DEVICEMAP
HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP
This key holds the pointers to all the hardware device drivers and settings on the system. It usually points to the control set that is currently on the system.
KeyboardClass
HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\KeyboardClass
This key points to the control set and the driver information listed there, as a map would to a traveler.
KeyboardPort
HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\KeyboardPort
This key points to the control set and the driver information listed there.
PARALLEL PORTS
HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\PARALLEL PORTS
This key points to the control set and the driver information listed there.
PointerClass
HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\PointerClass
This key points to the control set and the driver information listed there.
PointerPort
HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\PointerPort
This key points to the control set and the driver information listed there.
SCSI
HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\SCSI
SCSI (Small Computer Systems Interface) is an adapter/device combination that allows tremendous growth and outstanding speed. The settings for all host adapters and devices are listed under this key.
SCSI Port 0 (ATAPI Hard Disk Controller)
HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\SCSI\SCSI Port 0
SCSI Port 0 is the first SCSI host device found in the system, and this key holds the identification and configuration information for it.
HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\SCSI\SCSI Port 0\SCSI Bus 0
HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\SCSI\SCSI Port 0\SCSI Bus 0\
Initiator Id Â255
HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\SCSI\SCSI Port 0\SCSI Bus 0\Target Id 0
There are no configurable devices connected to this adapter, so no settings are listed in this key.
HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\SCSI\SCSI Port 0\SCSI Bus 0\Target Id
Â0\Logical Unit Id 0
This key holds the settings for the SCSI ID number of the devices attached to the host adapter, and the description of the device.
SCSI Port 1 (ATAPI Floppy-Disk Controller)
HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\SCSI\SCSI Port 1
The floppy-disk controller is also considered a nonconfigurable SCSI device to Windows NT, using an IDE-to-SCSI conversion driver called ATAPI. This key holds all the settings for devices attached to the floppy controller.
HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\SCSI\SCSI Port 1\SCSI Bus 0
HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\SCSI\SCSI Port 1\SCSI Bus 0\Initiator Id
Â255
HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\SCSI\SCSI Port 1\SCSI Bus 0\Target Id 0
HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\SCSI\SCSI Port 1\SCSI Bus 0\Target Id
Â0\Logical Unit Id 0
SCSI Port 2 (AHA154x)
HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\SCSI\SCSI Port 2
This key is for the settings for the Adaptec 1542c SCSI host adapter, and all the devices connected to it. shows that there are three devices connected to this host adapter, and each has its own Target ID key below this key.
. Device connections to SCSI adapters.
HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\SCSI\SCSI Port 2\SCSI Bus 0
HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\SCSI\SCSI Port 2\SCSI Bus 0\Initiator Id 7
HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\SCSI\SCSI Port 2\SCSI Bus 0\Target Id 0
This is the key for the description and settings for the connected hard drive.
HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\SCSI\SCSI Port 2\SCSI Bus 0\Target Id 2
This is the key for the description and settings for the connected scanner.
HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\SCSI\SCSI Port 2\SCSI Bus 0\Target Id 3
This is the key for the description and settings for the connected Syquest removable media drive.
SERIALCOMM
HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\SERIALCOMM
This key lists the names of the installed serial ports.
VIDEO
HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\VIDEO
This key points to the control set and the driver information listed there.
OWNERMAP
HKEY_LOCAL_MACHINE\HARDWARE\OWNERMAP
When a device gives up all control to another, it is said to be owned. Those devices and their owners are listed in this key.
RESOURCEMAP
HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP
This key holds all the basic connection settings for devices on the system, such as IRQ, DMA, and I/O port addresses. They are separated into subkeys, depending on the type of control.
Hardware Abstraction Layer
HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\Hardware Abstraction Layer
The Hardware Abstraction Layer (HAL) separates the system devices from the software and operating system, ensuring that even in the worst application crashes, the operating system and base hardware continue to run.
The HAL is the way the standard devices are controlled, including parallel and serial ports, disk controllers, and others.
HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\Hardware Abstraction Layer\PC Compatible Eisa/Isa HAL
This key is the actual type of HAL for the system. There are several types, including PC compatible Eisa/Isa, DEC, MIPS, PowerPC, and Compaq. The values for this key are the actual settings for all the devices.
KeyboardPort/PointerPort
HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\KeyboardPort/PointerPort
The settings for the keyboard and pointer (PS/2 mouse) port are in this key.
i8042prt
HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\KeyboardPort/PointerPort\i8042prt
Standard keyboards use an 8042 controller chip. This key holds information about the chip, so the system does not have to read it off the keyboard BIOS.
LOADED PARALLEL DRIVER RESOURCES
HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\LOADED PARALLEL DRIVER RESOURCES
The parallel port drivers in use are listed here.
Parport
HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\LOADED PARALLEL DRIVER RESOURCES\Parport
Settings for the currently active parallel ports are listed in the values in this key. Settings made in Control Panel to change the parallel port name (LPT1, LPT2, and so on) or resources are listed here.
LOADED SERIAL DRIVER RESOURCES
HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\LOADED SERIAL DRIVER RESOURCES
The serial port drivers in use are listed here.
Serial
HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\LOADED SERIAL DRIVER RESOURCES\Serial
Settings for the currently active serial ports are listed in the values in this key. Settings made in Control Panel to change the serial port name (COM1, COM2, and so on) or resources are listed here.
OtherDrivers
HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\OtherDrivers
Other drivers that are not standard for system operations are listed here, so they can be recognized by the system.
Floppy
HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\OtherDrivers\Floppy
The floppy-drive controller driver settings are listed in this key.
PCI3210
HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\OtherDrivers\PCI3210
This key lists the settings for a PCI network card.
SCSIAdapter
HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\SCSIAdapter
SCSI adapters are listed in this key, so specific settings can be made for each one.
Aha154x
HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\SCSIAdapter\Aha154x
The Adaptec 1542C SCSI host adapter settings are listed in this key.
atapi
HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\SCSIAdapter\atapi
ATAPI is a driver that translates SCSI-level information for IDE and Enhanced IDE interface cards.
System Resources
HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\System Resources
Memory and virtual memory settings are listed in this key.
Physical Memory
HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\System Resources\Physical Memory
Memory that is reserved in the Reserved memory area is listed here.
VIDEO
HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\VIDEO
Video driver information for current drivers is listed in this key.
s3
HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\VIDEO\s3
The s3 video driver is the one to be used when the system boots. This key holds the settings for the video card.
VgaSave
HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\VIDEO\VgaSave
If the video driver is not able to work with the installed video card, the system switches to the driver listed here. The system also uses it if VGA mode is chosen during startup.
VgaStart
HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\VIDEO\VgaStart
The video driver information actually used during startup is listed here.
SAM
HKEY_LOCAL_MACHINE\SAM
This key is inaccessible from the Registry editors, and it points to information about all the users on the domain.
SECURITY
HKEY_LOCAL_MACHINE\SECURITY
All rights and privileges are included in this Registry setting, but it is inaccessible from the Registry editors.
SOFTWARE
HKEY_LOCAL_MACHINE\SOFTWARE
The settings for all installed 32-bit software and .INI files for applications are listed in this key. The items included vary, depending on the software installed. Control functions for those applications are listed in the many subkeys located here.
SYSTEM
HKEY_LOCAL_MACHINE\SYSTEM
This key stores all information required for the system to start, and for the recovery of the system in case of failure.
Clone
HKEY_LOCAL_MACHINE\SYSTEM\Clone
This subkey is a non-accessible section that holds duplicate information for use by the system in case of failure. This key is saved with RDISK.EXE and activated by Last Known Good, and points to the %SYSTEMROOT%\Repair directory.
ControlSet001
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001
This subkey contains descriptions and controls for device drivers and other services. Multiple sets are created when drivers are changed in the system, and are labeled ControlSet001, ControlSet002, and so on.
Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control
This subkey holds the information that is set in the Control Panel applets in Windows NT. Do not edit this information through the Registry editor because some applets make changes in more than one Registry location. A missing entry may cause the system to be unstable. The following list holds the subkeys under the Control key:
BootverificationProgram
Class
ComputerName
CrashControl
FileSystem
GraphicsDrivers
GroupOrderList
hivelist
IDConfigDB
Keyboard Layout
Keyboard Layouts
Lsa
MediaProperties
MediaResources
NetworkProvider
Nls
Print
PriorityControl
ProductOptions
RegistrySizeLimit
SecurePipeServers
SecurityProviders
ServiceGroupOrder
ServiceProvider
Session Manager
Setup
SystemBesources
TimeZoneInformation
Update
VirtualDeviceDrivers
Windows
WOW
Enum
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum
Bus enumerator information for Windows NT is added to the Registry during installation of the devices and Windows NT. It is not dynamic, and does not get changed. All the information is required to make NT and its devices start up.
HTREE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\HTREE
This subkey holds information and pointers to details about devices, including the driver names, based on bus connections. Devices are split between Legacy (ISA) and Plug and Play bus functions.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\HTREE\ROOT
This subkey simply holds the next subkey.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\HTREE\ROOT\0
The actual locations of the bus-connected devices and their driver information are listed here.
Root
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root
This key contains control information for ISA and PNP bus connections, using the drivers listed next. The information contained in the subkeys in the Root key (shown in the following list) is specifically related to the connection settings and resources:
*PNP030b
*PNP0F03
LEGACY_AFD
LEGACY_AHAl 54X
LEGACY_ASYNCMAC
LEGACY_ATAPI
LEGACY_BEEP
LEGACY_BROWSER
LEGACY_CDFS
LEGACY_CDROM
LEGACY_DISK
LEGACY_EEl6
LEGACY_FASTFAT
LEGACY_FLOPPY
LEGACY_FS_REC
LEGACY_KBDCLASS
LEGACY_KSECDD
LEGACY_LANMANSERVER
LEGACY_LANMANWORKSTATION
LEGACY_LMHOSTS
LEGACY_MESSENGER
LEGACY_MOUCLASS
LEGACY_MSFS
LEGACY_MUP
LEGACY_NBF
LEGACY_NDIS
LEGACY_NDISTAPI
LEGACY_NDISWAN
LEGACY_NETBIOS
LEGACY_NETBT
LEGACY_NETDETECT
LEGACY_NETLOGON
LEGACY_NPFS
LEGACY_NULL
LEGACY_NWLNKIPX
LEGACY_NWLNKNB
LEGACY_NWLNKSPX
LEGACY_PARALLEL
LEGACY_PARPORT
LEGACY_PARVDM
LEGACY_PCI3210
LEGACY_RASACD
LEGACY_RASARP
LEGACY_RASAUTO
LEGACY_RASMAN
LEGACY_RDR
LEGACY_RPCSS
LEGACY_S3
LEGACY_SCSISCAN
LEGACY_SERIAL
LEGACY_SNDBLST
LEGACY_SPOOLER
LEGACY_SRV
LEGACY_TAPISRV
LEGACY_TCPIP
LEGACY_VGASAVE
UNIMODEM5DC8F5BA
Hardware Profiles
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles
Hardware profiles allow the user to select what hardware will be active after boot. Hardware profiles are normally used for notebooks or other portable systems, where the active/installed hardware may be different. For example, a notebook connected at the office might have a docking station with a network card, a SCSI tape drive, and external monitor and mouse. Different drivers would be required to run that system than when the notebook was detached from these features. Hardware profiles also prevent the system from trying to load all of those drivers when the system is not connected. All controls for hardware profiles are under this key.
0001
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001
The first set of drivers, shown at startup as the Original Configuration, is listed as profile 0001.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001\Software
Software associated with specific devices that may not be connected with another profile is listed here. Software is only listed here if it is affected by another profile.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001\System
System information that is unique to profile 0001 is listed here.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001\System\
CurrentControlSet
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001\System\
CurrentControlSet\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001\System\
CurrentControlSet\Enum
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001\System\
CurrentControlSet\Services
0002
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0002
Profile 0002 is the second profile created for NT. The first (0001) was done during installation. This second profile uses different drivers and settings required for a different hardware setup. The type of information in the following keys mirrors the information that is in hardware profile 0001.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0002\Software
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0002\System
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0002\System\
CurrentControlSet
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0002\System\
CurrentControlSet\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0002\System\
CurrentControlSet\Enum
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0002\System\
CurrentControlSet\Services
Current
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\Current
This key contains the profiles that are actually current in the system. The choice made during startup affects which of the two (or more) hardware profiles is current. For example, if Profile 0002 is chosen, all of the Profile 0002 information will be mapped into these keys.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\Current\Software
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\Current\System
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\Current\System\
CurrentControlSet
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\Current\System\
CurrentControlSet\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\Current\System\
CurrentControlSet\Enum
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\Current\System\
CurrentControlSet\Services
Services
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services
This key contains all the standard services that come with Windows NT, plus any that have been added through the installation of services or devices. Each standard Services key (shown in the following list) contains configuration and identification settings.
Abiosdsk ClipSrv Jazzg300
Afd Cpqarray Jazzg364
Aha154x cpqfws2e Jzvxl484
Aha174x dac960nt Kbdclass
aic78xx dce376nt KSecDD
Alerter Dell_DGX LanmanServer
Always Delldsa LanmanWorkstation
ami0nt DHCP LmHosts
amsint Disk Messenger
Arrow Diskperf mga
AsyncMac DptSCSI mga_mil
AsyncMac3 dtc329x mitsumi
atapi et4000 mkecr5xx
Atdisk EventLog Modem
ati Fastfat Mouclass
Beep Fd16_700 Msfs
Browser Fd7000ex Mup
BusLogic Fd8xx Nbf
Busmouse flashpnt Ncr53c9x
Cdaudio Floppy ncr77c22
Cdfs Fs_Rec Ncrc700
Cdrom Ftdisk Ncrc7l0
Changer i8042prt NDIS
cirrus Inport NdisTapi
NdisWan Pcmcia Sparrow
NdisWan2 PlugPlay Spock
NdisWan4 pnpisa Spooler
NdisWan5 psidisp symc810
NdisWan6 0I10wnt T128
NetBIOS qv T13B
NetBIOSInformation RasAcd TapiSrv
NetBT RasArp Tcpip
NetDDE RasAuto tga
NetDDEdsdm RasMan tmv1
NetDetect Rdr Ultral24
Netlogon RemoteAccess Ultra14f
Npfs Replictor Ultra24f
Ntfs RPCLOCATOR UPS
NtLmSsp RpcSs v7vrarn
Null s3 VgaSave
NwlnkIpx Schedule VgaStart
NwlnkNb SCSIprnt Wd33c93
NwlnkSpx SCSIscan wd90c24a
Oliscsi Serial wdvga
Parallel Sermouse weitekp9
Parport Sfloppy WinSock
ParVdm Simbad WinSock2
PCI3210 slcd32 WinTrust
PCI32101 sndblst Xga
PCIDump SNMP
ControlSet002
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002
When drivers are changed, if no other control set has the same drivers and information, an additional one is created with an incremental number such as ControlSet002. If a control set with the same drivers exists, that one is used instead.
CurrentControlSet
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet
The control set (listed previously) currently in use is mapped into all the keys listed next at startup.
The control set used is mapped to CurrentControlSet.
Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control
This is mapped information from a specific control set (such as ControlSet001).
Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum
This is mapped information from a specific control set (such as ControlSet001).
Hardware Profiles
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles
This is mapped information from a specific control set (such as ControlSet001).
Services
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
This is mapped information from a specific control set (such as ControlSet001).
Select
HKEY_LOCAL_MACHINE\SYSTEM\Select
This key lists the current control set, which is saved as Last Known Good. This key also lists which control sets, if any, failed during startup.
Setup
HKEY_LOCAL_MACHINE\SYSTEM\Setup
This key lists the system partition, the setup status, and other information about the setup process for the system.
Summary
HKEY_LOCAL_MACHINE holds all the filename, file-location, and setting information for the entire system, and all its attached devices. It is updated by the Control Panel, by the installation of devices, and through utilities such as Windows NT Diagnostics. HKEY_LOCAL_MACHINE is protected by Last Known Good and the Emergency Repair Disk because of the critical nature of the contained Registry settings.
By Jahanzeb Khan Nartopa Hazro
