Entry Data Types

Every entry has adata type,which is the specific kind of data that entry can store. Ten data types are available, but some aren’t used by Windows Server 2003. The following sections describe the data types you’ll run into.

104

Complete Reference/ Windows Ser ver 2003: TCR / Ivens / 219484-7 / Chapter 4

Registry Hive Disk File

HKEY_LOCAL_MACHINE\SAM %SystemRoot%\System32\Config\Sam HKEY_LOCAL_MACHINE\Security %SystemRoot%\System32\Config\Security HKEY_LOCAL_MACHINE\Software %SystemRoot%\System32\Config\Software HKEY_LOCAL_MACHINE\System %SystemRoot%\System32\Config\System HKEY_CURRENT_CONFIG %SystemRoot%\System32\Config\System HKEY_CURRENT_USER %SystemDrive%\Documents and

Settings\<username>\Ntuser.dat HKEY_USERS\.Default %SystemDrive%\Documents and

Settings\Default User\Ntuser.dat

Table 4-1. Location and Contents of Hive Files on a Windows Ser ver 2003 Computer

Color profile: Generic CMYK printer profile Composite Default screen

REG_DWORD The REG_DWORD data type is a double word—two 16-bit words, making the value 32 bits. This is the most common data type in the registry, and it’s used for a variety of entries. You’ll find entries with device driver information, Boolean values, quantities such as the number of seconds that can elapse before something happens or doesn’t happen, and other assorted information.

In Regedit, REG_DWORD entries are displayed in hex (hexadecimal format), but you can switch to decimal or binary format (depending on the entry) if you need to perform an edit. I can’t convert hex to anything in my head, so when I want to change a figure such as a timeout interval, I have to change the format in order to accomplish my task. If you have the ability to covert hex in your head, you’ll work faster.

REG_BINARY Entries that use a REG_BINARY data type are entries in which the data is raw binary data. “Raw” means there are no terminators, nothing except the raw data that’s placed there. This data type is used mostly for hardware component information. The data can be displayed and edited in either binary or hexadecimal format in Regedit.

REG_SZ Entries of type REG_SZ are fixed-length text strings. Most of the entries that use this type are either Boolean or have short text string values. This is a very common data type, probably arising almost as frequently as the REG_DWORD type.

The notationSZmeans String/Zero byte termination, because the entries are terminated with a zero byte at the end (a zero is added to the end of the string). Regedit hides the terminating zero, so you don’t have to think about it (unless you’re writing a software application that manipulates the registry, in which case you must remember to pay attention to the terminating byte).

When you view or edit an entry of this type in Regedit, the window that opens is titled “String Editor.”

REG_MULTI_SZ This entry type is used by data entries that comprise multiple text strings. The strings are separated by commas or spaces, and the entry is terminated by two null characters (unseen in the registry editor). In Regedit, the edit window displays binary data (although you can see the text on the right side of the window).

When applications do a lookup on any REG_MULTI_SZ entry, they’re sent the entire entry; they cannot ask for a specific string (which is important to know if you’re a programmer).

REG_EXPAND_SZ This entry type is used when an entry includes one or more variables that have to be resolved by an operating system service or an application. The variables are the same variables you use in batch files and scripts (for example, %SystemRoot% or %UserName%). I’ve never figured out why the registry itself doesn’t resolve the variable and pass it to the requesting service or program—after all, it knows where to find the information.

Complete Reference/ Windows Ser ver 2003: TCR / Ivens / 219484-7 / Chapter 4 Complete Reference/ Windows .NET Ser ver 2003: TCR / Ivens / 219484-7 / Chapter 4 Complete Reference/ Windows .NET Ser ver 2003: TCR / Ivens / 219484-7 / Chapter 4

REG_FULL_RESOURCE_DESCRIPTOR This entry type is used to store a resource list for hardware components. The contents are a nested array, consolidating the resources for a component (or a driver). Regedit displays this information in binary format.

REG_LINK This entry type contains a symbolic link between data and a registry value. For example, an application that needs to know the unique ID of a user (perhaps for settings information) can look up the security ID of the current user (HKEY_ CURRENT_USER).

REG_DWORD_LITTLE_ENDIAN This is an entry type that’s a sibling of the REG_ DWORD entry type. It is most commonly used for storing numbers. The data value is a 32-bit number in which the most important byte is displayed as a high-order (leftmost) byte. This entry type only exists in Windows Server 2003, Windows 2000, and Windows 98. Technically, it exists in Windows NT, but the registry in Windows NT automatically converts data written as REG_DWORD_LITTLE_ENDIAN to standard REG_DWORD.

REG_DWORD_BIG_ENDIAN This entry type is the opposite of REG_DWORD_ LITTLE_ENDIAN. The most significant byte is displayed as the low-order (rightmost) byte, and it’s used by machine platforms that place bytes in that order (PowerPC and Alpha). Because Windows Server 2003 doesn’t support those platforms, any leftover registry items of this type are ignored.