All startup-related data that must be stored (rather than computed during startup) is saved in the System hive. A complete copy of the data is also stored in the System.alt file. The data in HKEY_LOCAL_MACHINE\System—which is the System hive—is organized into control sets that contain a complete set of parameters for devices and services as described in this section. You might occasionally need to change entries in the CurrentControlSet subkey, as described in Chapter 25, "Configuration Management and the Registry."
Figure 23.17 shows the structure of this subtree.
Figure 23.17 The HKEY_LOCAL_MACHINE\System key
The following sections describe the HKEY_LOCAL_MACHINE\System subkeys.
The Registry, particularly data in the System hive, is essential to starting the system. To help ensure that the system can always be started, a kind of backup version is kept, which allows you to undo any configuration changes that did not have the intended effect. This section describes how it works.
Figure 23.18 shows the structure of subkeys under the HKEY_LOCAL_MACHINE\System key.
Figure 23.18 Subkeys under HKEY_LOCAL_MACHINE\System
All of the data required to control startup is gathered into subkeys called control sets in the Registry. Each control set has four subkeys:
Multiple control sets are saved as subkeys of HKEY_LOCAL_MACHINE\System under names such as ControlSet001 and ControlSet003. Although as many as four control sets (numbered 000–003) can appear, there are usually two sets. This is similar to having multiple sets of Config.sys files under MS-DOS—a current file and a backup copy known to start the system correctly. However, all of the work of creating and maintaining backups is done automatically by the system.
The Select subkey consists of four value entries that describe how the control sets are used:
The Clone subkey contains the last control set used to start the system. If the start was successful ("good"), the contents of the Clone become the LastKnownGood control set.
The CurrentControlSet subkey is not the root of an actual control set; rather, it is a symbolic link to the control set indicated by the value of Current. It is there so that constant paths can be used to refer to subkeys in the currently used control set, even though the name of that control set may change.
These multiple control sets are used to allow an escape from various problems. Each time the system starts, the control set used to start is saved (under HKEY_LOCAL_MACHINE\System\Clone). If the startup is declared to be "good," the LastKnownGood control set is discarded, and the Clone subkey is copied to replace it. An administrator can change the requirements for a startup to be classified as "good," but a startup is typically declared to be "good" if no severe or critical errors occurred while starting the services and if at least one user logged on successfully.
The LastKnownGood configuration is used when the user chooses LastKnownGood from the Hardware Profile/Configuration Recovery menu during startup or if startup fails (is not "good"). When this happens, a new control set is created by copying the LastKnownGood control set and the values of the entries in HKEY_LOCAL_MACHINE\System\Select are changed to point to different control sets:
User profile data is stored elsewhere and is therefore unaffected.
Tip
When you start Windows NT, you can choose which control set the system uses. At the Boot Loader command prompt, select Windows NT, then press the SPACEBAR. The Hardware Profile/Configuration Recovery menu appears. Follow the instructions on the screen to select the control set or LastKnownGood configuration from the menu.
To find out whether Default or LastKnownGood was used, see the values in the Select subkey.
To modify the information stored in these subkeys, use the Devices, Network, Server, and Services options in Control Panel, or use Server Manager.
To modify the configuration by using Registry Editor, make changes under the CurrentControlSet subkey.
The Control and Services subkeys found in each control set are described in the following sections.
The Control subkey contains startup parameters for the system, including information about the subsystems to load, computer-dependent environment variables, the size and location of the paging files, and so on. Figure 23.19 shows the typical Control subkeys, and Table 23.6 describes the contents of some typical subkeys.
Figure 23.19 A typical configuration of the Control subkey for a control set
Table 23.6 Typical Subkeys of \CurrentControlSet\Control for All Control Sets
Subkey | Contents |
BootVerificationProgram | A value that can be set to define a nonstandard mechanism to declare system startup as "good," as described in Chapter 25, "Configuration Management and the Registry." |
ComputerName | The names of the default and active computers, stored in two subkeys, ComputerName and ActiveComputerName. To set the computer name, use the Network option in Control Panel. |
GroupOrderList | Specifies the order in which to load services for all groups that have one, used in combination with Tags. ServiceGroupOrder specifies the order for loading groups. |
ServiceGroupOrder | Specifies the order in which to load various groups of services. Order within groups is specified by using Tags and GroupOrderList. |
HiveList | The location of the files that contain Registry information. This value should be maintained only by the system. |
Keyboard Layout | The DLLs for the keyboard language used as the default layout, plus a subkey named DosKeybCodes that lists the other available keyboard layouts. To set keyboard layout, use the Input Locales tab under the Keyboard option in Control Panel. |
Lsa | The authentication package for the local security authority. This value should be maintained only by the system—errors can prevent anyone from being able to log on to the computer. |
NetworkProvider | Can contain two subkeys, Active and Order, that specify the network provider and the order in which to load providers. Control settings for network providers by using the Network option in Control Panel. |
Nls | Information on national language support in three subkeys: CodePage, Language, and OEMLocale. Set preferences about language and locale in Windows NT by using the Regional Settings option in Control Panel. |
Information about the current printers and printing environment, contained in several subkeys: Environments, which contains subkeys defining drivers and print processors for system environments such as Windows NT on Digital Alpha, Windows NT on MIPS Rx4000, and Windows NT on Intel-based computers. Monitors, which can contain subkeys with data for specific network printing monitors. Printers, which can contain subkeys describing printer parameters for each installed printer. Providers, which can contain subkeys describing DLLs for network print services. To change printing parameters, click the Start button, point to Settings, then point to the Printers folder. | |
PriorityControl | The Win32 priority separation. Set this value only by using the System option in Control Panel. |
ProductOptions | The product type, such as Windows NT. These values should be maintained only by the system. |
Session Manager | Global variables used by Session Manager and these subkeys: DOSDevices, which defines the MS-DOS devices AUX, MAILSLOT, NUL, PIPE, PRN, and UNC. Environment, which defines the ComSpec, Path, Os2LibPath, and WinDir variables. To set user environment variables, in Control Panel double-click System. To change or add to the computer's default path, or add default system environment variables, change the values in this subkey. For more details, see Regentry.hlp, a Registry Help file on the Windows NT Workstation Resource Kit CD. FileRenameOperations, which is used during startup to rename certain files so that they can be replaced. These values should be maintained only by the system. KnownDLLs, which defines the directories and filenames for the Session Manager DLLs. These values should be maintained only by the system. MemoryManagement, which defines paging options. Define the paging file by using the System option in Control Panel. SubSystems, which defines information for the Windows NT subsystems. These values should be maintained only by the system. |
Setup | Hardware setup options. These values should be maintained only by the system. Users can make choices by running Windows NT Setup. |
TimeZoneInformation | Values for time zone information. Set these values by using the Date/Time option in Control Panel. |
VirtualDeviceDrivers | Virtual device drivers. These values should be maintained only by the system. |
Windows | Paths for the Windows NT directory and system directory. These values should be maintained only by the system. |
WOW | Options for 16-bit Windows-based applications running under Windows NT. These settings should be maintained only by the system. |
The Enum subkey contains configuration data for hardware devices, independent of the drivers they use.
This subkey, new with Windows NT 4.0, was one of several keys added to HKEY_LOCAL_MACHINE to enable Windows NT to access and control drivers and devices in ways similar to those used in Windows 95. (The methods are similar—but not the same, because the architecture of Windows NT differs from that of Windows 95.)
The changes reflected in these new keys prepare Windows NT to run the new generation of Plug and Play drivers and devices implemented in Windows 95. Plug and Play drivers are not included in Windows NT 4.0, but when the drivers become available, these changes will enable them to be implemented with fewer changes to the operating system.
Warning: Do not use a Registry editor to change the data in this key. Errors in this key can prevent Windows NT from detecting or operating hardware devices necessary to the operation of the computer. Windows NT protects this key from changes by all users, including administrators. Administrators can change the permissions on the key, but this is strongly discouraged. In your applications, use the standard Device Installer or Config Manager API to change data in the Enum subkeys.
By using the Device Installer or Config Manager API, you can enable applications to modify the data in Enum subkeys without including the path name of the Registry key in the application code. The Windows NT Registry has a different structure than the Registry in Windows 95. Because of this, if your application refers to this Registry key by path name, the application will not run on both Windows NT and Windows 95.
In general, the Enum subkey contains configuration data for devices. The subkeys under Enum represent a device hierarchy (or tree) that starts at a tree root (the top) and ends at the lowest branch with configuration data for a specific instance of a device, such as the keyboard on the local computer.
The Enum subkey itself is merely a container. It is not associated with any value entries. There are at least two subkeys immediately under Enum: Htree represents the hardware tree; the remaining keys represent enumerators, the means by which Windows NT learned about a device.
The Htree\Root\0 subkey is a reserved space in the Registry that represents the root (the top) of the hardware tree.. It contains the AttachedComponents value entry, which lists devices rooted at the top of the hardware tree.
Figure 23.20 shows the Htree\Root\0 subkey and its AttachedComponents value listing.
Figure 23.20 AttachedComponents value listing under Htree\Root\0
The remaining subkeys immediately under Enum represent enumerators and contain the subkeys of devices that have the same enumerator. For Plug and Play devices, the enumerator is the device bus on which the device runs, such as PCI or ISAPNP. A default enumerator, Root, is used for non–Plug and Play devices (known as legacy devices), which are enumerated by other parts of the system.
Figure 23.21 shows the Root enumerator of a typical computer running Windows NT.
Figure 23.21 Typical contents of a Root enumerator subkey
Each enumerator subkey, such as Root, contains subkeys that represent device types or models. The device type subkeys, in turn, contain the subkeys that represent devices of that type. The device type subkeys for each enumerator vary depending on the devices installed on the computer.
The name of each device type subkey indicates whether it is a Plug and Play device or a legacy (non–Plug and Play) device.
The subkeys under the device type are the device instance subkeys. These subkeys contain value entries that specify the configuration of a device. However, the device(s) to which the value entries apply depend on whether the device is a Plug and Play device or a legacy device.
The value entries and subkeys under the device instance subkeys vary with the device and its driver. For more information, see Regentry.hlp, the Registry Help file on the Windows NT Workstation Resource Kit CD.
The Services subkey in each control set lists all device drivers, file system drivers, and Win32 service drivers that can be loaded by the Boot Loader, the I/O Manager, and the Service Control Manager. The Services subkey also contains subkeys that are static descriptions of hardware to which drivers can be attached. Table 23.7 describes some typical Services subkeys for a computer running Windows NT.
Entries that appear under the DeviceMap subkeys include values that refer to entries in the Services subkey in the control set. For example, for a serial mouse, the following entry might appear under the DeviceMap\PointerPort subkey in HKEY_LOCAL_MACHINE\Hardware:
\Device\PointerPort0 : \REGISTRY\Machine\System\ControlSet001\Services\Sermouse
A related Services subkey named Sermouse defines values for the serial mouse driver. Figure 23.22 shows a typical configuration of the Sermouse subkey.
Figure 23.22 The Sermouse subkey
To view this information in a more readable format, use Windows NT Diagnostics or the Control Panel.
For suggestions on using the information in Windows NT Diagnostics and the Control Panel for troubleshooting, see Chapter 25, "Configuration Management and the Registry."
Each subkey includes several standard (but optional) entries, as shown in Figure 23.23, where Alerter is the name of a Windows NT service.
Figure 23.23 Subkey for the Alerter service under Services
The value entries that govern the behavior of a service include ErrorControl, Group, DependOnGroup, DependOnService, ImagePath, ObjectName, Start, Tag, and Type. For definitions of these value entries, see Regentry.hlp, the Registry Help file on the Windows NT Workstation Resource Kit CD.
The optional Linkage subkey specifies the binding options for the driver by using the Bind and Export values.
The OtherDependencies value that appears in the Linkage subkey for some services enables nodes to be loaded in an order related to other specific nodes with which they are closely associated. For example, the NBF transport depends on an NDIS driver. Therefore, to load the NBF protocol stack successfully, an NDIS network card driver must be loaded first. For details about loading order dependencies for network components, see "Dependency Handling for Network Components," later in this chapter.
The Parameters subkey (optional for some Services subkeys such as an adapter entry) contains a set of values to be passed to the driver. These values vary for each device driver. Figure 23.24 shows parameters for the serial mouse driver.
Figure 23.24 Parameters subkey for the serial mouse driver
Because the entries in the Services list are Registry keys, no assumptions can be made about their order in an enumeration, so services can explicitly specify load ordering by grouping services and drivers in order by type. For example, the SCSI port driver can be loaded before any of the miniport drivers. The ordering is specified under the \Control\ServiceGroupOrder subkey in a control set.
Settings for the drivers that appear under the Services subkeys can be changed by using the Devices, Network, or Services options in Control Panel or, for network services, User Manager for Domains in Windows NT. Specific parameters for drivers and services are described in online Help for the Registry.
Table 23.7 describes typical Services subkeys for a Windows NT–based computer.
Table 23.7 Descriptions of Typical Services Subkeys for a Windows NT–Based Computer
Service name | Description |
Abiosdsk | Primary disk1 |
Ahaxxx | Adaptec SCSI adapters1 |
Alerter | Alerter service for the workstation3 |
AtDisk | Primary disk driver for non-SCSI hard disks1 |
Ati | ATI video display1 |
Beep | Base sound driver1 |
Browser | Computer browser used by Workstation and Server services3 |
BusLogic | BusLogic SCSI adapter1 |
Busmouse | Bus mouse pointer1 |
Cdaudio | Filter1 |
Cdfs | SCSI CD-ROM file system driver1 |
Cirrus | Cirrus Logic video display1 |
ClipSrv | ClipBook (Network DDE service)3 |
Cpqarray | Compaq array driver (no additional Registry values) |
Dell_DGX | Dell DGX video display1 |
Diskperf | Disk Performance Monitoring Statistics Driver1 |
DptScsi | DPT SCSI adapter1 |
Et4000 | Tseng ET4000 video display1 |
EventLog | Event log service3 |
Fastfat | FAT file system driver1 |
Fd16_700 | Future Domain MCS 600/700, TMC-7000ex, 800-series SCSI adapters1 |
Floppy | Primary disk1 |
Ftdisk | Filter1 |
i8042pt | Keyboard driver1 |
Inport | Microsoft InPort Mouse pointer1 |
Jazzgxxx | Video display1 |
Jzvxl484 | Video display1 |
Kbdclss | Keyboard class driver1 |
LanmanServer | Server service3 |
Lanman Workstation | Workstation service3 |
Messenger | Messenger service for workstation3 |
Mouclass | Mouse class driver1 |
Mup | Network1 |
Nbf | NetBEUI transport protocol1, 2 |
Ncrxxx | NCR SCSI controllers and adapters1 |
NetBIOS | NetBIOS transport interface1, 2 |
NetDDE et al. | Network DDE and Network DDE DSDM3 |
NetDetect | Network detection1 |
NetLogon | Network logon for workstation3 |
Ntfs | NTFS file system driver1 |
Null | Base driver for null port1 |
Oliscsi | Olivetti SCSI adapter1 |
Parallel | Parallel port1 |
Qv | Qvision video display driver1 |
RAS | Remote Access Service3 |
Rdr | Network redirector1 |
Replicator | Directory replicator for workstation and server3 |
RPCLocator | Remote Procedure Call (RPC) locator (name service provider)3 |
RPCSS | Remote Procedure Call (RPC) service3 |
S3 | S3 video display1 |
Schedule | Network schedule service3 |
Scsixxxx | SCSI class devices, which do not add parameters to the Registry, including Scsicdrm, Scsidisk, Scsiflip, Scsiprnt, and Scsiscan |
Serial | Serial port1 |
Sermouse | Serial mouse1 |
Sgikbmou | Silicon Graphics keyboard and mouse driver1 |
Sgirex | Silicon Graphics video display driver1 |
Simbad | Filter1 |
Sparrow | SCSI adapter1 |
Spock | SCSI adapter1 |
Srv | Network server3 |
T128, T13B | Trantor SCSI adapters1 |
Trident | Trident video display1 |
UBxxx | Ungermann-Bass NDIS drivers1, 3 |
Ultraxxx | UltraStore SCSI adapters1 |
UPS | Uninterruptible power supply (UPS)3, 4 |
V7vram | Video Seven VRAM video display1 |
Vga | VGA video display1 |
Videoprt | Video display1 |
Wd33c93 | Maynard SCSI adapter1 |
Wdvga | Western Digital/Paradise video display1 |
Xga | IBM XGA video display1 |
1 Change settings for this driver by using the Devices option in Control Panel.
2 Change settings for this driver by using the Network option in Control Panel.
3 Change settings for this driver by using the Services option in Control Panel or by using Server Manager in Windows NT Services.
4 Change settings for this driver by using the UPS option in Control Panel.
The Hardware Profiles subkey in each control set contains the configuration data for all hardware profiles in a Windows NT–based system. This subkey is new to Windows NT 4.0.
A hardware profile is a set of changes to the standard configuration of devices and services (including drivers and Win32 services) loaded by Windows NT when the system starts. For example, a hardware profile can include an instruction to disable (that is, not load) a driver, or an instruction to Windows NT to not connect an undocked laptop computer to the network. Because of the instructions in this subkey, users can modify the service configuration for a particular use while preserving the standard configuration unchanged for more general uses.
Windows NT creates a default hardware profile (called Original Configuration). But users can create multiple hardware profiles and, when Windows NT starts, select from them the settings they want .
To create hardware profiles, use the System, Services, and Devices options in Control Panel. For more information on creating hardware profiles, double-click System in Control Panel, click the Hardward Profiles tab and open Help.
Figure 23.25 shows the Hardware Profiles subkey under CurrentControlSet.
Figure 23.25 The Hardware Profiles subkey for CurrentControlSet
Each numbered subkey under Hardware Profiles contains the configuration data for one hardware profile on the system. If there is more than one hardware profile, the system identifies a subkey as current when the user chooses it during startup. The Current subkey is a symbolic link to one of the numbered subkeys.
The HKEY_CURRENT_CONFIG subtree is an alias pointing to the Hardware Profiles\Current subkey of CurrentControlSet; the contents of the Current subkey appear in the HKEY_CURRENT_CONFIG subtree.
Tip
To determine which numbered subkey under Hardware Profiles represents the current hardware profile, see HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\IDConfigDB subkey. The value of CurrentConfig in the IDConfigDB subkey corresponds to the number of the subkey that contains the current hardware profile.
The data in each hardware profile subkey consists of profile-specific modifications to the standard service configuration. Only data that has been changed from the standard configuration is stored there, but organized in the same structure as the standard configuration. The standard configuration is defined by data stored throughout the Software and System subkeys of HKEY_LOCAL_MACHINE. Hence, the structure of a hardware profile is modeled on the structure of HKEY_LOCAL_MACHINE and can be thought of as a limited or condensed version of HKEY_LOCAL_MACHINE .
Figure 23.26 demonstrates the similar structures of HKEY_LOCAL_MACHINE and the subkeys under Hardware Profiles\0001.
Figure 23.26 HKEY_LOCAL_MACHINE and Hardware Profiles\0001 subkeys
When a hardware profile specifies a change to a value entry in the Software or System subkeys of HKEY_LOCAL_MACHINE, the original value in the Software or System subkey is not changed; instead that change is stored in the analogous subkey of Hardware Profiles\Number.
For example, if a user creates a hardware profile in which the Diskperf driver (which collects performance statistics for disks) is not loaded, the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_DISPERF subkey is not changed. Instead, the change is stored in HKEY_LOCAL_MACHINE \System\CurrentControlSet\Hardware Profiles\Number\System\CurrentControlSet\Enum\Root\LEGACY_DISPERF.
The subkeys of a hardware profile store the same kind of information as their counterparts in the Software and System subkeys of HKEY_LOCAL_MACHINE, but the hardware profile subkeys store changes only. This means that the driver, service, and device settings loaded when a hardware profile is chosen consist of those specified in the Software and System subkeys of HKEY_LOCAL_MACHINE, as modified by the data in the Software and System subkeys of the hardware profile.
For information about the subkeys of a hardware profile, see the descriptions of their analogs in the Software and System subkeys of HKEY_LOCAL_MACHINE. For information about the value entries in these subkeys, see Regentry.hlp, the Registry Help file on the Windows NT Workstation Resource Kit CD.
The Setup subkey under HKEY_LOCAL_MACHINE\System is used internally by Windows NT for the Setup program. Do not change these value entries. These settings should be maintained only by the system.