All registry Tricks

To Backup/Restore the Windows Registry: Windows 9x For XP 2000 click here
1. If you are in MSDOS, at the C:\Windows prompt type
2. Attrib -s -r -h C:\Windows\System.dat (press Enter)
3. Attrib -s -r -h C:\Windows\User.dat (press Enter)
To make the backup copies type:
1. copy C:\Windows\System.dat C:\Windows\System.000 (press Enter)
2. copy C:\Windows\User.dat C:\Windows\user.000 (press Enter)
To Restore the Registry
1. copy C:\Windows\System.000 C:\Windows\System.dat (press Enter)
2. copy C:\Windows\User.000 C:\Windows\user.dat (press Enter)
Add Open With to all files
You can add "Open With..." to the Right click context menu of all files.This is great for when you have several programs you want to open the same file types with. I use three different text editors so I added it to the ".txt" key.
1. Open RegEdit
2. Go to HKEY_CLASSES_ROOT\*\Shell
3. Add a new Key named "OpenWith" by right clicking the "Shell" Key and selecting new
4. Set the (Default) to "Op&en With..."
5. Add a new Key named "Command" by right clicking the "OpenWith" Key and selecting new
6. Set the (Default) to "C:\Windows\rundll32.exe shell32.dll,OpenAs_RunDLL %1", C:\ being your Windows drive. You must enter the "OpenAs_RunDLL %1" exactly this way.
Customize the System Tray
You can add your name or anything you like that consists of 8 characters or less. This will replace the AM or PM next to the system time. But you can corrupt some trial licenses of software that you may have downloaded.
1. Open RegEdit
2. Go to HKEY_CURRENT_USER\Control Panel\International
3. Add two new String values, "s1159" and "s2359"
4. Right click the new value name and modify. Enter anything you like up to 8 characters.
If you enter two different values when modifying, you can have the system tray display the two different values in the AM and PM.
Lock Out Unwanted Users
Want to keep people from accessing Windows, even as the default user? If you do not have a domain do not attempt this.
1. Open RegEdit
2. Go to HKEY_LOCAL_MACHINE\Network\Logon
3. Create a dword value "MustBeValidated"
4. Set the value to 1
This forced logon can be bypassed in Safe Mode on Windows 9x
Disable the Outlook Express Splash Screen
You can make OutLook Express load quicker by disabling the splash screen:
1. Open RegEdit
2. Go to HKEY_CURRENT_USER\Software\Microsoft\OutLook Express
3. Add a string value "NoSplash"
4. Set the value data to 1 as a Dword value
Multiple Columns For the Start Menu
To make Windows use multiple Start Menu Columns instead of a single scrolling column, like Windows 9x had, Also if you are using Classic Mode in XP
1. Open RegEdit
2. Go to the key
HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\ Explorer\ Advanced
3. Create a string value "StartMenuScrollPrograms"
4. Right click the new string value and select modify
5. Set the value to "FALSE"
Changing Windows' Icons
You can change the Icons Windows uses for folders, the Start Menu, opened and closed folder in the Explorer, and many more.
1. Open RegEdit
2. Go to
HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\ Explorer\ Shell Icons
3. Add a string value for each Icon you wish to change.
Example: "3" ="C:\Windows\Icons\MyIcon.ico,0" This will change the closed folders in the Explorer to "MyIcon.ico". Here is a complete list for each value.
0= Unknown file type
1= MSN file types
2= Applications Generic
3= Closed Folder
4= Open Folder
5= 5.25" Drive
6= 3.25" Drive
7= Removable Drive
8= Hard Drive
9= NetWork Drive
10= Network Drive Offline
11= CD-ROM Drive
12= RAM Drive
13= Entire Network 14= Network Hub
15= My Computer
16= Printer
17= Network Neighborhood
18= Network Workgroup
19= Start Menu's Program Folders
20= Start Menu's Documents
21= Start Menu's Setting
22= Start Menu's Find
23= Start Menu's Help
24= Start Menu's Run
25= Start Menu's Suspend
26= Start Menu's PC Undock
27= Start Menu's Shutdown 28= Shared
29= Shortcut Arrow
30= (Unknown Overlay)
31= Recycle Bin Empty
32= Recycle Bin Full
33= Dial-up Network
34= DeskTop
35= Control Panel
36= Start Menu's Programs
37= Printer Folder
38= Fonts Folder
39= Taskbar Icon
40= Audio CD
You need to reboot after making changes. You may need to delete the hidden file ShellIconCache if after rebooting the desired Icons are not displayed.
Change Default Folder Locations
You can change or delete the Windows mandatory locations of folder like My Documents:
1. Open RegEdit
2. Go to HKEY_CURRENT_USER\ Software\ Microsoft\ Windows\ CurrentVersion\ Explorer\ Shell Folders
3. Change the desired folder location, My Documents is normally list as "Personal"
4. Open the Explorer and rename or create the folder you wish.
To change the desired location of the Program Files folder
1. Go to
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
2. Change the value of "ProgramFiles", or "ProgramFilesDir"
Now when you install a new program it will default to the new location you have selected.
Change the Registered Change the User Information
You can change the Registered Owner or Registered Organization to anything you want even after Windows is installed.
1) Open RegEdit
2) Got to
HKEY_LOCAL_MACHINE\ SOFTWARE\ Microsoft\ Windows\ CurrentVersion.
3) Change the value of "RegisteredOrganization" or "RegisteredOwner", to what ever you want
Opening a DOS Window to either the Drive or Directory in Explorer
Add the following Registry Keys for a Directory:
HKEY_CLASSES_ROOT\Directory\shell\opennew
@="Dos Prompt in that Directory"
HKEY_CLASSES_ROOT\Directory\shell\opennew\command
@="command.com /k cd %1"
Add or Edit the following Registry Keys for a Drive:
HKEY_CLASSES_ROOT\Drive\shell\opennew
@="Dos Prompt in that Drive"
HKEY_CLASSES_ROOT\Drive\shell\opennew\command
@="command.com /k cd %1"
These will allow you to right click on either the drive or the directory and the option of starting the dos prompt will pop up.
Changing Exchange/Outlook Mailbox Location
To change the location of your mailbox for Exchange:
1. Open RegEdit
2. Go to
HKEY_CURRENT_USER\Software\ Microsoft\Windows Messaging Subsystem\ Profiles
3. Go to the profile you want to change
4. Go to the value name that has the file location for your mailbox (*.PST) file
5. Make the change to file location or name
To change the location of your mailbox for Outlook
1. Open RegEdit
2. Go to HKEY_CURRENT_USER\Software\Microsoft\Outlook (or Outlook Express if Outlook Express)
3. Go to the section "Store Root"
4. Make the change to file location
Add/Remove Sound Events from Control Panel
You can Add and delete sounds events in the Control Panel. In order to do that:
1. Open RegEdit
2. Go to HKEY_CURRENT_USER\AppEvents\Schemes\Apps and HKEY_CURRENT_USER\AppEvents\Schemes\Eventlabels. If this key does not exist you can create it and add events.
3. You can add/delete any items you want to or delete the ones you no longer want.
Adding an Application to the Right Click on Every Folder
Here is how to add any application to the Context Menu when you right click on any Folder. This way you do not have to always go to the Start Menu. When you right click on any folder, you can have access to that application, the same as using Sent To.
1. Open RegEdit
2. Go to HKEY_CLASSES_ROOT\Folder\shell
3. Add a new Key to the "Shell" Key and name it anything you like.
4. Give it a default value that will appear when you right click a folder, i.e. NewKey (use an "&" without the quotes, in front of any character and it will allow you to use the keyboard)
5. Click on the Key HKEY_CLASSES_ROOT\Folder\shell\NewKey
6. Add a New Key named Command
7. Set the (Default) value of the application you want to run
8. For example: c:\program files\internet explorer\iexplore.exe (Include the full path and parameters if you need them)
Adding Explore From Here to Every Folder
When you want to right click on any folder and want to open up an Explorer window of that folder.
1. Open RegEdit
2. Go to HKEY_CLASSES_ROOT\Folder\shell
3. Add a new Key "RootExplore " under the "Shell" Key
4. Set the (Default) value to "E&xplore From Here "
5. Right Click the "RootExplore " Key and add a new Key "Command"to the RootExplore
6. Set the (Default) value of Explorer.exe /e,/root,/idlist,%i
Changing the Location of Windows' Installation Files
If you need to change the drive and or path where Windows looks for its installation files:
1.Open RegEdit
2.Go to
HKEY_LOCAL_MACHINE\SOFTWARE\ Microsoft\ Windows\ CurrentVersion\ Setup
3.Edit the value next to SourcePath
Creating a Logon Banner
If you want to create a Logon Banner: A message box to appear below your logon on.
1.Open RegEdit
2.Go To
For Windows 9x and ME -
HKEY_LOCAL_MACHINE\SOFTWARE\ Microsoft\ Windows\ CurrentVersion\ Winlogon
For Windows 2000 XP 2003 Vista -
HKEY_LOCAL_MACHINE\SOFTWARE\ Microsoft\ Windows\ CurrentVersion\ Winlogon

3.Create a new String value"LegalNoticeCaption "
4. Enter the Title of the window. What is displayed in the Title Bar.
5. Create a new string value "LegalNoticeText"
6. Enter the text for your message box that will appear even before the Logon window.
Creating a Default File Opener
If you have a un-registered file type and want to view it instead of having to select Open With. Use Explorer's Right-click and add your program to the right-click options by:
1. Open RegEdit
2. Go to HKEY_CLASSES_ROOT\Unknown\Shell
3. Right click on "Shell" and create a New Key and name it "Open "
4. Create a New Key under the "Open" key you just created and name it "Command"
5. Set the (Default) value to the path and filename of the program you want to use to open the file type
6. For example: C:\Windows\NOTEPAD.EXE %1
You must use the "%1" for this to work.and a space between the exe and the %1
Deleting Registry Keys from the Command Line
There are two ways to delete a key from the Registry from the Command line. At the Windows Command line:
RegEdit /l location of System.dat /R location of User.dat /D Registry key to delete
You cannot be in Windows at the time you use this switch.
Or you can create a reg file as such:
REGEDIT4
[-HKEY_LOCAL_MACHINE\the key you want to delete]
Note the negative sign just behind the[
Then at the Command line type:
1. RegEdit C:\Windows\(name of the regfile).
Change/Add Restrictions And Features
If you want to make restrictions to what users can do or use on their computer without having to run Poledit, you can edit the Registry. You can add and delete Windows features in this Key shown below.
Zero is Off and the value 1 is On. Example: to Save Windows settings add or modify the value name NoSaveSettings to 0, if set to1 Windows will not save settings. And NoDeletePrinter set to 1 will prevent the user from deleting a printer.
The same key shows up at:
HKEY_USERS\(yourprofilename)\ Software\ Microsoft\ Windows\ CurrentVersion\ Policies\ Explorer so change it there also if you are using different profiles.
1.Open RegEdit
2.Go to
HKEY_CURRENT_USER\Software\Microsoft\ CurrentVersion\ Policies
3.Go to the Explorer Key (Additional keys that can be created under Policies are System, Explorer, Network and WinOldApp )
4.You can then add DWORD or binary values set to 1 in the appropriate keys for ON and 0 for off.
NoDeletePrinter - Disables Deletion of Printers
NoAddPrinter - Disables Addition of Printers
NoRun - Disables Run Command
NoSetFolders - Removes Folders from Settings on Start Menu
NoSetTaskbar - Removes Taskbar from Settings on Start Menu
NoFind - Removes the Find Command
NoDrives - Hides Drives in My Computers
NoNetHood - Hides the Network Neighborhood
NoDesktop - Hides all icons on the Desktop
NoClose - Disables Shutdown
NoSaveSettings - Don't save settings on exit
DisableRegistryTools - Disable Registry Editing Tools
NoRecentDocsMenu - Hides the Documents shortcut at the Start button
NoRecentDocsHistory- Clears history of Documents
NoFileMenu _ Hides the Files Menu in Explorer
NoActiveDesktop - No Active Desktop
NoActiveDesktopChanges- No changes allowed
NoInternetIcon - No Internet Explorer Icon on the Desktop
NoFavoritesMenu - Hides the Favorites menu
NoChangeStartMenu _ Disables changes to the Start Menu
NoFolderOptions _ Hides the Folder Options in the Explorer
ClearRecentDocsOnExit - Empty the recent Docs folder on reboot
NoLogoff - Hides the Log Off .... in the Start Menu
And here are a few more you can play with
ShowInfoTip
NoTrayContextMenu
NoStartMenuSubFolders
NoWindowsUpdate
NoViewContextMenu
EnforceShellExtensionSecurity
LinkResolveIgnoreLinkInfo
NoDriveTypeAutoRun
NoStartBanner
NoSetActiveDesktop
EditLevel
NoNetConnectDisconnect
RestrictRun - Disables all exe programs except those listed in the RestrictRun subkey
This key has many other available keys, there is one to even hide the taskbar, one to hide the control panel and more. I'm not telling you how, as someone may want to play a trick on you. The policies key has a great deal of control over how and what program can run and how one can access what feature.
In the System key you can enter:
NoDispCPL - Disable Display Control Panel
NoDispBackgroundPage - Hide Background Page
NoDispScrSavPage - Hide Screen Saver Page
NoDispAppearancePage - Hide Appearance Page
NoDispSettingsPage - Hide Settings Page
NoSecCPL - Disable Password Control Panel
NoPwdPage - Hide Password Change Page
NoAdminPage - Hide Remote Administration Page
NoProfilePage - Hide User Profiles Page
NoDevMgrPage - Hide Device Manager Page
NoConfigPage - Hide Hardware Profiles Page
NoFileSysPage - Hide File System Button
NoVirtMemPage - Hide Virtual Memory Button
In the Network key you can enter:
NoNetSetup - Disable the Network Control Panel
NoNetSetupIDPage - Hide Identification Page
NoNetSetupSecurityPage - Hide Access Control Page
NoFileSharingControl - Disable File Sharing Controls
NoPrintSharing - Disable Print Sharing Controls
In the WinOldApp key you can enter:
Disabled - Disable MS-DOS Prompt
NoRealMode - Disables Single-Mode MS-DOS
Automatic Screen Refresh
When you make changes to your file system and use Explorer, the changes are not usually displayed until you press the F5 key
To refresh automatically:
1. Open RegEdit
2. Go to
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Update
3. Set the value name "UpdateMode" to 1
Disable Password Caching
To disable password caching, which allows for the single Network login and eliminates the secondary Windows logon screen. Either use the same password or:
1. Open RegEdit
2. Go to the key
HKEY_LOCAL_MACHINE\SOFTWARE \Microsoft\ Windows\ CurrentVersion\ Policies\ Network
3. Add a Dword value "DisablePwdCaching" and set the value to 1
Changing the MaxMTU for faster Downloads
There are four Internet settings that can be configured, you can get greater throughput (faster Internet downloads) by modifying a few settings.
They are the MaxMTU, MaxMSS and DefaultRcvWindow, and DefaultTTL
1.Open RegEdit
2.Go to
HKEY_LOCAL_MACHINE\System\CurrentControlset\ Services\ Class\ net\ 000x
(where x is your particular network adapter binding.)
3.Right click on the right panel
4.Select New\String Value and create the value name IPMTU
5.Double click on it and enter then the number you want. The usual change is to 576
6.Similarly, you can add IPMSS and give it a value of 536
(Windows 9X)You can set DefaultRcvWindow, and DefaultTTL by adding these string values to HKEY_LOCAL_MACHINE\ System\ CurrentControlset\ Services\ VXD\ MSTCP
Set the DefaultRcvWindow to"5840"and the DefaultTTL to "128"
Note: These settings will slow down your network access speed slightly, but you will probably not even see the difference if you are using a network card. If you are using Direct Cable you should see a sight difference.
Adding Items to the Start Button
To add items when you right-click on the Start Button:
1.Open RegEdit
2.Go to HKEY_CLASSES_ROOT\Directory\Shell
3.Right-click on Shell and select New Key
4.Type in the name of the key and press the Enter key
5.In the Default name that shows in the right hand panel, you can add a title with a "&" character in front of the letter for a shortcut
6.Right-click on the key you just created and create another key under it called command
7.For the value of this command, enter the full path and program you want to execute
8.Now when you right click on the Start Button, your new program will be there.
9.For example, if you want Word to be added, you would add that as the first key, the default in the right panel would be &Word so when you right click on the Start Button, the W would be the Hot Key on your keyboard. The value of the key would be C:\Program Files\Office\Winword\Winword.exe
Remove Open, Explore & Find from Start Button
When you right click on the Start Button, you can select Open, Explore or Find.
Open shows your Programs folder. Explore starts the Explorer and allows access to all drives.
Find allows you to search and then run programs. In certain situations you might want to disable this feature.
To remove them:
1.Open RegEdit
2.Go to HKEY_CLASSES_ROOT\Directory\Shell\Find
3.Delete Find
4.Scroll down below Directory to Folder
5.Expand this section under shell
6.Delete Explore and Open
Caution: - When you remove Open, you cannot open any folders.
Removing Items from NEW Context Menu
When you right-click on the desktop and select New, or use the File Menu item in the Explore and select New a list of default templates you can open up are listed.
To remove items from that list:
1. Open RegEdit
2. Do a Search for the string ShellNew in the HKEY_CLASSES_ROOT Hive
3. Delete the ShellNew command key for the items you want to remove.
Changing Telnet Window
You can view more data if you increase the line count of Telnet. By Default it has a window size of 25 lines. To increase this so you can scroll back and look at a larger number on lines:
1. Open RegEdit
2. Go to HKEY_CURRENT_USER\Software\Microsoft\Telnet
3. Modify the value data of "Rows"
Changing the Tips of the Day
You can edit the Tips of the day in the Registry by going to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\ CurrentVersion\ explorer\ Tips
Disabling Drives in My Computer
To turn off the display of local or networked drives when you click on My Computer:
1.Open RegEdit
2.Go to
HKEY_CURRENT_USER\Software\ Microsoft\ Windows\ CurrentVersion\ Policies\ Explorer
3.Add a New DWORD item and name it NoDrives
4.Give it a value of 3FFFFFF
5.Now when you click on My Computer, none of your drives will show.
Changing the caption on the Title Bar
Change the Caption on the Title Bar for OutLook Express or the Internet Explorer:
For Outlook Express:
1. Open RegEdit
2. Go to
HKEY_CURRENT_USER\Software\Microsoft\OutLook Express
For IE5 and up use:
HKEY_CURRENT_USER\IDENTITIES \{9DDDACCO-38F2-11D6-93CA-812B1F3493B}\ SOFTWARE\ MICROSOFT\ OUTLOOK EXPRESS\5.0
3. Add a string value "WindowTitle" (no space)
4. Modify the value to what ever you like.
For no splash screen, add a dword value "NoSplash" set to 1
The Key {9DDDACCO-38F2-11D6-93CA-812B1F3493B} can be any key you find here. Each user has his own Key number.
The Key 5.0 is whatever version of IE you have
For Internet Explorer:
1. Open RegEdit
2. Go to HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main
3. Add a string value "Window Title" (use a space)
4. Modify the value to what ever you like.
Disabling the Right-Click on the Start Button
Normally, when you right button click on the Start button, it allows you to open your programs folder, the Explorer and run Find.
In situations where you don't want to allow users to be able to do this in order to secure your computer.
1.Open RegEdit
2.Search for Desktop
3.This should bring you to HKEY_CLASSES_ROOT\Directory
4.Expand this section
5.Under Shell is Find
6.Delete Find
7.Move down a little in the Registry to Folder
8.Expand this section and remove Explore and Open
Now when you right click on the Start button, nothing should happen.
You can delete only those items that you need.
Note: - On Microsoft keyboards, this also disables the Window-E (for Explorer) and Window-F
(for Find) keys.
See the section on Installation in the RESKIT to see how to do this automatically during an install.
Disabling My Computer
In areas where you are trying to restrict what users can do on the computer, it might be beneficial to disable the ability to click on My Computer and have access to the drives, control panel etc.
To disable this:
1.Open RegEdit
2.Search for 20D04FE0-3AEA-1069-A2D8-08002B30309D
3.This should bring you to the HKEY_CLASSES_ROOT\CLSID section
4.Delete the entire section.
Now when you click on My Computer, nothing will happen.
You might want to export this section to a Registry file before deleting it just in case you want to enable it again. Or you can rename it to 20D0HideMyComputer4FE0-3AEA-1069-A2D8-08002B30309D. You can also hide all the Desktop Icons, see Change/Add restrictions.
Opening Explorer from My Computer
By default, when you click on the My Computer icon, you get a display of all your drives, the Control Panel etc. If you would like to have this open the Explorer:
1. Open RegEdit
2. Go to
HKEY_CLASSES_ROOT\CLSID\ {20D04FE0-3AEA-1069-A2D8-08002B30309D}\ Shell
3 . Add a new Key named "Open" if it does not exists by right clicking "Shell" and selecting new.
4. . Add a new Key named "Command" by right clicking "Open" and selecting new
5. Set the (Default) value for the Command Key to "Explorer.exe" or "C:\Windows\Explorer.exe"
Recycle Bin Edits
Fooling with the recycle bin. Why not make the icon context menu act like other icon context menus.
Add rename to the menu:
HKEY_CLASSES_ROOT\CLSID\ {645FF040-5081-101B-9F08-00AA002F954E}\ ShellFolder
"Attributes"=hex:50,01,00,20
Add delete to the menu:
HKEY_CLASSES_ROOT\CLSID\ {645FF040-5081-101B-9F08-00AA002F954E}\ ShellFolder
"Attributes"=hex:60,01,00,20
Add rename and delete to the menu:
HKEY_CLASSES_ROOT\CLSID\ {645FF040-5081-101B-9F08-00AA002F954E} \ShellFolder
"Attributes"=hex:70,01,00,20
Restore the recycle bin to Windows defaults including un-deleting the icon after deletion:
Restore the icon.
HKEY_LOCAL_MACHINE\SOFTWARE\ Microsoft\ Windows \CurrentVersion\ explorer\
Desktop\NameSpace\{645FF040-5081-101B-9F08-00AA002F954E}
@="Recycle Bin"
Reset Windows defaults.
HKEY_CLASSES_ROOT\CLSID\ {645FF040-5081-101B-9F08-00AA002F954E} \ShellFolder
"Attributes"=hex:40,01,00,20
Other edits to the recycle bin icon:
HKEY_CLASSES_ROOT\CLSID\ {645FF040-5081-101B-9F08-00AA002F954E}\ ShellFolder
"Attributes"=hex:40,01,01,20 ... standard shortcut arrow
"Attributes"=hex:40,01,02,20 ... a different shortcut arrow
"Attributes"=hex:40,01,04,20 ... and still another shortcut arrow
"Attributes"=hex:40,01,08,20 ... make it look disabled (like it's been cut)
For Windows XP and 2000 also edit HKEY_CURRENT_USER\ Software\ Microsoft\ Windows\ CurrentVersion\ Explorer\ CLSID\ {645FF040-5081-101B-9F08-00AA002F954E}
For Windows ME also edit HKEY_CURRENT_USER \Software\ Classes\ CLSID\ {645FF040-5081-101B-9F08-00AA002F954E}
Setting the Minimum Password Length
1.Open RegEdit
2.Go to
HKEY_LOCAL_MACHINE\ SOFTWARE\ Microsoft\ Windows\ CurrentVersion\ Policies\ Network
3. Now, choose the Edit/New/Binary value command and call the new value MinPwdLen. Press Enter twice and Assign it a value equal to your minimum password length.
Add\delete programs to run every time Windows starts
You can start or stop programs from executing at boot up by adding or deleting them to/from the run Keys in the Registry. Windows loads programs to start in the following order; Program listed in the Local Machine hive, then the Current User hive, then theWin.ini Run= and Load = lines. then finally programs in your Start Up folder.
To add or remove programs in the Registry
1.Open RegEdit
2.Go to the desired Key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows \CurrentVersion \Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows \CurrentVersion \RunServices
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows \CurrentVersion \Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows \CurrentVersion \RunServices
3. Add a new String Value and name it anything you like
4. For the value data, enter the path and executable for the program you want to run.
By adding the value to the HKEY_CURRENT_USER hive instead allows the program to start only when that user is logged on.
If you add the value to the RunOnce key the program will run once and be removed from the key by Windows.
Removing the Shortcut Icon Arrows
1.Open RegEdit
2.Open the Key HKEY_CLASSES_ROOT
3.Open the Key LNKFILE
4.Delete the value IsShortcut
5.Open the next Key PIFFILE
6.Delete the value IsShortcut
7.Restart the Windows
Turn Off Window Animation
You can shut off the animation displayed when you minimize and maximize Windows.
1. Open RegEdit
2. Go to HKEY_CURRENT_USER\Control panel \Desktop\ WindowMetrics
3. Create a new string value "MinAnimate".
4. Set the value data of 0 for Off or 1 for On
Changing your Modem's Initialization String
1.Open RegEdit
2.Go to
HKEY_LOCAL_MACHINE\System\CurrentControlSet \Services \Class \Modem \0000 \Init
3.Change the settings to the new values
Increasing the Modem Timeout
If your modem it is timing out during file transfers or loading Web Pages, you might try increasing the timeout period. To change the Time Out::
1.Open RegEdit
2.Go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\ Services\ Class\ Modem\ XXXX\ Settings Where XXXX is the number of your modem
3. In the right panel and double click on Inactivity Timeout
4.The number of minutes for a timeout should be entered between the brackets.
5.For example, a setting could have S19=<10> to set it to 10 minutes.
Removing Programs from Control Panel's Add/Remove Programs Section
If you uninstalled a program by deleting the files, it may still show up in the Add/Remove programs list in the Control Panel.
In order to remove it from the list.
1.Open RegEdit
2.Go to HKEY_LOCAL_MACHINE\ SOFTWARE\ Microsoft\ Windows\ CurrentVersion\ Uninstall
3.Delete any programs here.
If you have a problem locating the desired program open each key and view the DisplayName value
The Fix for Grayed Out Boxes
The File Types tab in Explorer's View / Options menu lets you edit most of your file types, but certain settings cannot be changed. The default action for a batch file, for instance, runs the batch file instead of opening it via Notepad or Wordpad. Thus, when you double-click on AUTOEXEC.BAT, a DOS window opens, and the file executes. If you want to change this default action and edit a batch file when you double-click on it, however, the File Types tab does not let you do so; the Set Default button for the file type called MS-DOS Batch File is always grayed out.
The button is grayed out because HKEY_CLASSES_ROOT's batfile key contains an EditFlag value entry. Such entries are used throughout the Registry to prevent novice users from altering certain system settings. The binary data in batfile's EditFlag reads d0 04 00 00. If you change this value to 00 00 00 00, you can then change any of the batch file settings. Do not, however, indiscriminately zero out EditFlag; if you do so in a system ProgID such as Drive or AudioCD, it completely disappears from the File Types list. For ProgIDs that are linked to extensions, set all EditFlags to 00 00 00 00. For system ProgIDs, replace EditFlag data with 02 00 00 00.
If you wish to have access to some buttons while leaving others grayed out, you must know the function of each EditFlag bit. The last two bytes of data are always zero, but most bits within the first two bytes have a specific effect:
 Byte 1, bit 1: Removes the file type from the master list in the File Types tab (select View / Options under Explorer) if it has an associated extension.
 Byte 1, bit 2: Adds the file type to the File Types tab if it does not have an associated extension.
 Byte 1, bit 3: Identifies a type with no associated extension.
 Byte 1, bit 4: Grays out the Edit button in the File Types tab.
 Byte 1, bit 5: Grays out the Remove button in the File Types tab.
 Byte 1, bit 6: Grays out the New button in the Edit File Type dialog (select the Edit button in the File Types tab).
 Byte 1, bit 7: Grays out the Edit button in the Edit File Type dialog.
 Byte 1, bit 8: Grays out the Remove button in the Edit File Type dialog.
 Byte 2, bit 1: Prevents you from editing a file type's description in the Edit File Type dialog.
 Byte 2, bit 2: Grays out the Change Icon button in the Edit File Type dialog.
 Byte 2, bit 3: Grays out the SetDefault button in the Edit File Type dialog.
 Byte 2, bit 4: Prevents you from editing an action's description in the Edit Action dialog (select the Edit button in the Edit File Type dialog).
 Byte 2, bit 5: Prevents you from editing the command line in the Edit Action dialog.
 Byte 2, bit 6: Prevents you from setting DDE (Dynamic Data Exchange) fields in the Edit Action dialog.
The EditFlags value for Drive, for instance, is d2 01 00 00 in Hex (1101 0010 0000 0001 in binary). Bits 2, 5, 7, and 8 are on in byte 1, and bit 1 is on in byte 2. The EditFlag for batfile is d0 04 00 00 in Hex or 1101 0000 0000 0100 in binary. In this case, bits 5, 7, and 8 are on in byte 1, and bit 3 is on in byte 2.
Bits 4, 5, and 6 of byte 2 apply only to actions that are protected. EditFlags with action keys (such as HKEY_CLASSES_ROOT\batfile\shell\open) determine protection. If byte 1, bit 1 of such an EditFlag is 0 (or if there is no EditFlag), then the action is protected. If byte 1, bit 1 is 1, then the action is unprotected.
Protection on system files
To enable protection on system files such as the KnownDLLs list, add the following value;
1. Open RegEdit
2. HKEY_LOCAL_MACHINE\System\CurrentControlSet\ Control\ SessionManager
3. Create the a Dword value and name it "ProtectionMode "
4. Set the Value to1

System and Startup Settings
Updated: June 18, 2001
Paul Sanna
Chapter 6 from Windows 2000 Registry, published by Prentice Hall.
The Registry has much to do with the successful startup of Windows 2000. Once Windows 2000 starts, there are a number of settings you can modify in the Registry to control how the core operating system works, as well as to customize the startup process. In addition, the Registry stores data that, although you might not be able to successfully and safely change it, would tell you much about how the startup works. This chapter will help you understand the startup and shutdown processes in Windows 2000, as well as some of the system settings.
On This Page
When Windows 2000 Boots
Configuring Startup Options
Configuring System Options
Checking the Registry Hive List
Configuring Shutdown Options
Configuring Windows 2000 for a Crash
Checking the Software That Runs at Startup
When Windows 2000 Boots
The Registry plays an important part in the Windows 2000 startup process. This chapter explains how to make changes in the Registry to customize the startup process. To help you understand that process, though, here is a review of what happens when you start your computer and run Windows 2000.
When you turn on your computer, the computer's BIOS (basic input/output system) performs a POST (power-on self-test). It also checks the memory loaded and the hardware installed on your machine.
If the computer starts without a serious error, the BIOS determines the location of the master boot record. The master boot record specifies the active partition on the computer. The BIOS then executes the boot sector on the active partition. For Windows 2000, the program on the boot sector that executes is Ntldr.exe.
Ntldr.exe switches the machines from a real mode into a flat 32-bit memory mode. Ntldr.exe next opens the Boot.ini file and presents to the user the list of operating systems that can be used to boot based on the options in the file. Assuming that the user selects Windows 2000, the hardware detection phase begins. This function is handled by two programs, Ntdetect.com and Ntoskrnl.exe. The following is the list of hardware components these programs look for:
• Bus/adapter type
• Communications port
• Storage device
• Parallel port
• Video adapter
• Keyboard
• Pointing device
• SCSI adapter
• Floating-point coprocessor
After Windows 2000 has collected information about hardware, the system is interested in which hardware configuration it should use. If the workstation has multiple hardware profiles set up, the user is presented with a list of those profiles. The user can select from one of the hardware profiles or select the Last Known Good Configuration by pressing F8 and picking it from a list (the Last Known Good Configuration is the configuration that was used the last time Windows 2000 booted successfully). The hardware profile and the Last Known Good Configuration are known as ControlSets. A ControlSet contains a complete set of keys and entries needed by Windows 2000 to launch. Windows 2000 stores a number of ControlSets, each identified by a number (e.g. ControlSet001, ControlSet002, etc.). More about ControlSets later.
Note: Windows 2000 stores copies of failed configurations, as well, so don't assume each ControlSet you see in the Registry is a working configuration.
Now, with a configuration selection in hand, the HKEY_LOCAL_MACHINE \SYSTEM hive is populated. Refer to Chapter 6 for a review of what types of keys the HKEY_LOCAL_MACHINE \SYSTEM contains. The hive is populated from the data in the SYSTEM. file, which is located in the System32\Config folder in the main Windows 2000 folder.
Next, the boot loader checks the Registry to see which ControlSet it should load. Entries in the HKEY_LOCAL_MACHINE \SYSTEM \Select key (see Figure 6-1) indicate what configuration is stored in each ControlSet. There are four entries in the HKEY_LOCAL_MACHINE \SYSTEM \Select key. The value of each entry indicates what ControlSet stores the appropriate configuration:
• Current
• Default
• Failed
• LastKnownGood

Figure 6-1: The Select key stores the numbers of the configurations stored in the Registry.
As an example, let's assume the user chooses Last Known Good Configuration. The Registry checks the Select key and finds the LastKnownGood entry. If the Last Known Good Configuration entry in the Select key has a value of 3, then ControlSet003 stores the configuration that will be used to start Windows 2000 and the system loads it.
Next, the configuration selected by the user is copied to the CurrentControlSet. Windows 2000 also updates the Current entry in HKEY_LOCAL_MACHINE \SYSTEM \Select key with the number of the ControlSet used. Windows 2000 next loads the services listed in the CurrentControlSet. This marks the start of the kernel initialization phase. At this point in the startup process, the screen turns blue.
The first step in the kernel initialization is the population of the HKEY_LOCAL_MACHINE \HARDWARE key. This key is populated based on the data collected early in the startup process by Ntdetect.com and Ntoskrnl.exe. A snapshot of the configuration is taken at this point, as well. Here's how: Windows 2000 copies the configuration reflected in the ControlSet indicated by the Current entry in the HKEY_LOCAL_MACHINE \SYSTEM \Select key (remember, the Current entry was updated after the user selects a configuration) to the Clone key. This way, Windows 2000 always has a copy of a configuration.
At this point, drivers are loaded, more services are started, and Windows 2000 starts the logon process. When a user successfully logs on, the configuration stored in the Clone set is copied to the Last Known Good Configuration key. This marks the end of the early startup process. The system continues the startup process by applying settings in the Registry based on a successful startup and on the identity of the user who has logged on.
Top of page
Configuring Startup Options
The settings in this section enable you to configure aspects of Windows 2000's startup and logon process.
Displaying a Note at Startup
You can configure your workstation to display a message that appears as soon as the user presses Ctrl+Alt+Delete. This message can display any kind of warning regarding the legal ramifications of accessing the workstation or the network without proper authorization. Actually, the message can say anything, such as "Have a Nice Day."
To enable this feature, you must set at least one Registry entry, the LegalNoticeText entry, to define the text of the message. In addition, you can specify the text that appears in the title bar of the message with the LegalNoticeCaption entry.
Root Key: HKEY_LOCAL_MACHINE
Key: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Entry: LegalNoticeCaption
Entry: LegalNoticeText
Data Type: REG_SZ
Disable Warnings on Startup
You can suppress any error messages that might otherwise appear at Windows 2000 startup. Add this entry and set the value to 1. Note that the system and application logs will still record details about any startup problem, even if you configure this entry. If you enable this feature, make it a practice to review data in the system and error logs via the Event Viewer.
Root Key: HKEY_LOCAL_MACHINE
Key: SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon
Entry: NoPopupsOnBoot
Data Type: REG_SZ
Show Logon Options
The logon dialog box, which appears at startup and when the user presses Ctrl+Alt+Del, has a button labeled Options. When the user clicks the Options button, the domain dropdown list becomes active, and the option to logon via a dial-up connection appears. The Domain dropdown list gives the user the opportunity to select the domain to which to log on, while the dial-up option lets the user select a dial-up connection to use. You can disable the Options button if you do not want these features to be available. Set the value of this entry to 0.
Root Key: HKEY_LOCAL_MACHINE
Key: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Entry: ShowLogonOptions
Data Type: REG_DWORD
AutoRestartShell
On occasion, the Windows 2000 shell program crashes. Unless you change your shell program, this program is Explorer.exe. By setting this entry value to 1, Windows 2000 will automatically restart the shell application. The alternative to Windows 2000 not automatically restarting your shell application in event of a problem is that all of the items typically found on your Desktop—icons, Taskbar, My Computer, everything—disappear.
Root Key: HKEY_LOCAL_MACHINE
Key: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Entry: AutoRestartShell
Data Type: REG_DWORD
System
When Windows 2000 starts, a number of programs launch in the protected system context. To see the applications that launch for the operating system, open the Registry and inspect this entry.
Root Key: HKEY_LOCAL_MACHINE
Key: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Entry: System
Data Type: REG_SZ
Display Configure Your Server Wizard
You can modify a user profile to determine whether the "Windows 2000 Configure Your Server" dialog box appears at startup. To continue to display the wizard, leave the value of this as 1. To disable the display of the wizard at startup, change the value to 0. The user may at any time display the wizard by choosing Programs\Administrative Tools\Configure Your Server from the Start menu.
Root Key: HKEY_CURRENT_USER
Key: \Software\Microsoft\Windows NT\CurrentVersion\Setup\Welcome
Entry: srvwiz
Data Type: REG_DWORD
Configuring Script Options
A number of options are available to automate the logon, logoff, and shutdown script processes. You can use the Registry to control how these scripts run, such as if the commands in the script appear to the user as the script runs.
Running Logon Scripts Asynchronously
If you are familiar with logon scripts, then you may have experience in dealing with the problems caused when the shell portion of Windows 2000 starts before the logon script completes. This is usually a function more of the design of the logon script than a specific problem with Windows 2000. You can use the Registry to be sure that Windows 2000 does not start the user interface portion of the operating system until the logon script completes. To set this behavior, change the value of this entry to 1.
Root Key: HKEY_CURRENT_USER
Key: Software\Microsoft\Windows\CurrentVersion\Policies\System
Entry: RunLogonScriptSync
Data Type: REG_DWORD
Forcing Asynchronous Running of Startup Scripts
You can configure startup scripts to run just before a user logs on. If you use more than one startup script, it is possible that one script will not wait for another script to finish before it starts. You can configure the Registry so that startup scripts run one at a time. Set the value of this entry to 1 to force startup scripts to run asynchronously.
Root Key: HKEY_CURRENT_USER
Key: Software\Microsoft\Windows\CurrentVersion\Policies\System
Entry: RunStartupScriptSync
Data Type: REG_DWORD
Displaying Startup Script Commands
If you want the commands issued in a startup script to appear on the screen as the script runs, set this value to 0. If you do not want the commands to appear, either do not add this entry to the System key or set its value to 1.
Root Key: HKEY_CURRENT_USER
Key: Software\Microsoft\Windows\CurrentVersion\Policies\System
Entry: HideStartupScripts
Data Type: REG_DWORD
Displaying Shutdown Script Commands
If you do not want the commands issued in a shutdown script to appear on the screen, set the value of this entry to 1.
Root Key: HKEY_CURRENT_USER
Key: Software\Microsoft\Windows\CurrentVersion\Policies\System
Entry: HideShutdownScripts
Data Type: REG_DWORD
Managing Drive Sharing at Startup
You can configure whether the floppy and/or CD-ROM drives on a workstation can be shared over the network. A separate entry in the Registry is reserved for both drive types. For each entry, two options are available: a value of 0 indicates that only the user with administrative rights on the domain can access the drive remotely; a value of 1 indicates that only the user logged on locally at the workstation may access the drive.
Root Key: HKEY_LOCAL_MACHINE
Key: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Entry: allocatedasd
Entry: allocatecdroms
Entry: allocatefloppydrives
Data Type: REG_DWORD
Working with User Accounts
You can control certain aspects of how the user account is managed at system startup via the Registry. For example, you can specify that the user name for the last account logged onto the workstation not appear when the logon dialog box appears. As for another example, you can also control how early the prompt appears to remind users to change their passwords.
Don't Display the Last Logged On Username
When a user press Ctrl+Alt+Del to log on to Windows 2000, the logon dialog box appears. The logon dialog box automatically displays the username of the last account that was logged on to the machine. Some would view this as a security problem. This key can be used to disable the display of the name. Set the value of this entry to 1 to disable display of the last username logged on.
Root Key: HKEY_LOCAL_MACHINE
Key: HKEY_LOCAL_MACHINE \SOFTWARE \Microsoft \Windows NT\CurrentVersion\Winlogon
Entry: DontDisplayLastUserName
Data Type: REG_SZ
Managing Cached Logons
Windows 2000 networking is configured so that a user can log on to the network from any workstation on the Active Directory. A problem arises, though, when the network is down for some reason, such as through the inaccessibility of a domain controller. Each Windows 2000 machine, professional, server, or domain controller, stores the last ten user accounts that were successfully used to log on to the network at that workstation. This way, if the network does fail, a user can still log on to some workstation. For security reasons, you may feel that ten is too large a number of logons to cache. You can fine-tune that value using this entry.
Root Key: HKEY_LOCAL_MACHINE
Key: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Entry: cachedlogonscount
Data Type: REG_DWORD
Change Password Message
This entry allows you to specify how many days in advance a user receives a warning that he or she must change a password before actually being forced to.
Root Key: HKEY_LOCAL_MACHINE
Key: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Entry: passwordexpirywarning
Data Type: REG_DWORD
Restricting Lock Workstation
You can prevent the user of a workstation from locking it using the Windows 2000 Lock Workstation button on the Windows Security dialog box. For security reasons, you may not want to set this option, but it is available nonetheless. Set this entry to 1 to disable the Lock Workstation button. This entry does not appear by default in the Registry; you must add it.
Root Key: HKEY_LOCAL_MACHINE
Key: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Entry: DisableLockWorkstation
Data Type: REG_DWORD
Top of page
Configuring System Options
When Windows 2000 boots, a number of system options can be configured, including the user interface used, which is known as the shell. In this section, you can read about the Registry settings you can manage to customize the system at startup.
Specifying an Alternate Shell
If you miss the familiar Program Manager interface from Windows 3.1, you can still use it in Windows 2000. To configure Windows 2000 to launch the Program Manager interface when Windows 2000 launches, you need to specify the shell program you want to run. Enter Program.exe for this key to launch Program Manager. What does Program Manager look like running on Windows 2000? Figure 6-2 provides you a look.

Figure 6-2: You can run Program Manager in Windows 2000 or as a replacement for Explorer in Windows 2000.
Note that if you start your computer with Program Manager and realize you have made a mistake, you need to change this Registry enter back to its original value. To restore the Explorer shell, the value of this entry should be Explorer.exe. To start the Registry editor from the Program Manger shell, choose File, Run from the Program Manager window. Enter Regedit.exe in the dialog box that appears, and then click OK.
Root Key: HKEY_LOCAL_MACHINE
Key: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Entry: Shell
Data Type: REG_SZ
Configuring Processor Priority
The Registry stores the setting that determines if applications running in the foreground receive preferential treatment from Windows 2000 in terms of processor time. All applications and services running on any computer require the use of the processor. In Windows 2000, as a multitasking operating system, all applications and services receive the same general amount of attention. The Application Response setting allows you to specify that certain applications receive a bit more processor time compared to other applications. What is the alternative? Depending on what software is loaded on your computer, a number of programs may be running without your knowing or noticing. Without setting the Foreground option, these applications and services receive the same number of slices of processor time the application you are using on the Desktop, such as your browser, word processing program, whatever. Depending on the use of the computer running Windows 2000, you may want all applications to share equally in processor time.
Root Key: HKEY_LOCAL_MACHINE
Key: SYSTEM\ControlSet001\Control\PriorityControl
Entry: Win32PrioritySeparation
Data Type: REG_DWORD
Disabling Last Access Time on Files
The NTFS file system records the last time a file was accessed. You can disable this feature via a setting in the Registry. Set the value of this entry to 1 to do so. You will need reboot your workstation to effect this change.
Root Key: HKEY_LOCAL_MACHINE
Key: System\CurrentControlSet\Control\FileSystem
Entry: NtfsDisableLastAccessUpdate
Data Type: REG_DWORD
Configuring Troubleshooting Options
You can add verbose logging to a number of events trapped by Windows 2000. Verbose logging means that Windows 2000 presents more than the normal amount of information. The details logged are stored in the event logs, which are accessible via the Event Viewer. You can specify verbose logging individually for the three different types of events, or you can make one Registry change that specifies verbose logging for all. Table 6-1 shows the types of events that can be logged with extra detail. The table also shows the entry whose value should be set to 1 to enable verbose logging.
Root Key: HKEY_LOCAL_MACHINE
Key: Software\Microsoft\Windows NT\CurrentVersion\Diagnostics
Data Type: REG_DWORD
Table 6-1 Event Logging Keys
Logging Option Key
Verbose log all types of events RunDiagnosticLoggingGlobal
Verbose log group policy events only RunDiagnosticLoggingGroupPOlicy
Verbose log remote boot events RunDiagnosticLoggingIntelliMirror
Verbose log group policy events for application installations RunDiagnosticLoggingAppDeploy
Creating Multiple Pagefiles
Windows 2000 uses both the memory installed on your computer and disk space to create what is called virtual memory. The disk space Windows 2000 claims for memory is known as a pagefile. The pagefile on Windows 2000 workstation is hidden, but you can see it by changing the option in Windows 2000 Explorer to see hidden files in any folder.
The limit on pagefile size is 4095 MB, and the user interface in Windows 2000 only allows you to create one pagefile on each volume. If you need more than one pagefile and you only have one drive available and just one volume on that drive, then you won't be able to create more than one pagefile for use on your workstation. Using the Registry, though, you can add support for multiple pagefiles on a single volume.
To do so, you must create a folder for each pagefile. Naturally, you won't be able to create the pagefile—this is Windows 2000's job—but you must create the folder where the pagefile will be stored. Next, you need to enter the locations, names, minimum size (in Kbytes), and maximum size (Kbytes), for each pagefile you want create. Each of these values is entered into the Registry key specified below. The data type of the key is REG_MULTI_SZ, so you'll enter the information about each of the pagefiles in one entry. Here is the format:
c:\foldername\pagefile.sys minimum_size maximum_size
c:\next folder name\pagefile.sys minimum_size maximum_size
c:\last folder name\pagefile.sys minimum_size maximum_size
Here is the detail on the Registry key you need to work with:
Root Key: HKEY_LOCAL_MACHINE
Key: System\CurrentControlSet\Control\SessionManager\MemoryManagement
Entry: Pagingfiles
Top of page
Checking the Registry Hive List
As you read in Chapter 1, the Registry is stored in a number of files. The Registry editors that ship with Windows 2000, as well as those tools you can purchase or download for free from the Internet, are simply tools to view this data. The Registry stores the location of each of the files, known as hives. You can use the entries storing these location simply to look at the location of the hives, or you can change the entries in order to change the location. The following is the location in the Registry where the hive locations are listed:
HKEY_LOCAL_MACHINE \SYSTEM \CurrentControlSet \Control \HiveList
Figure 6-3 shows the appearance of the hive listing in the Registry.

Figure 6-3: The location of Registry hives is stored in the Registry.
Top of page
Configuring Shutdown Options
The settings in this section will help you configure and customize Windows 2000 when you issue the command to shut down the system.
Shutting the Computer off After Shutdown
Some users, the author included, think it's a nuisance to have to shut off the computer after telling Windows 2000 to shut down the computer. A Registry entry is available to change this default behavior. Use a value of 1 in the PowerdownAfterShutdown entry to automatically power down the computer after entering the choosing Shutdown from the Logon dialog box.
Root Key: HKEY_LOCAL_MACHINE
Key: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Entry: PowerdownAfterShutdown
Data Type: REG_SZ
Disabling Shutdown Without Logon
This setting enables the user to shut down the server from the logon dialog box even if the user is not logged on. Set this value to 1 to enable this option.
Root Key: HKEY_LOCAL_MACHINE
Key: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Entry: ShutdownWithoutLogon
Data Type: REG_SZ
Setting the Default Logoff and Shutdown Choice
You can configure the default option implemented when the user selects logoff or shutdown. The following list shows the option and the value you would use. The list and values are the same for the two settings.
0 Logoff
1 Shutdown
2 Shutdown and Restart
3 Shutdown and Power Off*
Root Key: HKEY_CURRENT_USER
Key: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Shutdown
Entry: LogoffSetting
Entry: ShutdownSetting
Data Type: REG_DWORD
Managing Problem Applications at Shutdown
It's probably impossible to find a user who has not experienced difficulty with an application he or she has installed into Windows 2000. Sometimes users do not know an application has halted until they issue the command to shut down Windows 2000. It's at that point that the operating system alerts the user that the operating system is having trouble with the application. The settings described in this section will help you manage halted applications when you shut down Windows 2000.
Checking for a Hung Application
When you issue the command to shutdown Windows 2000, the system contacts each running application with its own shutdown request. An application that is hung will not respond. Eventually, Windows 2000 will notify you that the application is not responding, and it will show you how much more time it will wait before attempting forcibly shut it down. The default value for this entry is 20.
Root Key: HKEY_CURRENT_USER
Key: ControlPanel\Desktop
Entry: WaitToKillAppTimeout
Date Type: REG_SZ
Waiting for a Hung Application to Respond
You can configure the amount of time Windows 2000 waits for an unresponsive application to respond before Windows 2000 finally shuts it down. This setting is supplied in milliseconds. The default value is 5.
Root Key: HKEY_CURRENT_USER
Key: ControlPanel\Desktop
Entry: HungAppTimeout
Date Type: REG_SZ
Automatically Ending Hung Applications
If you are impatient, you might not want to wait for Windows 2000 to activate a halted application when you issue the shutdown command. Set this value of this entry to 1 to force Windows 2000 to shut down as soon as you enter command without attempting to shut down normally a hung application.
Root Key: HKEY_CURRENT_USER
Key: ControlPanel\Desktop
Entry: AutoEndTasks
Date Type: REG_SZ
Top of page
Configuring Windows 2000 for a Crash
Almost all of the really usable configuration options for preparing for a Windows 2000 can be set in the Registry. Don't think that working with these options is a frivolous activity. Either your installation of Windows 2000 or that of someone you know or administer will crash. You should expect it and take few minutes to prepare for it. The traditional preparedness steps naturally involve backing up, storing the backups offsite, and other normal procedures. You won't learn how to back up here. Rather, I'll cover the options that control Windows 2000's behavior when it crashes.
Sending an Alert
You can configure Windows 2000 to send an alert to all members of the administrative group should the operating system crash. Set the value of the entry to 1 to send an administrative alert or set the value to 0 to disable.
Root Key: HKEY_LOCAL_MACHINE
Key: SYSTEM\ControlSet001\Control\CrashControl
Entry: SendAlert
Data Type: REG_DWORD
Configuring the Memory Dump File
It's difficult to miss the instant when Windows 2000 crashes. The screen background turns blue and streams of Windows 2000 internal technical data appear. This data is generally very useful, especially to a technical support engineer who may be able to determine why Windows 2000 crashed by examining that data. By examining this crash data, it is possible to determine what modules were loaded in memory when Windows 200 crashed, what drivers were in use, the data at specific memory points, and more. The DumpFile setting allows you to redirect this data to an external file. This way, you can save the settings to examine at a later time, such as if the crash condition becomes malignant. With the data in file format, you can very easily share the data with an individual qualified to review it.
You can use two settings to save diagnostic data to an external file. The first one, CrashDumpEnabled, simply determines if the data will be saved to a file. Enter 1 to save the data externally; enter 0 not to. The second entry allows you to specify the name of the file that will store the crash data, as well as its location. The default location is %SystemRoot%\Memory.Dmp. The %SystemRoot% variable resolves to the main Windows 2000 directory. You might recall from Chapter 1 the point that the REG_EXPAND_SZ data type is used for Registry entries that contain variables that are resolved to the real value when the entry is used.
Root Key: HKEY_LOCAL_MACHINE
Key: SYSTEM\ControlSet001\Control\CrashControl
Entry: CrashDumpEnabled
Data Type: REG_DWORD
Entry: DumpFile
Data Type: REG_EXPAND_SZ
Automatically Reboot
When Windows 2000 crashes, the system freezes, and contents of memory, names of modules loaded, and so on is displayed on the screen against a blue background. This is commonly referred to as the blue screen of death. You can change this behavior so that Windows 2000 automatically reboots after a crash condition. The drawback to this option is that it might not be immediately obvious to you that the system crashed if you weren't working at it when the crash happened. Granted, you might wonder when you return to your workstation why the logon dialog appears to log back onto the system, but nothing is as familiar to an experienced Windows NT/2000 user, even from a good distance away, as the blue screen of death. If you use this option, be sure you enable the option to store the contents of the crash log to an external files. To enable this option, set the value of AutoReboot to 1.
Root Key: HKEY_LOCAL_MACHINE
Key: SYSTEM\ControlSet001\Control\CrashControl
Entry: AutoReboot
Data Type: REG_DWORD
Top of page
Checking the Software That Runs at Startup
Windows 2000 runs a number of applications and services at startup. Applications are those programs that you may have installed. Some services launch automatically at system startup, such as your virus protection, others when they're needed, others when you manually start them, and some run just once. The Registry keeps track of those applications that need to be run just one time and notes when an application has been run so it doesn't run again. The same rules are in place for services. Services are programs that provide system support for Windows 2000. Examples of Windows 2000 services include the Network browser, which makes it possible for the workstation to see other computers on the network, and the Task Scheduler. A handful of Registry entries control the applications and services that run at startup. It's useful to know where to find this list should you need to debug some problem at startup. The following list of keys show you where the run information is stored:
HKEY_LOCAL_MACHINE \SOFTWARE \Microsoft \Windows \CurrentVersion \Run
HKEY_LOCAL_MACHINE \SOFTWARE \Microsoft \Windows \CurrentVersion \RunOnce
HKEY_CURRENT_USER \Software \Microsoft \Windows \CurrentVersion \Run
HKEY_CURRENT_USER \Software \Microsoft \Windows \CurrentVersion \Runonce
About the Author
Paul Sanna is a solutions consultant with more than 12 years of experience in the software industry. He has worked with every version of Windows NT and Windows 2000, including commercial releases, interim and beta builds, and service packs.
We at Microsoft Corporation hope that the information in this work is valuable to you. Your use of the information contained in this work, however, is at your sole risk. All information in this work is provided "as -is", without any warranty, whether express or implied, of its accuracy, completeness, fitness for a particular purpose, title or non-infringement, and none of the third-party products or information mentioned in the work are authored, recommended, supported or guaranteed by Microsoft Corporation. Microsoft Corporation shall not be liable for any damages you may sustain by using this information, whether direct, indirect, special, incidental or consequential, even if it has been advised of the possibility of such damages. All prices for products mentioned in this document are subject to change without notice.