| `C:\Windows\System32\config\RegBack\` | Auto-backup copies (created by default on every boot in Win10, off by default in Win11) |
The app you use to view and edit it is **regedit.exe** (Start → Run → `regedit`). It has two panes:
**Left:** folder tree (keys + subkeys)
**Right:** values in the currently-selected key
The 5 Root Hives
Step 2 of 7
There are exactly **5 root hives** you see at the top of regedit. They are fixed — you can't add a new one.
| Hive | What it stores |
|------|----------------|
| **HKEY_CLASSES_ROOT (HKCR)** | File associations, COM object registrations, shell commands. Merges HKLM\SOFTWARE\Classes and HKCU\SOFTWARE\Classes. |
| **HKEY_CURRENT_USER (HKCU)** | Settings for the *currently logged-in* user — desktop, app preferences, recently used files. |
| **HKEY_LOCAL_MACHINE (HKLM)** | Machine-wide settings: hardware drivers, OS config, software installed for all users. |
| **HKEY_USERS (HKU)** | All user profiles on this machine. HKCU is just a shortcut to your profile under here. |
| **HKEY_CURRENT_CONFIG (HKCC)** | Current hardware profile (display, printers, etc.). Pointer into HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\Current. |
*The mental model:**
**HKCU** = "per-user stuff" (theme, language, app settings for *you*)
**HKLM** = "machine-wide stuff" (drivers, services, OS config for *everyone*)
**HKCR** = "file type → app" mappings
**HKU** = "every user that has ever logged in"
**HKCC** = "current hardware profile" — almost never edited directly
When a program wants a setting, it asks the OS for HKCU\Software\Vendor\App first. If that doesn't exist, it falls back to HKLM\Software\Vendor\App. That's why the same program behaves differently for different users — its settings live in HKCU, not HKLM.
Keys, Subkeys, Values
Step 3 of 7
The structure is **folders-in-folders**, like a file system:
```
HKEY_CURRENT_USER ← root hive
└── Software ← key (folder)
└── Microsoft ← subkey
└── Windows ← subkey
└── CurrentVersion
└── Explorer ← subkey
├── value: AltTabSettings = 1 ← REG_DWORD
├── value: Advanced = "<binary>" ← REG_BINARY
└── value: Shell = "explorer.exe" ← REG_SZ
```
*Vocabulary:**
**Key** = a folder. Contains subkeys and/or values.
**Subkey** = a key nested inside another key. There's no technical difference — "subkey" just means "a key that's not at the root".
**Value** = a single setting inside a key. Has a **name**, a **type**, and **data**.
**Default value** = a value with the name `(Default)` (empty parens). Every key has one. If you see `(Default)` with no data, the key has no default value set.
*Path notation** uses backslashes between keys, same as Windows paths:
*Important:** key names are **case-insensitive** but value names are **case-sensitive**. `MyValue` and `myvalue` are two different values in the same key.
Value Types
Step 4 of 7
Every value has a **type**. The type tells Windows how to read the bytes. Get it wrong and the OS will silently misinterpret the data.
| Type | What it stores | What it looks like in regedit |
| `REG_SZ` | A string (text). | `"C:\Windows\explorer.exe"` |
| `REG_EXPAND_SZ` | A string with environment variables that get expanded. | `"%SystemRoot%\explorer.exe"` |
| `REG_MULTI_SZ` | A list of strings, one per line. | `line1\0line2\0line3\0\0` |
| `REG_DWORD` | A 32-bit integer. Most "on/off" or numeric settings. | `0x00000001` |
| `REG_QWORD` | A 64-bit integer. Less common. | `0x0000000000000001` |
| `REG_BINARY` | Raw bytes. | `12 34 56 78 9a bc de f0` |
| `REG_NONE` | Data with no defined type. Rare. | `(zero-length binary value)` |
*REG_DWORD and the magic of 0/1:**
`0` = disabled / off / false
`1` = enabled / on / true
That's it. For almost every "enable X" tweak you see on the internet, you're setting a DWORD to `1` (or `0` to disable).
*REG_SZ vs REG_EXPAND_SZ:**
Both look like strings, but `REG_EXPAND_SZ` is processed before the program sees it. If the data contains `%SystemRoot%`, that gets replaced with `C:\Windows` automatically. Don't change a `REG_EXPAND_SZ` to `REG_SZ` unless you know what you're doing.
*REG_MULTI_SZ** stores multiple strings with null terminators and a final double-null. In regedit's UI it shows as one string per line. Useful for lists of extensions, search paths, etc.
How to Edit a Value
Step 5 of 7
*Open regedit:** Win+R → `regedit` → Enter → Yes to UAC.
*Navigate:** click folders in the left pane to expand them. The address bar at the top shows the current path — you can paste a full path there and hit Enter to jump directly.
*Read a value:** select a key in the left pane. Its values appear in the right pane with name, type, and data columns.
*Edit a value:**
1. Double-click the value (or right-click → Modify)
2. Change the data
3. Click OK
4. Most changes apply **immediately** — no save button. Some need a restart or sign-out to take effect.
*Create a new value:**
1. Right-click in the right pane → New → pick the type (DWORD, String, etc.)
2. Type the name
3. Press Enter, then enter the data
*Create a new key:** right-click in the left pane → New → Key. Type the name.
*Delete a value or key:** select it, press Delete (or right-click → Delete). Confirm.
*Find:** Ctrl+F. Searches names, value data, and content. Use this constantly — there's no "recently used" otherwise.
*Refresh:** F5. If you change something via script, F5 to see it.
*Export a key:** right-click → Export. Saves a `.reg` file (text format, human-readable). This is your **backup** mechanism — covered in step 7.
Common Useful Tweaks
Step 6 of 7
These are real, harmless tweaks people do all the time. Each shows the **path**, **value name**, **type**, and **data** you set.
1. Read the path out loud. If it doesn't start with `HKCU` or `HKLM`, be careful.
2. Check the type matches (DWORDs are not strings).
3. Note the **original value** before changing it. Write it down.
4. Make the change.
5. If anything goes wrong, restore the original (see next step).
*Rule of thumb:** `HKCU` tweaks are safe to experiment with — they affect only your account, and you can delete the value to undo. `HKLM` tweaks affect everyone and can disable system features.
Backup, Restore, and What NOT to Touch
Step 7 of 7
*Backup before you change anything.**
1. Navigate to the key you're about to edit.
2. Right-click it → **Export**.
3. Save as a `.reg` file somewhere obvious (`Desktop\backup-2026-07-20.reg`).
4. Make your change.
If you break something, double-click the `.reg` file (or right-click → Merge) to restore. Or in regedit: File → Import → pick the file.
*Full registry backup:**
File → Export → choose **All** under "Export range" → saves the entire registry as one `.reg` file. Useful before big changes.
*Command-line backup/restore (handy in scripts):**
`hex(7):` = REG_MULTI_SZ (UTF-16LE, null-separated, double-null at end)
`hex(2):` = REG_EXPAND_SZ
All strings are UTF-16LE for .reg files (each ASCII char is two bytes with a `00` after)
You can write `.reg` files in any text editor and double-click them to apply. They're plain text — perfect for sharing tweaks, version-controlling system config, or scripting.
