Registry Tips Page 1

«1» What is the meaning of the Windows NT/2000 Registry Data Types?

The Windows NT-2000 Registry Data Types are defined as follows:

REG_BINARY........Raw binary data.  Most hardware component information is stored as binary data.  It can be displayed in Regedt32 as hexadecimal or binary.

REG_DWORD.........A 4 byte (32 bit) number. It can be displayed in Regedt32 as binary, hexadecimal, or decimal.

REG_EXPAND_SZ.....A text string that contains an environment variable that is replaced when retrieved.
E.g.: 
%SystemRoot%\notepad.exe  might be replaced with  C:\WinNT\notepad.exe.

REG_MULTI_SZ......A list of multiple string entries, usually seperated by nulls.  The Multi_String Editor display each string on a separate line.

REG_SZ............A text string.

 

«2» Lock Desktop Shortcuts in place and Taskbar size/position

This Registry entry will prevent you from permanently repositioning desktop shortcuts and from adjusting the size and/or position of the Taskbar.

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Add or change the Value name:  ‘NoSaveSettings’, Data Type: REG_DWORD, to 1.

 

«3» Make Add/Remove Programs display 'optional' components

The following items are optional, even though they are installed by default:

    Games

    Accessories (Calculator, Clock, etc ...)

    Multimedia

    Accessibility options

Add/Remove Programs does NOT display these items.  To display them:

1.  Use Notepad to edit the file:  %SystemRoot%\inf\Sysoc.inf.

2.  Find the  ; old base components  line.

3.  Remove  ,HIDE  from the AccessUtil=  line.

4.  For each item you wish to appear, remove ,HIDE from its line.

5.  Save the changes and exit Notepad.

6.  Open Add/Remove Programs in Control Panel.

7.  Press the Add/Remove Windows Components button.

8.  Select the Accessories and Utilities item. You can uncheck it or press the Details button to uninstall selected items.

 

«4» Stop Regedit From Opening to Previous Location

By default, whenever you start Regedit, it starts in the previous location. To turn off this feature:

1.  Start Regedt32 (not Regedit) and go to:

2.  HKCU\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit

3.  Clear the entry in the ‘LastKey’.

4.  Highlight the Regedit key.

5.  From the menu select Security / Permissions.

6.  Deny Full Control to the currently logged in user.

 

«5» Tweak the Internal Comm Rate Between Modem and Computer

Access the following Registry key:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Ports

Change the Value name: ‘COM3 from:  9600,n,8,1  to:  921600,n,8,1

 

«6» Change System Font

The default Windows 2000 shell font (for Windows Explorer) is Tahoma, and the default system font (for System Properties, Device Manager, etc.) is MS Sans Serif.  If you're bored with the defaults, the only way to change them is to alter the Registry.  Open Regedit and go to:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

Edit the ‘MS Shell Dlg’ string value [REG_SZ] in the right hand pane, and modify its "Microsoft Sans Serif" default value to match any other font name installed on your system (e.g., Tahoma).  Then close Regedit and restart your computer for the change to take effect.

 

«7» Replace the Generic DLL icon in Explorer

When you browse a folder in Windows Explorer, all .DLL files are displayed with a generic icon.  To cause explorer to use an icon embedded in the .DLL files, if there is one, use Regedt32 to navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\dllfile\DefaultIcon

Change the value of the <Default> string, a type REG_EXPAND_SZ, from:

    "%SystemRoot%\System32\shell32.dll,-154"   to   "%1"

 

«8» Remove Items From the Windows 2000 Start Menu

Start Menu restrictions can be implemented by editing the following Explorer values in the Registry (all values default to 0).  Use Regedit to navigate to:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Add or modify the following Value name(s):

‘NoSMHelp’, Data Type: REG_DWORD, Value:  1 to remove the HELP Command.

‘NoSMMYDocs’, Data Type: REG_DWORD, Value:  1 to remove My Documents.

‘NoRecentDocsMenu’, Data Type: REG_DWORD, Value:  1 to remove the Documents Menu.

‘NoFavoritesMenu’, Data Type: REG_DWORD, Value:  1 to remove the Favorites Folder.

‘NoLogoff’, Data Type: REG_DWORD, Value:  1 to remove the Logoff button.

‘NoClose’, Data Type: REG_DWORD, Value:  1 to remove the Shutdown button.  This does not disable shutdown from CTRL+ALT+DEL.

‘NoSetFolders’, Data Type: REG_DWORD, Value:  1 to hide Control Panel and Printers and My Computer in Explorer and on the Start Menu.

‘NoRun’, Data Type: REG_DWORD, Value:  1 to remove the Run Command.

‘NoFind’, Data Type: REG_DWORD, Value:  1 to remove the Find Command.

Log off and log on for the setting(s) to take effect.

 

«9» Print Spooler File Location

Move the location the printer spooler uses off of the Windows 2000 System drive.  This will decrease the utilization of the System drive.  Note:  Be sure the drive you move the spooler to has sufficient disk space to handle all printing requests of all clients on the network.

1.  Click Start.

2.  Click Control Panel.

3.  Click Printers.

4.  Click File.

5.  Click Server Properties.

6.  Click the Advanced Tab.

7.  Type the name of the new directory in the spool folder dialog box.

8.  Click OK.

 

«10» Disable creation of of a DOS compatible 8.3 filename for every file

Increases the speed of write operations because an additional filename does not have to be generated.  Of course this only works for NTFS drives.  To do this edit this registry key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\FileSystem

Set the Value name:  ‘NtfsDisable8dot3NameCreation’ to 1.

Note that the original version of Windows 95 without SP1 will not be able to access these files.

«11» Disable the automatic updating of File Access Time

Increase the speed of each disk operation by avoiding the updating of access time on each file reference.  Of course this only works for NTFS drives.  To do this edit this registry key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\FileSystem

Set the Value name:  ‘NtfsDisableLastAccessUpdate’ to 1.

 

«12» Backup And Restore Internet Explorer Security Zone Settings

To backup the Zone information, use Regedit to Export:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones

To save specific security settings, Export:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap

To restore, double-click the .REG file(s).

 

«13» Turn off Indexing Service

Indexing Service creates indexes of the contents and properties of documents on local and network drives.  It's quite similar to "Find Fast" that ships with Microsoft Office.  Indexing Service runs continuously.  Turning this off may increase performance.  Go to:   My Computer|right click on a Drive icon|select Properties.  Remove the checkmark from "Allow Indexing Service to index this disk for fast file searching".  Click Apply.  Be sure to select "Apply changes to <driveletter>:\, subfolders and files" before clicking OK in the new window.

 

«14» Close port 135 by disabling DCOM in Dcomcnfg.exe

Click on  Start|Run|and enter:  C:\WinNT\System32\Dcomcnfg.exe  Then click on the Applications tab.  Many programs "support" Distributed Communication (DCOM) but hardly ever use it.  This includes such programs as Windows Media and Wordpad, which are designed to be used across a network.  As you scan this tab, look for third-party applications that might actually require network support, as opposed to those that simply support it.  To determine if these programs really require DCOM, you must disable it, run those programs, and see what happens.  Note that it is probably only necessary to look at third-party programs here;  Microsoft programs designed to run on a non-networked, stand-a-lone computer (Office, etc.) are usually written to support but not require DCOM.  To disable DCOM, go to the Default Properties tab and uncheck the box labeled "Enable Distributed COM on this computer".

Reboot, and try running the third-party programs noted as above.  Chances are good that everything will still run correctly.  If not, go back and enable DCOM again.  As you re-enable it, also go to the Default Protocols tab and remove all protocols except "Connection-oriented TCP/IP".  This won't make your system much safer, but it will reduce the number of connection methods you have to keep an eye on.

If you do not have to re-enable DCOM again, then on the Default Protocols tab remove all protocols.  You won't need them, and that should stop the OS from listening on Port 135 (unless you have other programs that are forcing it open).

 

«15» Close port 445 TCP/UDP by disabling NetBT in Device Manager

Steps in Windows 2000 Professional, SP2:

1.  Open Computer Management

2.  Click on Device Manager

3.  Select View:  Show Hidden Devices

4.  Click on Non-Plug and Play Drivers

5.  Open Properties for NetBIOS over TCPIP

6.  Click on Disable

7.  Reboot per prompt

You will get an event in Event ID entry if you do not also disable the TCP/IP NetBIOS Helper Service service.  You can Disable this service in Administrative Tools|Services if desired.

Ed. Note:  This tweak will prevent the DHCP Client service from running properly.  Most Cable ISPs require the use of DHCP.  If your ISP requires DHCP, you will NOT be able to use this tweak.  Please see below.

Alternate Procedure:  The following information was developed, tested, and supplied by  T-1  (aka “bones”).

start | run | regedit | HKLM | system | CurrentControlSet | Services |

NetBT | Parameters ==> name: TransportBindName  data: \device\

remove "\device\" ... reboot PC

The following comments and opinions have been expressed regarding this procedure:

1.  “Rather than deleting anything, simply "rename" the "TransportBindName" by highlighting it and hitting F2.  Then press "end" to cancel the selection and append an "X" to the end.  Then press return ... and reboot.  By renaming the key it's easy to return it to its previous name (just remove the superfluous 'X') if any negative side effects later surface.”

2.  “The Registry tweak that bones researched and then reported here is more flexible because the NetBT driver is allowed to run (and therefore allows the dependent services to run), but it never opens port 445 (either TCP or UDP).”

 

«16» Disable/Enable the System File Check (SFC) Feature

Access the following Registry Key:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\WinLogon

Set the Value name:SFCDisable’ to 0 (zero) to Enable, and to 'ffffff9d' to Disable.  When booting with this value in the ‘SFCDisable’ Value name, an event will be written to the system log, ID 64032 from Windows File Protection, with the description:  "Windows File Protection is not active on this system".

NOTE:  This procedure only works on Windows 2000 WITHOUT Service Pack 2 (SP2) installed.

To disable System File Checker AFTER installing SP2:

1.  Load the file SFC.DLL into your favorite hex editor.

2.  Go to offset 6211h and you should see '8B' and 'C6' at offsets 6211h and 6212h.  If the two bytes are not these values DO NOT proceed.

3.  Change both bytes to read '90'.

4.  Save your changes.

Now the 'ffffff9d' regkey tweak will work again.

 

«17» Disable Paging Of Core Files and Speed Up Performance

Improve System Performance in Windows NT/2000 on systems with large amounts of RAM.  This tweak can be used to force the Windows system core files to be kept in memory and not paged to disk.

Open the registry and find this key:

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management

For the Value name:  ‘DisablePagingExecutive’, Data Type: REG_DWORD, change the value to 1 to enable the tweak and stop the core process from being paged, or set it to 0 for the default.

 

«18» Replace Locked Files Using INUSE.EXE

Inuse.exe provides Windows NT/2000 the capability to replace files that are currently in use ( locked ) by the operating system.  To obtain INUSE, see: Q228930

A gotcha! involving the INUSE utility:  it will not work on system files unless the %TEMP%  or  %TMP% environment variables point to the same drive as %SystemRoot%.

 

«19» Control Conversion of Filenames and Folders to Lowercase

If you type in a folder or filename using all CAPS, Windows ‘helpfully’ pretty prints the name, changing the case to uppercase for the first letter and lowercase for the rest.  If you want to turn off the pretty printing, you can use the following Windows NT/2000 Registry hack.  Without it, for example, Windows converts ‘MYFOLDER’ to ‘Myfolder’.

Open the registry and find this key:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

Change or add the Value name:  ‘DontPrettyPath’, Data Type: REG_DWORD, Value: 1 to leave case as entered.

 

«20» Disable the keyboard Windows Key

To disable the keyboard Windows Key in Windows NT/2000, use Regedit to navigate to the following key:

HKEY_LOCAL_MACHINE/SYSTEM\CurrentControlSet\Control\Keyboard Layout

Change or add the Value name:  ‘Scancode Map’, Data Type: REG_BINARY,
Value:  00 00 00 00 00 00 00 00 03 00 00 00 00 00 5B E0 00 00 5C E0 00 00 00 00

 

«21» Determine the Charge Level on a Laptop’s Battery When Using AC Power

To see the charge level of your battery(s):

1.  Go to Control Panel|Power Options|Power Meter.
2.  Check the “Show details for each battery” box.
3.  Select the Advanced tab.
4.  Check the “Always show icon on the taskbar” box.
5.  Press Apply and OK.

When the computer is on a single battery, placing the curor over the taskbar battery icon will display the state of charge.  When the computer is on AC power, a power cord icon is displayed when the battery is fully charged.  A power cord with a lightning bolt indicates the battery is charging.  To see the charge level, double-click the power cord.

NOTE:  If your Windows 2000 laptop can install 2 batteries, Windows 2000 may NOT run the low or Critical battery alarm, as set in Control Panel|Power Options|Alarms.  The problem is caused by Windows 2000 improperly calculating the remaining time when 2 batteries are installed, and AC power is unplugged.

 

«22» Windows Cascading Menus

How fast or slow submenus appear when your mouse is over a menu, is dependent on the ‘MenuShowDelay’ value.  For faster fly-out menus, reduce the delay interval at the following Windows NT/2000 Registry key:

HKEY_CURRENT_USER\Control Panel\Desktop

Change or add the Value name:  ‘MenuShowDelay’, Data Type: REG_DWORD, Value:  400  ms is the default.

NOTE:  Setting ‘MenuShowDelay’ too low, can actually hurt performance if Windows is using too many cycles creating and destroying undesired menus.  This is a personal preference item.  Experiment to see what value works best for you.

 

«23» System File Checker Switches

You can use the System File Checker, SFC.exe, to scan all protected files to verify their version and to check and repopulate the Dllcache folder.  SFC supports the following switches:

/Scannow     - Scans all protected systems files immediately

/Scanonce    - Scans all protected system files once, at the next restart

/Scanboot    - Scans all protected system files every time you start your computer

/Cancel      - Cancels all pending scans of protected system files

/Quiet       - Replaces all incorrect file versions without prompting the user

/Enable      - Enables Windows File Protection for normal operation

/Purgecache  - Purges the file cache and scans all protected system files

/Cachesize=n - Sets the file cache size

 

«24» An Easier Way To Create a New Folder

When you select a folder object in Windows Explorer to create a new sub-directory, you must move the mouse to File/New/Folder or key-in ALT+FWF to create a new folder.  Wouldn't it be nice to just right click and choose ‘NewFolder’?  While there might be a real way to do this, here is a method that works:

1.  In Windows Explorer select:  Tools|Folder Options|File Types
2.  Scroll to Folder and select it
3.  Press Advanced and then New
4.  Type NewFolder in ‘Action:’
5.  In ‘Application used to perform action:’...., type:

c:\winnt\system32\cmd.exe /c MD """%1\NewFolder"""

6.  OK out of the dialogue

Now when you select a folder object and right-click, you can choose NewFolder.  A sub-directory named NewFolder is created which you can rename.

 

«25» What Is ‘Svchost.exe’ And Why Are More Than One Shown In Task Manager?

%SystemRoot%\System32\Svchost.exe is a generic process name for service groupings that run from DLLs.  When you start your Windows 2000 computer, it checks the registry at:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Svchost

for each Value Name.  How many Value Names you have, depend upon whether you are running W2K Pro or one of the Servers, and what is installed.  Multiple groups allow better control and debugging.  If you look at:

HKLM\System\CurrentControlSet\Services\<Service Key>\Parameters

you will see that only services with a populated ServiceDll value name have an entry in a Svchost Value Name.  This is a type REG_MULTI_SZ data type, so you should use Regedt32 to view it.  Click in the MULTI-STRING Editor to deselect the entries, or you may destroy them while looking.

For additional information see:  Q250320.

 

«26» Enable Verbose Event Messages

To turn on verbose boot, shutdown, logon, and logoff error messages in Windows 2000, start Regedit and navigate to:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system

Add or modify the Value Name:  ‘VerboseStatus’, Data Type: REG_DWORD, Value: 1 (default = 0)

You can avoid modifying the Registry by using a group policy setting:

=  Open a policy in Group Policy Editor

=  Expand Computer Configuration, Administrative Tools, System

=  Double-click Verbose vs normal status messages

=  Set option to Enabled or Disabled.

=  Click OK

=  Close GPE

 

«27» What Are the Supported Dual-Boot Configurations?

The supported dual-boot configurations are:

Personal Oper System   Professional Oper System   Professional Oper System

 Windows Me             and Windows 2000           or Windows NT 4.0

 Windows 98 SE          and Windows 2000           or Windows NT 4.0

 Windows 98             and Windows 2000           or Windows NT 4.0

 Windows 95 OEM         and Windows 2000           or Windows NT 4.0

 Windows 95             and Windows 2000           or Windows NT 4.0

Microsoft does NOT support dual-booting between multiple personal operating systems.

Microsoft does NOT support triple-booting Windows NT, Windows 2000, and a personal operating system.

Multiple operating systems on the same partition are NOT supported.

Microsoft recommends that you install the personal operating system first.

The C: partition must use a file system that each operating system can boot from.

 

«28» How Do I Use the ‘Show Desktop’ Feature?

The Show Desktop feature minimizes or restores all your open programs and makes it easy to view your desktop.  When you press the Show Desktop icon on the ‘Quick Launch’ toolbar, Windows 2000 toggles between minimizing all open programs or restoring all minimized programs.

NOTE:  If you are running in full-screen mode, first press the Windows key or CTRL+ESC.

NOTE:  You can Press the Windows Key + D to toggle Show Desktop.

NOTE:  Programs may be restored in reverse order.

NOTE:  If your Show Desktop icon is missing, see the following tip.

 

«29» Re-create the ‘Show Desktop’ Icon On the Quick Launch Toolbar

If you lost your Show Desktop icon, you can re-create it using Notepad.  Open Notepad and copy the following text:

[Shell]
Command=2
IconFile=explorer.exe,3
[Taskbar]
Command=ToggleDesktop

Save the file as:  Show Desktop.scf in the:

  %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch  folder.

The location of the Quick Launch shortcuts is discussed in the following tip.

 

«30» Where Are the Quick Launch Shortcuts Located?

You can manually manage the Quick Launch toolbar by adding or removing shortcut icons at:

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch

To find this location in your system, type:  set UserProfile  at a CMD prompt.  It will return: 

USERPROFILE=C:\Documents and Settings\<UserName>

 

«31» WinInet Limits Connections Per Server

WinInet will limit the number of simultaneous connections that it will make to a single HTTP server.  If you exceed this limit the requests will block until one of the current connections has completed.  This is by design and is in agreement with the HTTP specifications and industry standards.

WinInet will limit connections to a single HTTP 1.0 server to four simultaneous connections.  Connections to a single HTTP 1.1 server will be limited to two simultaneous connections.  The HTTP 1.1 specification (RFC 2068) mandates the two connection limit while the four connection limit for HTTP 1.0 is a self-imposed restriction which coincides with the standard used by a number of Web browsers.

You can elect to configure WinInet to exceed this limit by creating and setting the following Registry entries:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings

The sub-key:  ‘MaxConnectionsPerServer’, Data Type: REG_DWORD, Value: 2  (is the default)  sets the number of simultaneous requests to a single HTTP 1.1 Server.

The sub-key:  ‘MaxConnectionsPer1_0Server’, Data Type: REG_DWORD, Value: 4  (is the default)  sets the number of simultaneous requests to a single HTTP 1.0 Server.

NOTE:  By changing these settings you are causing WinInet to break the HTTP protocol specification for your application and any other WinInet applications running on your machine, including Internet Explorer.

NOTE:  See Q183110 for additional details.