Windows 7 Structure of Registry: HKCR vs. HKLM; Wow6432Node branch

[pstein]

I have some questions about the structure and dependencies of Registry branches.

When I inspect (on 64bit Win 7) all entries of a certain program then I found two identical branches of it in

HKEY_CLASSES_ROOT\

and

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\

Is the second a replication of the first?
In other words: If the second is not existing: Does it automatically acces the first as a kind of fallback information?

Similarly I found identical branches in

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\

and

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\Mail\

Here the same question arises:
Is the second a mirror of the first?

What if they contradict each other: Which one has priority?

Peter

 

[BurrWalnut]

Here is some information that I have put together over the years. It should answer most of your questions:


There are five main branches of the registry. HKEY is an acronym for Handle to Registry Key. They are as follows:

1. HKEY_CLASSES_ROOT (HKCR) – The information that is stored here makes sure that the correct program opens when you open a file by using Windows Explorer. Starting with Windows 2000, this information is stored under both the HKLM and HKEY_CURRENT_USER (HKCU) keys.

The HKLM\SOFTWARE\Classes key contains settings that can apply to all users on the computer. The HKCU\Software\Classes key contains settings that override the default settings and apply only to the current user. The HKCR key provides a view of the registry that merges the information from these two sources.

To change the settings for the current user, changes must be made under HKCU\Software\Classes instead of under HKCR. To change the all user settings, changes must be made under HKLM\SOFTWARE\Classes.

If you write keys to a key under HKCR, the system stores the information under HKLM\ SOFTWARE\Classes.

If you write values to a key under HKCR, and the key already exists under HKCU\ SOFTWARE \Classes, the system will store the information there instead of under HKLM\ SOFTWARE\Classes.

2. HKEY_CURRENT_USER - This branch is a subkey of HKEY_USERS, loaded when the user logs on. It links to the appropriate S-1-5-21 section for the user currently logged onto the PC and contains information such as logon names, desktop settings and Start menu settings.

3. HKEY_LOCAL_MACHINE - This branch contains computer specific information about the type of hardware, software and other preferences on a given PC, this information is used for all users who log onto this computer.

4. HKEY_USERS - This branch contains individual preferences for each user of the computer, each user is represented by a SID subkey located under the main branch. S-1-5-18 contains System Information, S-1-5-19 is Local Service, S-1-5-20 is Network Service and an S-1-5-21 for each User.

5. HKEY_CURRENT_CONFIG - This branch links to the section of HKEY_LOCAL_MACHINE appropriate for the current hardware configuration.



Also, there is an additional folder named C:\Program Files (x86), which contains the x86 (32-bit) program details. Another, C:\Windows\SysWOW64, appears to be a System32 equivalent. There are very many more SysWOW64 folders in the huge C:\Windows\winsxs folder. The registry contains additional branches named \Wow6432Node in HKCR, HKCU, HKLM and HKU, which all contain mirrored information regarding 32-bit software. WOW stands for Windows 32-bit on Windows 64-bit.