Frequently Asked Questions of Registry Workshop

• What is the relationship between registry hives and files on Windows 2000/XP?
• How can I edit registry on non-bootable Windows 2000/XP system?
• I can not delete a registry key, is there any way to work around this problem?
• Can I use abbreviation of root keys in the address bar?
• I see HKLM and HKU in the snapshot. What about HKCR, HKCU and HKCC?

What is the relationship between registry hives and files on Windows 2000/XP?

Windows 2000/XP maintains a list of which hives exist on a particular machine in HKLM\SYSTEM\CurrentControlSet\Control\hivelist. The following table lists standard registry hives and corresponding files.

Regisrty Hive	File
HKLM\SAM	%SystemRoot%\System32\Config\SAM
HKLM\SECURITY	%SystemRoot%\System32\Config\Security
HKLM\SOFTWARE	%SystemRoot%\System32\Config\Software
HKLM\SYSTEM	%SystemRoot%\System32\Config\System
HKU\.DEFAULT	%SystemRoot%\System32\Config\DEFAULT
HKU\SID	Documents and Settings\userName\NTUSER.DAT
HKU\SID_Classes	Documents and Settings\userName\Local Settings \Application Data\Microsoft\Windows\UsrClass.dat

 

How can I edit registry on non-bootable Windows 2000/XP system?

You can move the hard disk with the corrupted Windows to another computer, use the Load Hive function to load the registry hive and edit it.

I can not delete a registry key, is there any way to work around this problem?

If you are sure it's not a permission problem, you can try the following steps.

• Select any registry key and export the key to a registry hive file. For performance reason, please do not select a key contains a lot of subkeys and values.
• Select the parent key of the key you want to delete. If there are other keys and values in the parent key, move these keys and values to other place or export to a REG file.
• Import the registry hive file on top of the parent key. This operation will overwrite everything in the parent key.
• Delete the imported keys and values and restore the old content.

Can I use abbreviation of root keys in the address bar?

Yes, you can use following abbreviations.

Root Key	Abbreviation
HKEY_CLASSES_ROOT	HKCR
HKEY_CURRENT_USER	HKCU
HKEY_LOCAL_MACHINE	HKLM
HKEY_USERS	HKU
HKEY_CURRENT_CONFIG	HKCC

I see HKLM and HKU in the snapshot. What about HKCR, HKCU and HKCC?

HKLM and HKU contain all registry data. HKCR, HKCU and HKCC are just links.

Root Key	Equivalent
HKCR	HKCU\Software\Classes + HKLM\SOFTWARE\Classes
HKCU	HKU\SID
HKCC	HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\Current