The Registry 2: Control Sets
In this series covering The Registry, this, the second article, concentrateson the Control Sets, and attempts to explain what each of the Control Sets are and how they interact, as well ashow to safely work with them.
|
Caution: Editing the registry can be extremely dangerous and candisrupt your system to the point where your only option is to re-install Windows NT. |
Refer to the article Registry:Basics for information on safe handling of the registry.
What Control Sets Are
The Control Sets contain the parameters for the systems services anddevices. They are located in HKEY_LOCAL_MACHINE \SYSTEM. You will probably have two of the numbered sets (ControlSet001and ControlSet002), though you may have as many as four, and you will always have CurrentControlSet, which is alink to the numbered set that contains the data set currently in use.
What Control Sets Are For
When the system starts, the numbered set used (usually ControlSet001)is copied into HKEY_LOCAL_MACHINE \SYSTEM \Clone, and CurrentControlSet is linked to that numbered set. The copyin \Clone also replaces the LastKnownGood configuration, once the startup is declared "good" (generallymeaning there were no Severe or Critical errors, and a successful logon was done). This is a very important datum.If you botch your registry changes, you can revert them by:
- Rebooting immediately
- Selecting the operating system to boot to
- Invoking the Configuration Recovery menu
- Selecting Last Known Good
Any changes you made since the last "good" startup willvanish. You can also save your configuration any time you choose, as described in the article Safety under the section Boot Configuration . With this option, you can "lockin" a known good configuration which you can go back to any time you want. Please do not assume this meansyou dont need to back up the registry; a backup is the only certain way to be safe.
HKEY_LOCAL_MACHINE \SYSTEM \Select contains the value entries Current,Default, Failed and LastKnownGood. Their values are the corresponding numbered sets. For example, you will probablysee Current and Default as "REG_DWORD: 0x1". This means ControlSet001 is the default set and is the setcurrently in use. The value "0x2" refers to ControlSet002, and so on. If you have never had a failedboot, Failed will be "REG_DWORD: 0". While you can manually set LastKnownGood to any existing ControlSet, this is not recommended because if you make a mistake in this setting, you wont be able to select an alternateboot. If your default boot then fails, youll have to do an emergency repair and may have to re-install WindowsNT! Its best to let Windows NT handle this default.
The Control Sub-Key
Each Control Set has the sub-keys \Control (for controlling the system)and \Services (for controlling the services). \Control contains parameters necessary for the system to start. Whilemost of these parameters are controlled through utilities in Control Panel, this is where most "tweaking"would be done.
There are several sections here that you should leave alone, specifically,\Lsa, \ProductOptions, \VirtualDeviceDrivers and \WOW. Changes to these can prevent the system from starting orrunning or make it impossible for anyone to log in, so let the system maintain these. There are two others, \HiveList(paths to the registry files) and \Windows (paths to the Windows NT and System folders). Dont fool with these either,but theoretically you could make some changes here that would allow you to move files off the system partitionin an emergency (for example, if you run out of free space). We are doing some experiments on a test system, andwill report anything useful, but any changes here will certainly interfere with an operating system upgrade orService Pack installation. Play it safe, and dont change these unless you absolutely must.
The Other Control Set Sub-Keys
Services contains data on drivers and on their associated hardware.
You maintain this data from Control Panel, using the Devices, Network,Services and UPS icons. We have never had a need to make changes manually, except for deleting keys while manuallyuninstalling an application when Add/Remove Programs fails.
\Hardware contains five entries, 001 through 004 and Current, whichcorrespond to ControlSets. These contain data defining hardware that is run by drivers listed in \Services. Theseare also maintained entirely from Control Panel.
\Enum. This shows up on our machine, but we have not been able tofind any references to it.
HKEY_CURRENT_CONFIG - Points to a subset of CurrentControlSet (asdescribed above), containing the current configuration.
By now you should have a good understanding of what we are dealingwith. The next few articles will start on details: What specific value entries there are, what they mean and howyou can use them to tune your system. Do you have your registry backup tools ready?
If you have any comments about this article orany requests for new technical articles e-mail
Executive Software Europe
