The registry is a simple, hierarchical database of information that Windows operating systems and some applications use to define the configuration of the system. For Windows XP, it's the registry that is most important to the system, because it contains the heart and soul of Windows XP. Without the registry, Windows XP would be nothing more than a collection of programs, unable to perform even the basic tasks that we expect from an operating system.
However, times are a-changing. Microsoft now realizes that if every application stores application-specific information in the system registry, then the system registry can grow to an enormous size. That isn't quite what Microsoft had in mind when they created the registry structure. Microsoft's policy now states that applications may (and should) use standalone .ini files as needed.
The registry is a tree-based hierarchical system that offers quick access to data stored in almost any format. Actually, the registry is a rather flexible database. Every component of Windows XP uses the registry, without exception. Windows XP starts to use the registry at the very beginning stages of system bootup.
The Windows XP boot process consists of the following steps:
1. The system is powered up, the video is initialized, and the hardware self-tests are performed. The BIOS performs these tests, which are called POSTs (power-on selftests). Usually, the memory test is the most visible one; its progress is shown on most computer screens.
2. After running POST, the system initializes each adapter. If the adapter has its own built-in BIOS, the adapter's BIOS is called to perform its own initialization. For IDE adapters (most computers have either two or four IDE adapters), each connected drive (there may be up to two drives for each IDE adapter, allowing for a total maximum of eight IDE type drives) is queried for its specifications and access method. Some adapters, such as Adaptec's SCSI adapters, display messages and allow the user to interact. Some adapters that don't have a BIOS aren't initialized until Windows XP loads their drivers much later in the boot-up process.
3. After all the adapters that have a BIOS have been initialized, the system boot loader reads in the sector located at the very beginning of the first bootable disk drive and passes commands to this code. This sector is called the boot sector, or the MBR (Master Boot Record), and it is written by the operating system when the operating system is installed.
4. The code in the MBR then loads the NTLDR file. (This file has no extension, though it is an executable file.) Once loaded, the MBR passes control to the code in NTLDR.
5. NTLDR then switches into 32-bit mode. (Remember, an Intel x86 processor always boots into 16-bit real mode.) It then loads a special copy of the necessary file system I/O files and reads in the file boot.ini.
6. The file boot.ini has information about each operating system that can be loaded. Remember, Windows XP supports multiboot configurations. It is trivial to create a Windows XP installation that can boot Windows NT, Windows XP, and Windows 95 or Windows 98. The boot loader can even boot two different copies of Windows XP with either the same or different version numbers. NTLDR then processes boot.ini, displaying boot information that allows the user to select which operating system will be loaded. At this point, let's assume that Windows XP will be loaded.
7. When you select Windows XP to be loaded, NTLDR loads the file ntdetect.com. This program then collects information about the currently installed hardware and saves this information for the registry. Most of this information is stored in the HKEY_LOCAL_MACHINE hive.
8. Once NTDETECT has detected the hardware, control is passed back to NTLDR, and the boot process continues. At this point, the registry has been substantially updated with the current hardware configuration, which is stored in HKEY_LOCAL_MACHINE\Hardware.
9. The prompt to select the configuration is then presented. This prompt, "Press spacebar now to invoke Hardware Profile/Last Known Good menu," allows you to force Windows XP to use a specific configuration as stored in the registry hive HKEY_LOCAL_MACHINE.
10. Following the detection of NTDETECT, NTLDR loads and initializes the Windows NT kernel, loads the services, and then starts Windows.
11. When the kernel is loaded, the HAL is also loaded. (The HAL—Hardware Abstraction Layer—is used to manage hardware services.) Next, the registry system subkey HKEY_LOCAL_MACHINE\_System is loaded into memory. Windows XP scans the registry for all drivers with a start value of zero. This includes those drivers that should be loaded and initialized at boot time.
12. You can see the beginning of the next stage, kernel initialization. The screen switches to a blue background, and you see a message about the Windows XP build number and the number of system processors. Again, the system scans the registry and finds all drivers that must be started at the kernel initialization stage.
13. From this point, Windows XP starts various components and systems. Each component and system reads the registry and performs various tasks and functions. In the final stage, the program that manages the user logon, WinLogon, starts. WinLogon allows the user to log on and use Windows XP.
Once Windows XP is booted, both the operating system and applications use the registry. The registry is dynamic, but usage of the registry may be dynamic or static. That is, some registry items are read one time and never reread until the system is restarted. Other items are read every time they are referenced.