What is the Windows Registry?
Almost every setting Windows uses lives in the registry: drivers and services, file associations, startup programs, policy settings, and each user's desktop and app preferences. The Settings app, Control Panel, Group Policy and software installers all write to it behind the scenes. Technicians open it directly with Registry Editor (regedit.exe) when a fix calls for checking or changing one specific value.
How the registry is organized
The layout works like a file system. Keys act like folders, subkeys nest inside them, and values are the entries in the right pane. Each value has a name, a data type and data. Registry Editor shows five root keys:
| Root key | Short form | What it holds |
|---|---|---|
| HKEY_LOCAL_MACHINE | HKLM | Machine-wide settings: hardware, drivers, services, installed software, security |
| HKEY_CURRENT_USER | HKCU | Settings for the signed-in user; it is a pointer to that user's branch of HKU |
| HKEY_USERS | HKU | Every loaded user profile, listed by security identifier (SID), plus .DEFAULT |
| HKEY_CLASSES_ROOT | HKCR | File associations and COM registrations, merged from HKLM and HKCU |
| HKEY_CURRENT_CONFIG | HKCC | The hardware profile in use since startup |
Common value types are REG_SZ (text), REG_EXPAND_SZ (text containing variables such as %SystemRoot%), REG_MULTI_SZ (a list of strings), REG_DWORD (a 32-bit number, often 1 for on and 0 for off), REG_QWORD (a 64-bit number) and REG_BINARY (raw bytes).
On disk, the machine hives are files in C:\Windows\System32\config (SAM, SECURITY, SOFTWARE, SYSTEM and DEFAULT). Each user's HKCU data is stored in NTUSER.DAT in that user's profile folder. When a profile's hive cannot load, Windows may sign the user in with a temporary profile.
Editing the registry safely
- Press Win+R, type
regeditand approve the User Account Control prompt. - Paste a path into the address bar, or use Edit > Find (Ctrl+F, then F3 for the next match).
- Back up first: right-click the key and choose Export to save a .reg file. Double-clicking that file later merges it back. A restore point also captures the registry.
- Change one value at a time and test. Some changes need a sign-out, a service restart or a reboot.
Edits are written immediately. There is no Save button and no undo. Skip registry cleaner utilities; they fix nothing a technician needs and can remove entries Windows depends on. For scripts, reg query, reg add, reg delete, reg export and reg import do the same work from the command line, and PowerShell exposes HKLM: and HKCU: as drives.
Keys every technician should recognize
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Runand the same path under HKCU: programs that start at sign-in for every user (HKLM) or one user (HKCU). TheRunOncekey beside each runs an entry once, then deletes it.HKLM\SYSTEM\CurrentControlSet\Services: one subkey per service and driver, including its start type.HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon: the Shell and Userinit values, which malware sometimes changes.HKLM\SOFTWARE\PoliciesandHKCU\Software\Policies: where many Group Policy settings are written.
Troubleshooting cues
- A program or pop-up comes back after you disable it in Startup apps: check the Run and RunOnce keys, and Task Scheduler, for a persistence entry.
- "Registry editing has been disabled by your administrator": a policy blocks regedit. On a managed PC that is deliberate; on a home PC it is a classic malware sign.
- A problem that follows one account points to HKCU. A problem for every account points to HKLM.
Windows Registry on the CompTIA A+ exam
Registry Editor is one of the Windows tools in Core 2 (220-1202) objective 1.4. Know the regedit command, the five root keys and what each holds, HKCU versus HKLM scope, and the rule to export a key before editing it. Questions tend to ask where a setting lives or what to do before a change rather than test deep edits. If a program keeps launching for every user, think HKLM Run key; for one user only, think HKCU.