GUI

logon

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\RunLogonScriptSync = 0x00000001
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\Administrator = 0x00000001 (WinXP)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Network\MinPwdLen = chars (binary)
HKLM\SOFTWARE\Microsoft\Windows[ NT]\CurrentVersion\Winlogon\
  - AutoAdminLogon = "1" (press and hold "shift" while booting to override temporarily; see also "IgnoreShiftOverride")
  - DefaultPassword = "password"
  - DefaultUserName = "username"
  - DontDisplayLastUserName = "1"
  - IgnoreShiftOverride = "1" (ignore shift override to not bypass the "AutoAdminLogon")
  - PowerDownAfterShutDown = "1" (see WinNT4)
  - ShowLogonOptions = "0" (Win2k)
HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\RestoreConnection = 0 (restore on first access)
HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ExpectedDialupDelay = 0..600 (seconds, DWORD)

context-menu of files and folders

HKCR\file-type\shell\(default) = "standard-execute-item" (marked bold in context-menu)
HKCR\file-type\shell\menu-item\(default) = "text in context-menu" (with '&' to underline one character)
HKCR\file-type\shell\menu-item\command\(default) = "command-line to execute"
HKCR\*\Quickview\(default) = "*" (enables Quickview for almost all file-types, not all OS'es)

example: "Notepad" for all files
HKCR\*\shell\Notepad\command\(default) = "notepad %1"

example: "DOS-prompt" for all folders
HKCR\Folder\shell\DOS\command\(default) = "command" (95+) resp. "cmd" (NT4+)

further entries
HKCR\AllFilesystemObjects\shellex\ContextMenuHandlers\Copy To\(default) = "{C2FBB630-2971-11D1-A18C-00C04FD75D13}"
HKCR\AllFilesystemObjects\shellex\ContextMenuHandlers\Move To\(default) = "{C2FBB631-2971-11D1-A18C-00C04FD75D13}"

desktop settings (wallpaper, colors, appearance and the like)

HKCU\Control Panel\Colors\
  - AppWorkspace = RGB
  - ButtonDkShadow = RGB (outer border-shadow, right/below)
  - ButtonLight = RGB (outer border-shadow, left/above)
  - ButtonShadow = RGB (inner border-shadow, right/below)
  - ButtonHilight = RGB (inner border-shadow, left/above)
  - Scrollbar = RGB
  - WindowsFrame = RGB
HKCU\Control Panel\Desktop\
  - ForegroundFlashCount (default: 0x00000003)
  - ForegroundLockTimeout (default: 0x00030D40, in ms)
  - HungAppTimeout = "5000"
  - MenuDropAlignment = 1 (align right)
  - MenuShowDelay = "250" [ms]
  - PaintDesktopVersion = 0x00000001 (Win9x ?)
  - WaitToKillAppTimeout = "10000"
HKCU\Control Panel\Desktop\WindowMetrics\
  - IconTitleWrap = "0"
  - MinAnimate = "0" (window-animation when max/min)
  - MinWidth = [REG_SZ] (maximum width of an entry in the taskbar in pixel, "-270" disables all text)
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
wallpaper-position:
  HKCU\Control Panel\Desktop\WallpaperOriginX resp. WallpaperOriginY
background color before login: (only NT?)
  HKU\.DEFAULT\Control Panel\Colors\Background = "255 255 255" (e.g.)
HKU\.DEFAULT\Control Panel\desktop\DragFullWindow = 1
HKU\.DEFAULT\Control Panel\desktop\FontSmoothing = 1
HKU\.DEFAULT\Control Panel\desktop\ScreenSave_Data = [screen saver password]
HKU\.DEFAULT\Control Panel\Keyboard\InitialKeyboardIndicators="0" or "2"
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\
HKCU\Software\Microsoft\Command Processor\
  - AutoRun = "some-batch-file-to-run-for-every-instance-of-cmd-exe.bat"
  - CompletionChar = 0x00000009 (Tab)
  - PathCompletionChar = 0x00000009 (Tab)
HKCU\Software\Microsoft\Internet Explorer\DesktopComponents\0\Position: [bytes 17/18] workspace height -> taskbar height
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Link = 00 00 00 00 (disables "Link to ...")
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\
  - EnableBalloonTips = 0
  - EncryptionContextMenu = 1
  - IntelliMenus = "NO" (Win2k+)
  - ShowInfoTipp = 0
  - Start_ShowRecentDocs = 0..2 (WinXP)
  - StartMenuScrollPrograms = "NO" (Win98+)
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FindComputerMRU\
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Doc Find Spec MRU\
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\comdlg32\ (file open/save dialog)
  - NoBackButton = 0x00000000 (show back button)
  - NoFileMru = 0x00000000 (remember previously-used filenames)
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\comdlg32\PlacesBar\
  - Place0..4 = REG_SZ (path) or REG_DWORD:
      0x00000000 desktop
      0x00000005 my documents
      0x00000006 favorites
      0x00000008 recent
      0x0000000d my music
      0x0000000e my videos
      0x00000011 my computer
      0x00000012 network neighborhood
      0x00000022 history
      0x00000027 my pictures
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\
  - ClassicShell = 1 (disables IE4-desktop-extentions)
  - ClearRecentDocsOnExit = 01 00 00 00
  - LinkResolveIgnoreLinkInfo = 01 00 00 00 (don't check target network link)
  - NoAddPrinter = 01 00 00 00
  - NoClose = 01 00 00 00 (no logoff!)
  - NoCommonGroups = 01 00 00 00
  - NoDeletePrinter = 01 00 00 00
  - NoDesktop = 01 00 00 00 (no desktop-icons!)
  - NoDrives: A:bit[0], B:bit[1], etc.
  - NoDriveTypeAutoRun: (autorun.inf) zero means autorun activated
      bit 0: unknown drive type
      bit 1: no root directory
      bit 2: changeable drive (e.g. diskette)
      bit 3: hdd
      bit 4: network drive
      bit 5: cdrom
      bit 6: ram-disk
      bit 7: reserved, always set
  - NoFavoritesMenu = 01 00 00 00
  - NoFileMenu = 0x00000001 (in windows-explorer)
  - NoFileSharingControl = 01 00 00 00
  - NoFind = 01 00 00 00
  - NoInstrumentation (?)
  - NoLogOff = 01 00 00 00
  - NoLowDiskSpaceChecks = 0x00000001
  - NoNetHood = 01 00 00 00 (Win9x/ME?)
  - NoNetConnectDisconnect = 01 00 00 00 (explorer context-menu)
  - NoPrinterTabs = 01 00 00 00 (no "General" and "Detail" tabs)
  - NoPrintSharingControl = 01 00 00 00
  - NoRecentDocsHistory = 1 (?)
  - NoRecentDocsMenu = 01 00 00 00
  - NoRun = 01 00 00 00
  - NoSaveSettings = 01 00 00 00
  - NoSetFolders = 01 00 00 00 (minimizes "Start/Settings")
  - NoSetTaskbar = 01 00 00 00
  - NoSMHelp = 01 00 00 00
  - NoSMMyDocs = 01 00 00 00
  - NoStartBanner = 01 00 00 00
  - NoStartMenuSubFolders = 0x00000001 (?)
  - NoToolbarCustomize (?)
  - NoTrayContextMenu = 01 00 00 00 (no context-menu on taskbar, start-button, clock, taskbar applications)
  - NoViewContextMenu = 01 00 00 00 (no context-menu on desktop, windows-explorer)
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage = 0x00000001
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\NoDispCPL = 0x00000001 (no "Display"-dialog)
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\NoStartBanner = 0x00000001

rename "Recycle Bin"

HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\ShellFolder\Attributes: change "40 01 00 20" to "70 01 00 20"

refresh windows-explorer (if F5 isn't enough)

HKLM\SYSTEM\CurrentControlSet\Control\Update\UpdateMode = 0 (!)

wrapping in notepad.exe

HKCU\Software\Microsoft\Notepad\fWrap = 0

select another searchengine for "startmenu/search/in the internet"

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main\Search Page\

repair missing file-attributes column in explorer (due to an error in win 98)

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowAttribCol = 0x00000001
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\ShowAttribCol\
  Type = "checkbox"
  Text = "Dateiattribute in Detailansicht anzeigen"
  HKeyRoot = 0x80000001
  RegPath = "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"
  ValueName = "ShowAttribCol"
  CheckedValue = 0x00000001
  UncheckedValue = 0x00000000
  DefaultValue = 0x00000000
  HelpID = "update.hlp#51071"
to add a corresponding checkbox in options

add system tree structure to quickbar

HKCR\CLSID\{EFA24E64-B078-11d0-89E4-00C04FC9E26E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}

change drive letter assignments

HKLM\SYSTEM\MountedDevices\...

System

main system- and user-data

HKLM\SOFTWARE\Microsoft\Windows[ NT]\CurrentVersion\

setup default user-data

HKCU\Software\Microsoft\MS Setup (ACME)\User Info\

uninstall-entries

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

installed fonts

HKLM\SOFTWARE\Microsoft\Windows[ NT]\CurrentVersion\Fonts\

booting NT4/2K

HKCU\Software\Microsoft\WindowsNT\CurrentVersion\Windows\NoPopUpsOnBoot = 0x00000001 (?)
"chkdsk /f" at boot:
  HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute = "autocheck autochk /p *" (unicode!)

speed up DSL connections

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\MTU = 0x000005d4 (1492) - (NT4/2K/XP)
  or: HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{choose interface}\MTU = ...
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Tcp1323Opts = 0x00000001 - (NT4/2K)
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\TcpWindowSize = 0x0000faf0 (64240) - (NT4/2K) - 7fff? f990? ffff? - (MTU-40)*44 ?

get max MTU:
ping -f -l 1464 t-online.de
lower the number if "package had to be fragmented"
add 28 to get MTU // e.g. 1464 + 28 = 1492
see http://www.speedguide.net/analyzer.php

c't 25/2006 about Window Size (Receive Window, RWIN):
RWIN = data-rate * round-trip-time
Example: 6 MBit/s * 100 ms = 600.000 Bit = 75.000 Byte

speed up NT4/2K/XP - do rather not use these

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\
  - AlwaysUnloadDLL = 0x00000001 (obsolete since Win2k)
  - ClearPageFileAtShutdown = 0x00000001 (not for speed, but for security)
  - DisablePagingExecutive = 0x00000001 (keep kernel in RAM, not recommended below 256 MB RAM; even then not always good)
  - IoPageLockLimit = [DWORD] (number of pages written to resp. read from the harddisk at one time, not recommended below 128 MB RAM) (?) (obsolete for WinXP)
  - LargePageMinimum = [big value, e.g. 0xffffffff] (early athlon patch, use carefully; obsolete for WinXP)
  - LargeSystemCache = 0x00000001 (recommended only for pure file servers)
  - [Non]NonPagedPoolQuota/Size = [DWORD] (only a concern for driver developer and faulty applications)
  - PagingFiles = [REG_MULTI_SZ] (better don't touch this)
  - PhysicalAddressExtension = [DWORD] (not a switch, but a monitor)
  - SecondLevelDataCache = [DWORD] (e.g., default: 100 = 256kB; obsolete since Pentium-II, ignored by WinXP)
  - SystemPage = [DWORD] (better don't touch this)
HKLM\SYSTEM\CurrentControlSet\Control\WaitToKillServiceTimeout = "10000"

speed up network access from win2k to win98

HKLM\Software\Microsoft\Windows\Current Version\Explorer\RemoteComputer\NameSpace - delete key {D6277990-4C6A-11CF-8D87-00AA0060F5BF} ("Geplante Tasks")

UDMA in NT4 SP5+ ("0x1": try activation, "0x2": force activation, could destroy system!)

HKLM\SYSTEM\CurrentControlSet\Services\atapi\Parameters\Device[0,1]\DriverParameter = "DMADetectionLevel = 0x1;"

48-bit LBA support (for IDE disks larger than 128 GB)

HKLM\SYSTEM\CurrentControlSet\Services\atapi\Parameters\EnableBigLba = 0x00000001

modify the percentage of a volume that NTFS reserves for its MFT

HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsMftZoneReservation = 0x00000001 (default, 12.5%) - 0x00000004 (50%)

speed up file access for NTFS

HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\
  - NtfsDisable8dot3NameCreation = 0x00000001 (don't create short file names for 16-bit software)
  - NtfsDisableLastAccessUpdate = 0x00000001 (disable update of last file access status)

speed up floppy access

HKLM\System\CurrentControlSet\Services\Class\FDC\0000\ForceFIFO = 0 (if access takes unusually long)

activate the NUKEFIX to prevent being shot from the internet (?)

HKLM\SYSTEM\CurrentControlSet\Services\VxD\MSTCP\BSDUrgent = "0"

correct shutdown problems in Win 9x (doesn't always help)

HKLM\SYSTEM\CurrentControlSet\Control\Shutdown\FastReboot = "0"

network shares

HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\Shares

hide in network

HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters\hidden = 0x00000000

disable default shares

HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters\
AutoShareServer = 0
AutoShareWks = 0

don't start dr. watson as default debugger

delete HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug - undo: start "DRWTSN32 -i"

disable "windows update"-link

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWindowsUpdate = 0x00000001

"Do not allow enumeration of SAM accounts and names" (Win NT4/2k)

HKLM\SYSTEM\CurrentControlSet\Control\LSA\RestrictAnonymous = 0x00000001

extend file access in recovery console

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\SetCommand = 0x00000001
  → then in console type "set AllowAllPaths = TRUE"

time service

disable super fetch for SSD in Win7

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters\EnablePrefetcher = 0x00000000

disable '.exe has stopped working' dialog (at least on Server 2008; not on Win2k)

HKCU\Software\Microsoft\Windows\Windows Error Reporting\DontShowUI = 1

Internet Explorer (see also internet explorer)

some interesting values

HKCU\Software\Microsoft\Internet Explorer\Main\
HKCU\Software\Microsoft\Internet Explorer\PageSetup\
HKCU\Software\Microsoft\Internet Explorer\SearchURL\
HKCU\Software\Microsoft\Internet Explorer\Settings\
HKCU\Software\Microsoft\Internet Explorer\Styles\
HKCU\Software\Microsoft\Internet Explorer\TypedURLs\

max connections per website (HTTP 1.0 / 1.1), try out exact values

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
  MaxConnectionsPer1_0Server = 0x00000008 (default: 0x00000004)
  MaxConnectionsPerServer = 0x00000008 (default: 0x00000002)

Login with username and password in URL

HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\iexplore.exe = 0x00000001

disable caching of SSL pages (e.g. for online-banking)

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\DisableCachingOfSSLPages = 0x00000001 (default: 0x00000000)

background image for menu-bar

HKCU\Software\Microsoft\Internet Explorer\Toolbar\BackBitmap = "file"

standard browser

HKCR\.htm (resp. .html) \(Standard) = htmlfile (IE) resp. NetscapeMarkup

enable security level options for "my computer"-zone

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Flags: bit[5] (for 32) = 0

disable fade out of rarely used menu items (IE5 (and higher?))

HKCU\Software\Microsoft\Internet Explorer\Main\FavIntelliMenus = "no"

change URL-autocomplete (CTRL-ENTER) order

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\Url(Template)\

navigating sound

HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.current\(Standard) = [wav-file]

open new windows with external link clicked

HKCU\Software\Microsoft\Internet Explorer\Main\AllowWindowReuse = 0

browse in new process (IE5, automatic decision does not always function correctly, "yes" with >32 MB RAM)

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess\BrowseNewProcess = "yes" or "no"
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess\BrowseNewProcess (NT,2k)

start in fullscreen mode (same as F11)

HKCU\Software\Microsoft\Internet Explorer\Main\FullScreen = "yes"

re-get download-dialog after accidently de-marked "always ask" with "exe"-files

HKCR\exefile\EditFlags: bit[8] (for 256) = 0

expand selections of search engines in (non en-us ?) IE5

HKLM\SOFTWARE\Microsoft\Internet Explorer\Search: replace {SUB_RFC1766} with "en-us" and reboot

disable "Alexa" (in IE5 SP1&2 (?), suspected to spy)

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}   (delete this key!)

(animated) logos

look at http://support.microsoft.com/support/kb/articles/q176/7/13.asp

outlook express splash screen

HKU\.DEFAULT\Identities\CLASS ID\Software\Microsoft\Outlook Express\5.0\NoSplash = 0x00000001 or
HKU\UserId\ClassId\Software\Microsoft\Outlook Express\5.0\NoSplash = 0x00000001 (when using profiles)

outlook express adressbook

HKCU\Software\Microsoft\WAB\WAB4\Wab File Name\

Office (see also office)

live-scrolling in Word (97)

HKCU\Software\Microsoft\Office\8.0\Word\Options\LiveScrolling = "1"

extended undo in Excel (97)

HKCU\Software\Microsoft\Office\8.0\Excel\Microsoft Excel\UndoHistory = 0..100 (default: 16)

disable journaling

HKCU\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft ...\Enabled = 0x00000000

disable the automatic popup of the dialog of the clipboard in o2k

HKCU\Software\Microsoft\Office\9.0\Common\General\AcbControl = 0x00000001

Outlook 2002: minimize to tray

HKCU\Software\Microsoft\Office\10.0\Outlook\Preferences\MinToTray = 0x00000001

Multimedia

media player recent file list

HKCU\Software\Microsoft\MediaPlayer\Player\RecentFileList\

cd-intro play length

HKCU\Software\Microsoft\Windows\CurrentVersion\Applets\CdPlayer\Settings\IntroPlayLen = 1..60 (sec.)

show cards of other players

HKCU\Software\Microsoft\Windows\CurrentVersion\Applets\Hearts\ZB = "42"

Other

disable norton splash screen

HKLM\SOFTWARE\Symantec\Norton Utilities\DisableSplashScreen = "1"

Registry internals

main categories

types

.reg - files (example)

1. line: REGEDIT4 (or REGEDIT ?)
empty line
; comment
[HKEY_LOCAL_MACHINE\SOFTWARE\company] (creates 'company'-key)
empty line
[HKEY_LOCAL_MACHINE\SOFTWARE\company\software] (creates 'software'-key in 'company')
@="text" (creates standard-string-variable in 'software'-key)
"variable1"="c:\\temp\\somewhat\\" (creates string-variable in 'software'-key, note the double '\\' for folders!)
"variable2"=dword:000000FF (creates dword-variable in 'software'-key, value (255) in hex)
"variable3"=hex:00,01,20,33,4A,FF,80 (creates hex-variable in 'software'-key, single values in hex)
"variable4"=hex:01,01,00,01,01,01,00,01,02,01,04,01,01,01,01,01,31,01,01,01,01,\ (these 80 characters per line ...)
09,01,00,01,35,04,53,61,74,31,ff,01,05,01,00,01,05,01,01,00,04,00,00,00,01,\ (... seem to be the upper limit for hex, ...)
00,00,00,00,00,00,01,02,02,22,41,72,69,61,6c,00,00,00,00,00,00,00,00,00,00,\ (... connect lines with '\')
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
empty line
...
[-HKEY_CURRENT_USER\this key will be deleted (win2k+?)]
[HKEY_CURRENT_USER\some key]
"this key's value will be deleted (win2k+?)"=-
...

CLSID

Regedit

parameters

• import: regedit [file]
• import silent: regedit /s [file]
• export ascii: regedit /a [file] <key>
• export unicode: regedit /e [file] <key>
• create and replace (?): regedit /c [file]
• delete (win9x): regedit /d [key]
• open new instance (winxp): regedit /m
• win2k resource kit and winxp also have "reg.exe"

settings

• HKCU\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit
• script to open regedit with specified key:
  set LastKey="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix"
set Key=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit
reg add %Key% /f /v "LastKey" /d %LastKey%
start regedit.exe