# Windows Registry
The Windows Registry is a hierarchical database in which the Windows operating system, its applications, and its services store configuration data that is critical to their operation.[1](https://learn.microsoft.com/windows/win32/sysinfo/structure-of-the-registry/) It replaced the scattered INI files of earlier Windows versions with a single, typed, tree-structured store that programs read and write through a standard API.[5](https://www.registryparser.com/en/blog/windows-registry-history) • [6](https://www.bitsavers.org/pdf/microsoft/windows_95/Introducing_Microsoft_Windows_95_1995.pdf)
| Key fact | Detail |
|---|---|
| Structure | A hierarchy of keys, each of which can contain subkeys and data entries called values; each value has a name and associated data[1](https://learn.microsoft.com/windows/win32/sysinfo/structure-of-the-registry/) |
| First appeared | Windows 3.1, released in 1992[7](https://projectzero.google/2024/04/the-windows-registry-adventure-2.html) |
| Role in Windows 95 | The central configuration store for user, application, and computer-specific information, replacing the INI files of Windows 3.1[6](https://www.bitsavers.org/pdf/microsoft/windows_95/Introducing_Microsoft_Windows_95_1995.pdf) |
| Hive files | Supporting files for all hives except HKEY_CURRENT_USER are stored in `%SystemRoot%\System32\Config` on Windows NT 4.0 through Windows Vista[2](https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/windows-registry-advanced-users) |
| 32-bit on 64-bit Windows | 32-bit keys are displayed under `HKEY_LOCAL_MACHINE\Software\WOW6432Node` by the 64-bit Registry Editor[2](https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/windows-registry-advanced-users) |
| File format | A proprietary binary format (regf on NT-based systems) for which Microsoft has never officially published a specification[7](https://projectzero.google/2024/04/the-windows-registry-adventure-2.html) • [11](https://www.kandibrian.com/articles/windows-registry-forensic-analysis.html) |
| Editing tools | Registry Editor (regedit), the `reg` command-line utility, and PowerShell, which exposes hives as drives such as `HKCU:`[3](https://learn.microsoft.com/en-us/powershell/scripting/samples/working-with-registry-keys?view=powershell-7.6) • [9](https://learn.microsoft.com/th-th/windows/advanced-settings/developer-mode?view=aspnetcore-2.1) |
## Structure
The registry is organized as a tree. Each key can contain both subkeys and data entries called values, and each value consists of a value name and its associated data, if any.[1](https://learn.microsoft.com/windows/win32/sysinfo/structure-of-the-registry/) The tree is rooted in a small number of top-level subtrees, such as HKEY_LOCAL_MACHINE for machine-wide settings and HKEY_CURRENT_USER for the settings of the logged-on user.[2](https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/windows-registry-advanced-users) • [3](https://learn.microsoft.com/en-us/powershell/scripting/samples/working-with-registry-keys?view=powershell-7.6)
**Hives.** A registry hive is a group of keys, subkeys, and values that has a set of supporting files containing backups of its data. On [Windows NT 4.0](https://www.edgepedia.org/windows-nt-4-0), [Windows 2000](https://www.edgepedia.org/windows-2000), [Windows XP](https://www.edgepedia.org/windows-xp), Windows Server 2003, and Windows Vista, the supporting files for all hives except HKEY_CURRENT_USER are stored in the `%SystemRoot%\System32\Config` folder; HKEY_LOCAL_MACHINE\SECURITY, for example, is backed by the file `\system32\config\security`.[2](https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/windows-registry-advanced-users) • [14](https://learn.ztu.edu.ua/pluginfile.php/413918/mod_resource/content/1/Windows%20Forensics%20Understand%20Analysis%20Techniques%20for%20Your%20Windows.pdf)
On 64-bit versions of Windows, the default 64-bit Registry Editor displays 32-bit keys under the node `HKEY_LOCAL_MACHINE\Software\WOW6432Node`, separating the configuration of 32-bit applications from their 64-bit counterparts.[2](https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/windows-registry-advanced-users)
## History
The first thing to call itself the registry appeared in [Windows 3.1](https://www.edgepedia.org/windows-3-1), released in 1992.
The registry reached its recognizable modern form in two 1990s releases. [Windows 95](https://www.edgepedia.org/windows-95) used it as the central configuration store for user, application, and computer-specific information, a hierarchical database storing system-wide information in a single location in place of the INI files used in Windows 3.1.[6](https://www.bitsavers.org/pdf/microsoft/windows_95/Introducing_Microsoft_Windows_95_1995.pdf) In parallel, the [Windows NT](https://www.edgepedia.org/windows-nt) line adopted the regf file format: pre-release builds of [Windows NT 3.1](https://www.edgepedia.org/windows-nt-3-1) used regf v1.0, the Windows NT 3.1 release used regf v1.1, and Windows NT 3.5 and 3.51 used regf v1.2.[7](https://projectzero.google/2024/04/the-windows-registry-adventure-2.html)
The registry's design answered several problems of the INI-file era at once: typed values, a per-machine versus per-user split, a store the kernel could keep consistent, and a single programmatic API that tooling and administrators could target.[5](https://www.registryparser.com/en/blog/windows-registry-history)
## Editing and administration
Administrators and applications modify the registry through several interfaces. The Registry Editor (regedit) displays the key structure graphically and is the tool most users encounter; the `reg` command can add values directly, for example `reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" /t REG_DWORD /f /v "AllowAllTrustedApps" /d "1"`.[9](https://learn.microsoft.com/th-th/windows/advanced-settings/developer-mode?view=aspnetcore-2.1) Settings packaged as .reg files can be applied manually or through a logon script.[2](https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/windows-registry-advanced-users)
PowerShell treats the registry as a set of drives: `HKCU:` corresponds to the HKEY_CURRENT_USER hive, and cmdlets such as `Get-ChildItem` and `Copy-Item` can list, filter, and copy keys. A copy of a key made this way does not include the subkeys contained in the original.[3](https://learn.microsoft.com/en-us/powershell/scripting/samples/working-with-registry-keys?view=powershell-7.6)
Registry edits remain a routine part of Windows servicing and troubleshooting. Microsoft's own guidance for recent releases directs administrators to registry paths such as `HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MachineIdentityIsolation` when working around known issues, and to registry keys for [Secure Boot](https://www.edgepedia.org/secure-boot) certificate updates on IT-managed devices.[4](https://support.microsoft.com/en-us/servicing/os/secure-boot/2025/09/registry-key-updates-for-secure-boot-windows-devices-with-it-managed-updates) • [8](https://learn.microsoft.com/windows/release-health/status-windows-11-26H2)
## Forensic use
Because the registry records configuration, user activity, and system state, hive files are among the richest data sources available to a forensic investigator. Analysis covers user activity, program execution, USB device history, and malware persistence mechanisms.[11](https://www.kandibrian.com/articles/windows-registry-forensic-analysis.html) Hive files use a proprietary binary format for which Microsoft has never officially published a specification, although the structures are effectively public through PDB kernel symbols and independent reverse-engineering efforts.[11](https://www.kandibrian.com/articles/windows-registry-forensic-analysis.html) Dedicated tools parse hives to extract forensic artifacts and security-relevant information,[10](https://cursed.tools/docs/modules/windows/registry-hive-analyzer) and registry data is one of the independent artifacts that forensic frameworks check for corroboration against sources such as Prefetch and event logs.[12](https://github.com/Gear-I/Corrobora) Registry recovery is also one of the five areas defined by the digital forensics tool-testing program used in benchmarking frameworks for forensic software.[13](https://arxiv.org/abs/2512.16965)
## Backup behavior
Through [Windows 11](https://www.edgepedia.org/windows-11) version 1803, each successful boot prompted the system to save a registry copy automatically in the "RegBack" folder; current versions no longer perform this automatic backup.[15](https://www.windowscentral.com/software-apps/windows-11/6-registry-tweaks-every-tech-savvy-user-must-apply-on-windows-11)
## References
1. [Structure of the Registry, Win32 apps, Microsoft Learn](https://learn.microsoft.com/windows/win32/sysinfo/structure-of-the-registry/)
2. [Windows registry for advanced users, Windows Server, Microsoft Learn](https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/windows-registry-advanced-users)
3. [Working with registry keys, PowerShell, Microsoft Learn](https://learn.microsoft.com/en-us/powershell/scripting/samples/working-with-registry-keys?view=powershell-7.6)
4. [Registry key updates for Secure Boot: Windows devices with IT-managed updates, Microsoft Support](https://support.microsoft.com/en-us/servicing/os/secure-boot/2025/09/registry-key-updates-for-secure-boot-windows-devices-with-it-managed-updates)
5. [A short history of the Windows Registry, and why it still matters, Registry Parser](https://www.registryparser.com/en/blog/windows-registry-history)
6. [Introducing Microsoft Windows 95 (1995), bitsavers](https://www.bitsavers.org/pdf/microsoft/windows_95/Introducing_Microsoft_Windows_95_1995.pdf)
7. [The Windows Registry Adventure #2: A brief history of the feature, Google Project Zero](https://projectzero.google/2024/04/the-windows-registry-adventure-2.html)
8. [Windows 11, version 26H2 known issues and notifications, Microsoft Learn](https://learn.microsoft.com/windows/release-health/status-windows-11-26H2)
9. [Settings for developers, Microsoft Learn](https://learn.microsoft.com/th-th/windows/advanced-settings/developer-mode?view=aspnetcore-2.1)
10. [Registry Hive Analyzer, Cursed Tools](https://cursed.tools/docs/modules/windows/registry-hive-analyzer)
11. [Windows Registry Forensic Analysis: User Activity, Execution, USB, and Persistence, Kandi Brian](https://www.kandibrian.com/articles/windows-registry-forensic-analysis.html)
12. [Corrobora: Open-source Windows forensics framework, GitHub](https://github.com/Gear-I/Corrobora)
13. [AutoDFBench 1.0: A Benchmarking Framework for Digital Forensic Tool Testing, arXiv](https://arxiv.org/abs/2512.16965)
14. [Windows Forensics: Understand Analysis Techniques, ZTU](https://learn.ztu.edu.ua/pluginfile.php/413918/mod_resource/content/1/Windows%20Forensics%20Understand%20Analysis%20Techniques%20for%20Your%20Windows.pdf)
15. [6 registry tweaks every tech-savvy user must apply on Windows 11, Windows Central](https://www.windowscentral.com/software-apps/windows-11/6-registry-tweaks-every-tech-savvy-user-must-apply-on-windows-11)
---
*Topic: Encyclopedia › Technology and the built world › Computing and digital systems › Software and programming › Operating systems › Microsoft Windows*
*Initially written Sep 17, 2026 · Reviewed: Sep 17, 2026; Oct 15, 2026 · Edited: Oct 15, 2026 · Last review: Oct 15, 2026*
*Copyright 2026 EdgeChat AI, a subsidiary of Biostate AI.*
License: Edgepedia Community License 1.0, https://www.edgepedia.org/edgepedia/license