All startup-related data that must be stored (rather than computed during startup) is saved in the System hive. A complete copy of the data is also stored in the SYSTEM.ALT file. The data in HKEY_LOCAL_MACHINE\SYSTEM—which is the System hive—is organized into control sets that contain a complete set of parameters for devices and services as described in this section. You may occasionally need to change entries in the CurrentControlSet subkey, as described in Chapter 12, "Configuration Management and the Registry."
The following example shows the structure of this subtree:
The following sections describe the HKEY_LOCAL_MACHINE\SYSTEM subkeys.
The Registry, particularly data in the System hive, is essential to starting the system. To help ensure that the system can always be started, a kind of backup version is kept, which allows you to undo any configuration changes that did not have the intended effect. This section describes how it works.
All of the data required to control startup is gathered into subtrees called control sets in the Registry. Each control set has two parts, a Control subkey and a Services subkey. The Control subkey contains various data items used to control the system, including such things as the computer's network name and the subsystems to start. The Services subkey contains a list of drivers, file systems, user-mode service programs, and virtual hardware keys. Its data controls the services (drivers, file systems, and so on) to be loaded and their load order. The data in the Services subkey also controls how the services call each other.
Multiple control sets are saved as subtrees of HKEY_LOCAL_MACHINE\SYSTEM under names such as ControlSet001 and ControlSet003. Although as many as four control sets can appear, there are usually two sets. This is similar to having multiple sets of CONFIG.SYS files under MS-DOS — a current one and a backup copy known to start the system correctly. However, the work for creating and maintaining backups is all done automatically by the system.
The Select subkey describes how the control sets are used in four value entries:
The CurrentControlSet subkey is not the root of an actual control set; rather, it is a symbolic link to the control set indicated by the value of Current. It's there so that constant paths can be used to refer to keys in the currently used control set, even though the name of that control set may change.
These multiple control sets are used to allow escape from various problems. Each time the system starts, the control set used to actually start up is saved away (under Clone). If the startup is declared "good," the old LastKnownGood control set is discarded, and the Clone subtree is copied to replace it. Administrators can change how system startup is declared "good," but usually it means no Severe or Critical errors in starting services and at least one successful logon.
If system startup fails in certain ways or if the user chooses LastKnownGood from the Configuration Recovery menu, the LastKnownGood control set will be used to start the system instead of the Default control set. The Default set will be reserved as Failed, and the LastKnownGood set cloned to make a new LastKnownGood set. The LastKnownGood set becomes the new Default set. The effect of all of this is to undo all changes to configuration data stored in a control set since the last time a startup was declared "good." (User profile data is stored elsewhere and is therefore unaffected by this.)
Tip
You can choose from among control sets on a computer by pressing the SPACEBAR immediately after selecting Windows NT at the Boot Loader prompt. A message asks if you want to choose to start the system using the current control set or the last known good configuration.
To find out whether Default or Last Known Good was used, see the values in the Select subkey.
You can modify the information stored in these subkeys by choosing the Devices, Network, Server, and Services icons in Control Panel, or by using Server Manager.
If you need to modify the configuration in Registry Editor, make changes under the CurrentControlSet subkey.
The Control and Services keys found in each control set are described in the following sections.
The Control subkey contains startup parameters for the system, including information about the subsystems to load, computer-dependent environment variables, the size and location of the paging files, and so on. The following illustration shows the typical Control subkeys, and Table 10.5 describes the contents of some typical subkeys.
Table 10.5 Typical Subkeys of \CurrentControlSet\Control for All Control Sets
Subkey | Contents |
BootVerificationProgram | A value that can be set to define a nonstandard mechanism to declare system startup as "good," as described in Chapter 12, "Configuration Management and the Registry." |
ComputerName | The names of the default and active computers, stored in two subkeys, ComputerName and ActiveComputerName. The computer name should be set using the Network icon in Control Panel. |
GroupOrderList | Specifies the order to load services for all groups that have one, used in combination with Tags. ServiceGroupOrder specifies the order for loading groups. |
ServiceGroupOrder | Specifies the order to load various groups of services. Order within groups is specified using Tags and GroupOrderList. |
HiveList | The location of the files that contain Registry information. This value should be maintained only by the system. |
Keyboard Layout | The DLLs for the keyboard language used as the default layout, plus a subkey named DosKeybCodes that lists the other available keyboard layouts. Settings for keyboard layout should be set by using the International icon in Control Panel. |
Lsa | The authentication package for the local security authority. This value should be maintained only by the system—errors may prevent anyone from being able to log on to the computer. |
NetworkProvider | Two subkeys, Active and Order, that specify the network provider and the order in which to load providers. Settings for network providers should be set by choosing the Network icon in Control Panel. |
Nls | Information on national language support in three subkeys: CodePage, Language, and OEMLocale. Preferences about language and locale in Windows NT should be set using the International icon in Control Panel. |
Information about the current printers and printing environment, contained in several subkeys: Environments, which contains subkeys defining drivers and print processors for system environments such as Windows NT Alpha_AXP, Windows NT R4000, and Windows NT x86. Monitors, which can contain subkeys with data for specific network printing monitors. Printers, which can contain subkeys describing printer parameters for each installed printer. Providers, which can contain subkeys describing DLLs for network print services. Printing parameters should be changed by using Print Manager. | |
PriorityControl | The Win32 priority separation. This value should be set only by using the System icon in Control Panel. |
ProductOptions | The product type, such as Winnt. These values should be maintained only by the system. |
Session Manager | Global variables used by Session Manager and these keys: DOS Devices, which defines the MS-DOS devices AUX, MAILSLOT, NUL, PIPE, PRN, and UNC. Environment, which defines the ComSpec, Path, Os2LibPath, and WinDir variables. User environment variables can be set using the System icon in Control Panel. If you want to change or add to the computer's default path, or add default system environment variables, you must change values in this subkey. For an example, see Chapter 14, "Registry Value Entries." FileRenameOperations, which are used during startup to rename certain files so that they can be replaced. These values should be maintained only by the system. KnownDLLs, which defines the directories and filenames for the Session Manager DLLs. These values should be maintained only by the system. MemoryManagement, which defines paging options. The paging file should be defined by using the System icon in Control Panel. SubSystems, which defines information for the Windows NT subsystems. These values should be maintained only by the system. |
Setup | Hardware setup options. These values should be maintained only by the system. Users can make choices by running Windows NT Setup. |
TimeZoneInformation | Values for time zone information. These settings should be set by using the Date/Time icon in Control Panel. |
VirtualDeviceDrivers | Virtual device drivers. These values should be maintained only by the system. |
Windows | Paths for the Windows NT directory and system directory. These values should be maintained only by the system. |
WOW | Options for 16-bit Windows-based applications running under Windows NT. These settings should be maintained only by the system. |
The Services subkey in each control set lists all of the Kernel device drivers, file system drivers, and Win32 service drivers that can be loaded by the Boot Loader, the I/O Manager, and the Service Control Manager. The Services subkey also contains subkeys that are static descriptions of hardware to which drivers can be attached. Table 10.6 describes some typical Services subkeys for a Windows NT computer.
Entries that appear under the DeviceMap subkeys include values that refer to entries in the Services subkey in the control set. For example, for a serial mouse, the following entry might appear under the DeviceMap\PointerPort subkey in HKEY_LOCAL_MACHINE\HARDWARE:
\Device\PointerPort0 : \REGISTRY\Machine\System\ControlSet001
\Services\SermouseA related Services subkey named Sermouse will define values for the serial mouse driver. For example:
To view this information in an easily readable format, run Windows NT Diagnostics, and then choose the Drivers button and review details about a selected driver. You can choose the Devices icon in Control Panel to change startup and other information for a driver. For suggestions about how a system administrator can use this information for troubleshooting, see Chapter 12, "Configuration Management and the Registry."
Each subkey includes several standard (but optional) entries as shown in the following example, where Alerter is the name of a service that appears in the Services Control database.
The value entries that govern the behavior of a service include ErrorControl, Group, DependOnGroup, DependOnService, ImagePath, ObjectName, Start, Tag, and Type. For definitions of these value entries, see "CurrentControlSet\Services Subkeys" in Chapter 14, "Registry Value Entries."
The optional Linkage subkey specifies the binding options for the driver using the Bind and Export values. The OtherDependencies value that appears in the Linkage subkey for some services allows nodes to be loaded in an order related to other specific nodes with which they are closely associated. For example, the NBF transport depends on an NDIS driver. Therefore, to load the NBF protocol stack successfully, an NDIS network card driver must be loaded first. For details about loading order dependencies for network components, see "Dependency Handling for Network Components," later in this chapter.
The Parameters subkey (optional for some Services subkeys such as an adapter entry) contains a set of values to be passed to the driver. These values vary for each device driver. The following shows parameters for the serial mouse driver.
Because the entries in the Services list are Registry keys, no assumptions can be made about their order in an enumeration, so services can explicitly specify load ordering by grouping services and drivers in order by type. For example, the SCSI port driver can be loaded before any of the miniport drivers. The ordering is specified under the \Control\ServiceGroupOrder subkey in a control set.
Settings for the drivers that appear under the Services subkeys can be changed using the Devices, Network, or Services icons in Control Panel or, for network services, User Manager For Domains in Windows NT. Specific parameters for drivers and services are described in Chapter 14, "Registry Values Entries."
Table 10.6 Descriptions of Typical Services Subkeys for a Windows NT Computer
Service name | Description |
Abiosdsk | Primary disk1 |
Ahaxxx | Adaptec SCSI adapters1 |
Alerter | Alerter service for the workstation3 |
AtDisk | Primary disk driver for non-SCSI hard disks1 |
Ati | ATI video display1 |
Beep | Base sound driver1 |
Bowser | Network1 |
Browser | Computer browser used by Workstation and Server services3 |
BusLogic | BusLogic SCSI adapter1 |
Busmouse | Bus mouse pointer1 |
Cdaudio | Filter1 |
Cdfs | SCSI CD-ROM class file system driver1 |
Cdfs_Rec | Recognizer for SCSI CD-ROM class file system1 |
Cirrus | Cirrus Logic video display1 |
ClipSrv | ClipBook (NetDDE service)3 |
Cpqarray | Compaq array driver (no additional Registry values) |
Dell_DGX | Dell DGX video display1 |
Diskperf | Filter1 |
DLC | DLC transport2 |
DptScsi | DPT SCSI adapter1 |
Et4000 | Tseng ET4000 video display1 |
EventLog | Event log service3 |
Fastfat | FAT boot file system driver1 |
Fat_Rec | Recognizer for FAT boot file system1 |
Fd16_700 | Future Domain MCS 600/700, TMC-7000ex, 800-series SCSI adapters1 |
Floppy | Primary disk1 |
Ftdisk | Filter1 |
Hpfs_Rec | Recognizer for HPFS boot file system1 |
i8042pt | Keyboard driver1 |
Inport | Microsoft InPort Mouse pointer1 |
Jazzgxxx | Video display1 |
Jzvxl484 | Video display1 |
Kbdclss | Keyboard class driver1 |
LanmanServer | Server service3 |
Lanman Workstation | Workstation service3 |
Messenger | Messenger service for workstation3 |
Mouclass | Mouse class driver1 |
Mup | Network1 |
Nbf | NetBEUI transport protocol1, 2 |
Ncrxxx | NCR SCSI controllers and adapters1 |
NetBIOS | NetBIOS transport interface1, 2 |
NetDDE et al. | Network DDE and Network DDE DSDM3 |
NetDetect | Network detection1 |
NetLogon | Network logon for workstation3 |
Ntfs | NTFS file system driver1 |
Nfts_Rec | Recognizer for NTFS file system1 |
Null | Base driver for null port1 |
Oliscsi | Olivetti SCSI adapter1 |
Parallel | Parallel port1 |
Pinball | HPFS file system driver1 |
Qvision | Qvision video display driver1 |
RAS | Remote Access Service3 |
Rdr | Network redirector1 |
Replicator | Directory replicator for workstation and server3 |
RPCLocator | Remote Procedure Call (RPC) locator (name service provider)3 |
RPCSS | Remote Procedure Call (RPC) service3 |
S3 | S3 video display1 |
Schedule | Network schedule service3 |
Scsixxx | SCSI class devices, which do not add parameters to the Registry, including Scsicdrm, Scsidisk, Scsiflip, Scsiprnt, and Scsiscan |
Serial | Serial port1 |
Sermouse | Serial mouse1 |
Sgikbmou | Silicon Graphics keyboard and mouse driver1 |
Sgirex | Silicon Graphics video display driver1 |
Simbad | Filter1 |
Sparrow | SCSI adapter1 |
Spock | SCSI adapter1 |
Srv | Network server3 |
T128, T13B | Trantor SCSI adapters1 |
Trident | Trident video display1 |
UBxxx | Ungermann-Bass NDIS drivers1, 3 |
Ultraxxx | UltraStore SCSI adapters1 |
UPS | Uninterruptible power supply (UPS) 3, 4 |
V7vram | Video Seven VRAM video display1 |
Vga | VGA video display1 |
Videoprt | Video display1 |
Wd33c93 | Maynard SCSI adapter1 |
Wdvga | Western Digital/Paradise video display1 |
Xga | IBM XGA video display1 |
1 Change settings for this driver using the Devices icon in Control Panel.
2 Change settings for this driver using the Network icon in Control Panel.
3 Change settings for this driver using the Services icon in Control Panel or using Server Manager in Windows NT Services.
4 Change settings for this driver using the UPS icon in Control Panel.
The Setup subkey under HKEY_LOCAL_MACHINE\SYSTEM is used internally by Windows NT for the Setup program. Do not change these value entries. These settings should be maintained only by the system.