Chapter 15 Windows Under the HOOD

Page 1

In this chapter, you will learn

how to

■ Work with the Registry

■ Understand and observe in detail

the Windows boot process

■ Control processes and services

■ Explore Windows tools for

programmers

the Registry is a huge database that stores everything about your PC,

including information on all of the hardware in the PC, network information,

user preferences, file types, and virtually anything else you might run

into with Windows.

Almost any form of configuration you do to a Windows

system involves editing the Registry. Every version of Windows stores the

numerous Registry files (called hives) in the \%SystemRoot%\System32\

config folder and each user account folder.

Fortunately, you rarely have to

access these massive files directly. Instead, you can use a set of relatively

tech-friendly applications to edit the Registry

You might see either regedit

or regedt32 on the exam as

the way to access the Registry

Editor

access it by the command prompt.

The Registry is organized in a tree structure similar to the folders in the

PC::

root keys:

■ HKEY_CLASSES_ROOT

■ HKEY_CURRENT_USER

■ HKEY_USERS

■HKEY_LOCAL_MACHINE

■ HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER: Windows is designed to support more than one user on the same PC, storing personalized information such as desktop colors, screensavers, and contents of the desktop for every user that has an account on the system

HKEY_USERS: stores all of the personalized information for all users on a PC

HKEY_LOCAL_MACHINE: This root key contains all the data for a system’s non-user-specific configurations. This encompasses every device and every program in your PC. HKEY_LOCAL_MACHINE is abbreviated as HKLM. You will see this abbreviation on the exam!

HKEY_CURRENT_CONFIG: If the values in HKEY_LOCAL_MACHINE have more than one option, such as two different monitors, this root key defines which one is currently being used. Because most people have only one type of monitor and similar equipment, this area is almost never touched.

Values must have a defined type of data they store:

String value■■ These are the most flexible type of value and are very common. You can put any form of data in these.

Binary value■■ These values store nothing more than long strings of ones and zeros.

DWORD value■■ These values are like Binary values but are limited to exactly 32 bits.

QWORD value■■ These values are like Binary values but are limited to exactly 64 bits.

Manual Registry Edit::: To prevent these problems, always make a backup of the Registry before you change anything. Once the backup is in a safe place (I like to use a thumb drive, personally), reboot the system to see if the changes you made had the desired result. If it worked, great. If not, you’ll need to restore the old Registry settings using your backup. Let’s watch this in action.

One of the more common manual Registry edits is to delete autostarting programs.

The Boot Process::::

Booting Windows XP differs dramatically from booting Windows Vista/7

Windows XP was the last Microsoft operating system to use a very old boot process known as ntldr (NT Loader)

Windows Vista introduced the far more flexible, complex, and powerful Windows Boot Manager (or bootmgr), which Windows 7 also use

The Windows XP Boot Process:: Windows XP distinguishes between the files that start the operating system (called the system files) and the rest of the operating system files (by default in the \Windows folders). The system files (memorize these!) consist of three required files: ntldr, boot.ini, and ntdetect.com. If you’re using a SCSI hard drive, there’s a fourth file called ntbootdd.sys. The ntldr (pronounced NT loader) file begins the boot process.

ntldr

boot.ini

ntdetect.com

The Windows Task Manager ( taskmgr ) is the one-stop-shop for anything you need to do with applications, processes, and, if you’re using Windows Vista or Windows 7, services (see Figure 15.11).