Jump to content

How installation values relate to registry and environment variables


Recommended Posts

Trying to make the connections in in the subject line, I note that some installation values have relatively clear connections to the registry, others are obscure at best. An obvious example in the middle of those extremes is the registry (and environment) value SystemRoot, which seems to be derived from the installation values SystemDrive (from $OEM$ $1) and TargetPath (from WinNT.SIF). Is that inference correct? If not, how is SystemRoot derived?

Bonus question for that example: Where is SystemDrive defined in the registry? It is used in the registry as value data (i.e., %SystemDrive% as part of a larger string), but I can't find it as a value defined under any key - yet the value is used often in the registry and is passed to the environment. Anyone know how this works?

Related question: I have been able to identify the source of many environment variables in the registry under these keys;


HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion (SystemRoot)
HKLM\SYSTEM\CurrentControlSet\Control\SessionManager\Environment (Comspec, OS, Path, PATHEXT, windir)
HKCU\Environment (TEMP, TMP)
HKCU\Volatile Environment (APPDATA, HOMEDRIVE, HOMEPATH, LOGONSERVER, SESSIONNAME)

But that still leaves environment variables that I don't find defined in the registry (like SystemDrive) and strings like USERDOMAIN and USERPROFILE that aren't even used in the registry. Where and how are these stored?

Link to comment
Share on other sites


According to http://support.microsoft.com/kb/104011, and http://stackoverflow.com/questions/573817/where-are-environment-variables-stored-in-registry, and http://best-windows.vlaurie.com/environment-variables.html, for XP:

User environment variables are stored in the Registry in the key:

HKEY_CURRENT_USER\Environment

System variables are found in the key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment

Note that any environment variable that is in the form that needs to be expanded (for example, %PATH%) must be stored in the registry as a REG_EXPAND_SZ registry value. Editing the Registry is primarily for scripts used by systems administrators and is not recommended for the average PC user.

Cheers and Regards

Link to comment
Share on other sites

But that still leaves environment variables that I don't find defined in the registry (like SystemDrive) and strings like USERDOMAIN and USERPROFILE that aren't even used in the registry. Where and how are these stored?

I guess you will have to "dirty your hands" with SID's, those are created "on-the-fly" at logon.

See (as an example):

http://www.raygibson.net/kb/profile_migration/

The actual values are stored in

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

See:

http://blogs.technet.com/b/heyscriptingguy/archive/2007/01/23/how-can-i-get-the-name-of-the-last-user-to-log-on-to-a-computer.aspx

This may be of use as a quick reference:

http://www.scriptlogic.com/support/CustomScripts/environmentVariableReference.html

jaclaz

Link to comment
Share on other sites

According to http://support.microsoft.com/kb/104011, and http://stackoverflow.com/questions/573817/where-are-environment-variables-stored-in-registry, and http://best-windows.vlaurie.com/environment-variables.html, for XP:

User environment variables are stored in the Registry in the key:

HKEY_CURRENT_USER\Environment

System variables are found in the key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment

...

Thanks, but I think that's pretty close to what I said, except that the original post was a bit more complete. For example, while HKCU\Environment provides only TEMP and TMP, quite a few variables are provided from HKCU\Volatile Environment (APPDATA, HOMEDRIVE, HOMEPATH, LOGONSERVER, SESSIONNAME), and SystemRoot is apparently provided from HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion -- and then there are the environment variables that are used but not defined in the registry, as well as environment variables that do not even appear in the registry.

My questions were (and remain):

1) How do the installation values connect to the registry values? How are those registry values (like SystemRoot) derived from the installation values?

2) Where is SystemDrive defined in the registry? How is it derived from the installation?

3) For all of the registry values that are not found in

HKCU\Environment
HKLM\SYSTEM\CurrentControlSet\Control\SessionManager\Environment

or even in

HKCU\Volatile Environment
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion

- and for those environment variables that are not defined in the registry, and those that do not even appear in the registry, how do they get to the environment? How and where are they stored?

Any idea where to look for those answers? - where to find documentation on such cases?

Regards,

John

Link to comment
Share on other sites

But that still leaves environment variables that I don't find defined in the registry (like SystemDrive) and strings like USERDOMAIN and USERPROFILE that aren't even used in the registry. Where and how are these stored?

I guess you will have to "dirty your hands" with SID's, those are created "on-the-fly" at logon.

See (as an example):

http://www.raygibson.net/kb/profile_migration/

That was a great read - thanks! - but i don't see how it addresses the connection of installation settings to registry values, or registry values to environment variables. Did I miss something?

The actual values are stored in

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

See:

http://blogs.technet.com/b/heyscriptingguy/archive/2007/01/23/how-can-i-get-the-name-of-the-last-user-to-log-on-to-a-computer.aspx

That was also interesting. So the environment gets USERNAME from "DefaultUserName" and USERDOMAIN from "DefaultUserDomain"? - and those in turn are passed to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon from the SID? For example, "DefaulttUserName" comes from "Logon User Name" of the SID? And "DefaultUserDomain" comes from the default value of HKU\{SID}\Software\Microsoft\Windows\ShellNoRoam? If so, How do we learn such arcane details (particularly the inter-registry transfers, although the derivation of the corresponding environment variables would also be helpful)? Documentation?

Thanks, but the variables per se are pretty familiar. It's the connections from the registry, and from the installation settings to the registry, that are my concern.

i appreciate you getting me this far. If you have any thoughts on the follow-up questions, I would appreciate them, too.

Regards,

John

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...