very IT literate. Consequently, one of the techies, Dai 'eighteen months', nicknamed this manager: Evans Twp. (Dai lost part of an ear in a Rugby scrum, and as a result, he only had an ear and a half!).
The IT department took on a new lad called Peter. Practical jokes are often part of the initiation ritual for new workers, and this company was no exception. Peter's first job was to install five new Vista Machines. During the scripted set-up he discovered the Organization Menu; he stopped and asked Dai 'eighteen months' what he should enter. Dai said, "Put Evans Twp in the box".
When Peter proudly showed off the new computers he was taken aback when Mr Evans went ballistic and accused Peter of undermining his authority. What happened was Mr Evans typed Winver in the Start Search menu, and saw that the 'Registered To' was: - Evans Twp. (Meaning: Evans the stupid one!)
I was visiting the company doing other work, when I heard of Peter's distress. Mr Evans told the poor lad that had to come in at the weekend and reinstall the machines, Mr Evans wanted the company name as the 'Registered Owner'. I took Peter aside and showed him how to launch Regedit and find RegisteredOwner. We found Evans Twp and changed it to Mr Evans. Peter was thrilled as it only took a moment to make the registry hack, and Peter went to the rugby match instead of sacrificing his weekend to perform re-installs.
Creating a .Reg File
This page explains how to create, and then edit .reg files for your computer. As it's easy to import the contents of a .reg file into the registry, do take extra care with procedures.
Read More..
