Windows and most applications save their configuration in the registry database — or registry, for short. Whenever you change a setting, this affects the corresponding value in the registry, but there are also values in the registry for which there is no equivalent in a configuration tool.
Many tech-savvy Windows users probably have some settings that they change immediately when they install Windows. Other adjustments are made more or less regularly — for example, to provide variety in the desktop design or because certain tasks require it.
A search in the “Settings” helps to find the available options. However, it is still tedious to configure everything as desired. In addition, you sometimes have to dig through subcategories, and sometimes even use the Control Panel under Windows 11 or navigate through several tabs.
All this makes it quite difficult to apply the familiar settings after a new installation of Windows or on other computers. However, some settings can be saved if you are logged in with a Microsoft account.
This article describes the basics of working with the Windows registry and precautionary measures that enable recovery in the event of defects. We also introduce readers to other tools that make it easier to work with the registry or customize a special set of settings, for example for more privacy.
See also: How to clean your Windows registry and speed up your PC
First orientation in the Windows registry
The standard program for editing the registry is the Windows Registry Editor. You start it by pressing the Win-R key combination,
regedit and confirm with “OK.” The tool displays the contents of the registry files in a tree view.
The registry actually consists of several files, which are located in the folder “C:\Windows\System32\config,” plus the file “Ntuser.dat” with the user’s data, which is located in the user profile under “C:\Users\[username].”
A look at the registry: The registry consists of five main keys. “Hkey_Current_User” contains the user’s configuration, “Hkey_Local_Machine” the global settings.
Foundry
The five branches of the registry:
- “Hkey_Current_User” contains the configuration of the logged on user.
- “Hkey_Local_Machine” contains the global settings for Windows and applications, which can only be changed with administrative rights and apply to all users. Changes in this branch usually only take effect after a Windows restart.
- “Hkey_Users” contains keys with user IDs of system profiles. The two longer IDs are those of the current user and correspond to the content of “Hkey_Current_User.”
- “Hkey_Classes_Root” contains file name extensions and the associated program shortcuts as well as keys for registered Windows components.
- “Hkey_Current_Config” is a link to the keys below “Hkey_Local_Machine\System\CurrentControlSet\Hardware Profiles\Current\.” This allows programs to access the values via a shorter path.
Add keys and values: Use the “New” context menu item to select what you want to create. The correct data type is important for many settings.
Foundry
Keys and values: Registry branches contain subkeys, similar to folders in the file system. They contain values that are comparable to files. There are value types, for example “string” for text content or the “DWORD value (32-bit)”, which can hold four bytes.
Change the content of the registry: Select a key in the tree on the left-hand side. Use the “New” context menu to create subkeys or values. On the right-hand side of the window, you can see the data that a key contains. Double-click on an entry to open an editor that can be used to change the data.
Create a backup copy of the registry
For a complete copy of the registry, use the Registry Backup Portable tool. First go to “Settings” and specify a storage location under “Backup Location.”
If the program does not work correctly with the default settings, go to “Help & Support” and click on the icon under “Online Help & FAQ’s.” In the help you will find instructions on how to repair the VSS service. Then go to the “Backup Registry” tab and click on “Backup Now.”
Registry Backup Portable: Use this tool to create a complete backup copy of all registry files. If problems occur, you can restore the files.
IDG
Restore the registry: In the event of a problem, restart Registry Backup, go to the “Restore Registry” tab, and select the last backup using the selection field at the top of the window. Click on “Restore Now.” You must then restart Windows.
Using Process Monitor to analyze the registry
You can find out which registry value belongs to which setting in the tips on numerous websites. You can use the Process Monitor from Microsoft Sysinternals to determine which registry keys are written when a setting is changed.
When you start Process Monitor, the “Process Monitor Filter” window appears. Select “Operation” and then “is.” Enter “RegSetValue” in the input field or select the value from the list. Click on “Add.” Accordingly, you can set the filter “begins with” and “HKCU” (Hkey_Current_User) for “Path.”
Process Monitor records selected accesses in the registry. This allows you to check which values change during an action.
IDG
Without a sensibly set filter, the window immediately fills up with thousands of entries and it is almost impossible to determine the relevant value. Click on “OK” to start recording.
Change an option in the “Settings,” for example. End the recording as quickly as possible using the Ctrl-E key combination. You will see a chronological list of accesses with “RegSetValue” in the window.
The tedious task now is to fish out the corresponding registry key and value from the still numerous lines using a plausibility check.
Example: Customize the Explorer
A freshly installed Windows is configured in a way that Microsoft considers useful for most users. Some settings are unnecessary for experienced users and may even be a security risk for less experienced users.
One example of this is the missing display of file-name extensions in Windows Explorer. File names in Windows usually consist of the file name, a dot, and the file name extension. Windows uses the extension to recognize the file type and the application with which a file is opened by double-clicking.
Views in Windows Explorer: Show file name extensions for security reasons.
Foundry
However, Windows Explorer shows a description in the “Type” column in the “Details” view. For executable files (“.exe”) “Application” appears here, for text files (“.txt”) you can read “Text document.”
The file icons also provide an indication of the file type. However, files cannot be identified very quickly if you do not look closely or have set a view other than “Details.”
For greater clarity, go to “View” in Windows Explorer and select the menu item “File name extension” under “Show.” In Windows 10, go to “View” and tick the box next to “File name extensions.”
This also has the additional effect of making it easier to assign file name extensions.
For example, if you create and save a text file, it is given the extension “.txt.” If you want to turn the text file into a batch file with the extension “.bat” or “.cmd,” you can now simply change the extension in Windows Explorer by renaming the file.
If the file name extensions are hidden in Windows Explorer, this is not possible. If you append a “.bat,” the name is “Filename.bat.txt,” which means that the editor remains responsible for the file and it does not become a Windows batch file.
The hidden file name extensions also represent a potential security risk. Windows Explorer displays “filename.txt.bat” as “filename.txt” by default. In the “Type” column, it says “Windows batch file,” but you may not notice this.
If you don’t notice the difference in the icons for text and batch files, you may start a dangerous batch file instead of opening a text file in Notepad.
The Windows Registry Editor is certainly sufficient for most tasks. However, it does not offer many convenient functions — a gap that other providers fill.
Regcool is an advanced registry editor with a quick search function. You can use it to create bookmarks and add comments, compare registry keys, and create a registry backup.
The Regshot function creates a snapshot of the registry, which can later be compared with a second snapshot. This allows you to see what has changed in the meantime.
Alternative registry editor: Regcool offers a quick search and numerous convenient functions when working with the registry, such as bookmarks and registry comparison.
IDG
Registry Finder shines with a very fast search and remembers the search results in several tabs. Bookmarks can be provided with a description and additional entries such as “Category” and “Tags.”
Reg Ownership Ex can change access rights in the registry. Click on “Search,” enter the desired key, and click on “Take ownership.” Click on “Restore” to restore the previous rights.
Data that cannot be changed in the registry
Microsoft is increasingly trying to prevent users and also the manufacturers of tuning tools from changing values in the registry. This may be partly for security reasons, even if this is not always recognizable.
One example of this is “News and interesting topics” in the taskbar, which Microsoft calls “widgets” in Windows 11. The display can be hidden or shown via “Settings” and “Personalization > Taskbar.”
If you try to change the associated value in the registry, access is denied. This is caused by the User Choice Protection Driver (UCPD).
It prohibits write access to registry values that have been set by user decisions for certain settings, such as the choice of default browser or PDF reader. This seems sensible so that malware does not simply change links to these programs maliciously, for example to redirect to advertising sites.
As of October 2024, however, there are methods to override the protection itself. The batch file “Switch_Taskbar_Widget_visibility.bat” together with the Powershell script “Set_Taskbar_Widget-visibility.ps1” shows how to do this.
The trick is essentially to use a copy of “Reg.exe” — the registry editor for the command line, which UCPD does not monitor. With Windows 10 it is a little more complicated because a hash value must also be changed here. Use “Switch_Taskbar_Widget_visibility.bat” to hide the widgets and show them again when restarting.
Settings for security and privacy
Windows constantly transmits diagnostic data (telemetry) to Microsoft. This is used, for example, for the early detection of errors in Windows updates.
However, a lot of data is also collected that can affect the user’s privacy. As a number of registry keys are used for configuration, it is better to leave the settings to specialized tools.
One of these is O&O Shutup10, which provides a description of each setting. If possible, only use the recommended settings, otherwise you will have to reckon with the side effects described.
An alternative is W10Privacy, which displays many settings on several tabs and offers more options than O&O Shutup. The recommended settings are highlighted in green, the conditionally recommended settings in yellow.
Prevent spying: O&O Shutup10 can reduce or prevent the transfer of data to Microsoft and thus protect your privacy.
O&O ShutUp10++
This article originally appeared on our sister publication PC-WELT and was translated and localized from German.
