Systems administrators need to be aware that Microsoft has made many changes to the structure of the Windows registry and the x64 version of Windows. They also need to be careful. Editing the registry can be dangerous – by making incorrect modifications to the registy, you can destroy Windows and your applications.
As an admin, it is critical that you understand these architectural changes to the Windows registry before you attempt to work with the registry on a system running an x64 version of Windows. Note: Always make a full system backup prior to making any changes to the Windows registry.
In a previous article, I explained that x64 versions of Windows use x64 versions of Registry redirection to keep certain 32-bit specific registry entries separate from the 64-bit registry entries.
The Windows-on-Windows 64-bit subsystem, also known as WOW64, takes care of all the differences between 32-bit Windows and 64-bit Windows, particularly involving structural changes to Windows itself.
But Registry redirection is not the only way in which WOW64 interacts with the registry. In order to support 32-bit applications, WOW64 also relies on a technology called Registry reflection.
A 32-bit COM server can make an out-of-process call to a 64-bit COM object. Normally, 32- and 64-bit code must be isolated from each other, but out-of-process calls are an exception because the 32- and 64-bit code are running in separate processes. Using RPC calls, 32- and 64-bit COM servers can receive calls from 32- and 64-bit COM clients.
If a COM object services requests from 32- and 64-bit COM clients, Registry access can be an issue. While 32-bit clients will need data from the 32-bit portion of the registry, 64-bit clients will need data from the 64-bit portion of the registry. This is where Registry reflection comes into play. Registry reflection makes it possible for a COM server to keep the 32- and the 64-bit registries open, so it can handle 32- and 64-bit program calls.
What this means is that Registry reflection makes it possible for certain information to appear in both the 32- and the 64-bit views of the registry, even though the information actually only exists in one location. Suppose you installed Microsoft Word on to a machine running the x64 version of Windows XP. Microsoft Word registers the .DOC file extension. Since both 32-bit and 64-bit applications need to be aware of this file extension, the registry reflector copies the file extension registration from the 64-bit registry to the 32-bit section of the registry.
In current x64 versions of Windows, the following registry keys are reflected. This means that there values are shared by both 32-bit and 64-bit programs. The reflected registry keys are:
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\SERVICES
HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\HCP
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\MSMQ
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NETWORKCARDS
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PERFLIB
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PRINT
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PORTS
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\CONTROL PANEL\CURSORS\SCHEMES
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\TELEPHONY\LOCATIONS
HKEY_LOCAL_MACHINE\SOFTWARE\POLICIES
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\OC MANAGER
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\SOFTWARE\MICROSOFT\SHARED TOOLS\MSINFO
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\CTF\TIP
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\CTF\SYSTEMSHARED
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\FONTS
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\FONTSUBSTITUTES
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\FONTDPI
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\FONTMAPPER
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\RAS
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\DRIVER SIGNING
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\NON-DRIVER SIGNING
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\CALAIS\CURRENT
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\CALAIS\READERS
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONE
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\TRANSACTION SERVER
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\DFS
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\TERMSERVLICENSING
Changes to the Registry Editor
Since 64-bit and 32-bit applications have completely separate views of the registry, Registry redirection and Registry reflection have the potential to make registry editing very confusing. To cut down on the confusion, Microsoft has included both a 64-bit and a 32-bit version of the Registry Editor and x64 versions of Windows.
To access the 64-bit version of the registry editor, enter the REGEDIT command at the Run prompt. This version of the Registry Editor allows you to see all of the 64-bit registry entries. It also allows you to access the HKEY_LOCAL_MACHINE\Software\WOW6432node sub key.
On the other hand, the 32-bit version of the Registry Editor allows you to view the registry as it appears to 32-bit applications. You can access the 32-bit version of the Registry Editor by entering the following command at the Run prompt:
C:\Windows\syswow64\REGEDIT.EXE
About the author: Brien M. Posey, MCSE, is a Microsoft Most Valuable Professional for his work with Windows 2000 Server, Exchange Server and IIS. He has served as CIO for a nationwide chain of hospitals and was once in charge of IT security for Fort Knox. He writes regularly for SearchWinComputing.com and other TechTarget sites.
More information on this topic:
Tip: Running 32-bit apps in x64 Windows: Registry redirection
Topics: Windows servers
RSS: Sign up for our RSS feed to receive expert advice every day.
