Tip

Reduce confusion of registry editing due to Registry reflection

wiSystems administrators need to be aware that Microsoft has made many changes to the structure of the Windows registry and the x64 version of Windows. They also need to be careful. Editing the registry can be dangerous – by making incorrect modifications to the registy, you can destroy Windows and your applications.

As an admin, it is critical that you understand these architectural changes to the Windows registry before you attempt to work with the registry on a system running an x64 version of Windows. Note: Always make a full system backup prior to making any changes to the Windows registry.

In a previous article, I explained that x64 versions of Windows use

Requires Free Membership to View

x64 versions of Registry redirection to keep certain 32-bit specific registry entries separate from the 64-bit registry entries.

The Windows-on-Windows 64-bit subsystem, also known as WOW64, takes care of all the differences between 32-bit Windows and 64-bit Windows, particularly involving structural changes to Windows itself. But Registry redirection is not the only way in which WOW64 interacts with the registry. In order to support 32-bit applications, WOW64 also relies on a technology called Registry reflection.

A 32-bit COM server can make an out-of-process call to a 64-bit COM object. Normally, 32- and 64-bit code must be isolated from each other, but out-of-process calls are an exception because the 32- and 64-bit code are running in separate processes. Using RPC calls, 32- and 64-bit COM servers can receive calls from 32- and 64-bit COM clients.

If a COM object services requests from 32- and 64-bit COM clients, Registry access can be an issue. While 32-bit clients will need data from the 32-bit portion of the registry, 64-bit clients will need data from the 64-bit portion of the registry. This is where Registry reflection comes into play. Registry reflection makes it possible for a COM server to keep the 32- and the 64-bit registries open, so it can handle 32- and 64-bit program calls.

What this means is that Registry reflection makes it possible for certain information to appear in both the 32- and the 64-bit views of the registry, even though the information actually only exists in one location. Suppose you installed Microsoft Word on to a machine running the x64 version of Windows XP. Microsoft Word registers the .DOC file extension. Since both 32-bit and 64-bit applications need to be aware of this file extension, the registry reflector copies the file extension registration from the 64-bit registry to the 32-bit section of the registry.

In current x64 versions of Windows, the following registry keys are reflected. This means that there values are shared by both 32-bit and 64-bit programs. The reflected registry keys are:

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\SERVICES
HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\HCP
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\MSMQ
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NETWORKCARDS
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PERFLIB
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PRINT
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PORTS
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\CONTROL PANEL\CURSORS\SCHEMES
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\TELEPHONY\LOCATIONS
HKEY_LOCAL_MACHINE\SOFTWARE\POLICIES
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\OC MANAGER
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\SOFTWARE\MICROSOFT\SHARED TOOLS\MSINFO
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\CTF\TIP
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\CTF\SYSTEMSHARED
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\FONTS
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\FONTSUBSTITUTES
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\FONTDPI
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\FONTMAPPER
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\RAS
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\DRIVER SIGNING
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\NON-DRIVER SIGNING
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\CALAIS\CURRENT
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\CALAIS\READERS
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONE
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\TRANSACTION SERVER
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\DFS
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\TERMSERVLICENSING

Changes to the Registry Editor

Since 64-bit and 32-bit applications have completely separate views of the registry, Registry redirection and Registry reflection have the potential to make registry editing very confusing. To cut down on the confusion, Microsoft has included both a 64-bit and a 32-bit version of the Registry Editor and x64 versions of Windows.

To access the 64-bit version of the registry editor, enter the REGEDIT command at the Run prompt. This version of the Registry Editor allows you to see all of the 64-bit registry entries. It also allows you to access the HKEY_LOCAL_MACHINE\Software\WOW6432node sub key.

On the other hand, the 32-bit version of the Registry Editor allows you to view the registry as it appears to 32-bit applications. You can access the 32-bit version of the Registry Editor by entering the following command at the Run prompt:

C:\Windows\syswow64\REGEDIT.EXE

About the author: Brien M. Posey, MCSE, is a Microsoft Most Valuable Professional for his work with Windows 2000 Server, Exchange Server and IIS. He has served as CIO for a nationwide chain of hospitals and was once in charge of IT security for Fort Knox. He writes regularly for SearchWinComputing.com and other TechTarget sites.

More information on this topic:

This was first published in April 2007

There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.