The Structure of the Registry

There are five primary, or “root,” branches, each containing a specific portion of the information stored in the registry. These root keys can’t be deleted, renamed, or moved, because they are the basis for the organization of the registry. They are:


This branch contains the information that comprises your file type associations and the registered software components (called classes) used by Windows and many of your applications.

This entire branch is a symbolic link, or “mirror,” of HKEY_LOCAL_MACHINE\SOFTWARE\Classes, but is displayed separately here for convenience and, of course, to confuse you.


A symbolic link is different from a Windows shortcut you’d find on your hard disk. Information in a linked branch appears twice and can be accessed at two different locations, even though it’s stored only once. This means that the Find tool may stop in both places if they contain something you’re looking for and, as you might expect, changes in one place will be immediately reflected in the mirrored location.


This branch simply points to a portion of the HKEY_USERS root key (later in this section) representing the currently logged-in user. This way, any application can read and write settings for the current user without having to know which user is currently logged in.

In each user’s branch are the settings for that user, such as Control Panel settings and Explorer preferences. Most applications store user-specific information ...

Get Windows 7 Annoyances now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.