Figure 7.8: An example of the contents of the DeviceN nested key for the device driver
subkey under HKEY_LOCAL_MACHINE\SYSTEM\ControlSetnnn\Services
Depending on the video driver implementation, this key may contain a variety of
parameters, including the VgaCompatible standard setting, which is set to FALSE for
most modern drivers. If the parameter is set to FALSE, the driver is based on the MS
VGA miniport driver.
The following REG_BINARY settings under the
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Video\{56652C39-
3E1C-4A83-AD68-1CF58F0EDEE9}\0000:
HardwareInformation.AdapterString,
HardwareInformation.BiosString,
HardwareInformation.ChipType,
HardwareInformation.Crc32,
HardwareInformation.DacType
HardwareInformation.MemorySize
contain hardware information displayed by administrative utilities. Notice that similar
settings are also present in Windows NT/2000 registries, but under different locations.
When Windows GUI starts, the system reads the video settings contained under the
following registry key (Fig. 7.9
):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Hardware Profiles\Current\System\CurrentControlSet\Control\VIDEO\
{56652C39-3E1C-4A83-AD68-1CF58F0EDEE9}\0000

Figure 7.9: Registry settings that specify the video mode
After reading these settings, the system checks whether the display driver supporting the
specified mode is present. As soon as the appropriate driver has been found, the startup
procedure continues. What happens, though, if the system can't find an appropriate
driver? The answer's simple: the system will use standard VGA mode (16 colors).
Thus, we have considered the usage of the

HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\PnP
Manager\PnpManager.

Figure 7.10: The RESOURCEMAP key in Windows XP/Windows Server 2003
The HKEY_LOCAL_MACHINE\SAM Key
For computers that are not joined to a domain, the HKEY_LOCAL_MACHINE\SAM
registry key contains information on local user and group accounts stored in the directory
database (which was formerly known as the SAM database). For Windows 2000 Server
and Windows Server 2003 computers joined to a domain, this key also contains security
data for domain users and groups.
This key references the HKEY_LOCAL_MACHINE\Security\SAM key, and any
modification introduced into one of these keys is immediately introduced into another
one.

Note Starting with Windows 2000, domain controllers both in Windows 2000 and
Windows Server 2003 domains store security data in the Active Directory database
file (Ntds.dit). However, SAM database is still preserved for storing local security
information on servers that are not joined to a domain, as well as for backward
compatibility with the existing Windows NT 4.0 domains. Besides this, it is used
for restoring Active Directory information when the user selects the Directory
Services Restore Mode (Windows domain controllers only option from the
Windows Advanced Startup Options menu during system boot.
Default security settings both in Windows 2000 Server and in Windows Server 2003
prevent users (even those with administrative permissions) from viewing the contents of
this registry key. More detailed information on this topic will be provided in Chapter 9
.
The HKEY_LOCAL_MACHINE\SECURITY Key
The HKEY_LOCAL_MACHINE\SECURITY registry key contains information about
the security subsystem on the local computer, including user rights and permissions,
password policies, and local group membership. All of this information is specified using

local computers with file types (identified by filename extensions). These subkeys
contain data that you can add using the File Types tab of the Folder Options
window, as well as information added by the Setup programs that install Windows
applications.

<Class-definition> subkeys. These subkeys contain information associated with
COM objects. The data contained within these keys specify the shell and OLE
(COM) properties for specific objects. If the application supports DDE (Dynamic
Data Exchange), the Shell subkey may, in turn, contain other subkeys such as
Open and Print. The subkeys define DDE commands for opening and printing
files. Notice that the information contained under these keys is very similar to that
which is stored in the registry database of previous Windows versions, such as
Windows 3.1x.

Note The COM object information contained in the registry must be created by an
application supporting COM. Direct registry editing can't be considered the easiest
method of editing the information. If you need to perform this task in Windows NT
4.0, select the Options command from the View menu in Windows NT Explorer,
then go to the File Types tab of the Options dialog. If you need to perform the
same task in Windows 2000, Windows XP, or one of the Windows Server 2003
products, start the Folder Options applet from the Control Panel, or select the
Folder Options command from the Tools menu in Windows Explorer; then go to
the File Types tab in the Folder Options window.
The Description Subkeys
The HKEY_LOCAL_MACHINE\Software\Description keys contain names and version
numbers of the software installed on the local computer. (Configuration settings specified
for individual users are stored under HKEY_CURRENT_USER.)
During installation, applications register this information in the following form: