[JohnKaufmann]

Trying to make the connections in in the subject line, I note that some installation values have relatively clear connections to the registry, others are obscure at best. An obvious example in the middle of those extremes is the registry (and environment) value SystemRoot, which seems to be derived from the installation values SystemDrive (from $OEM$ $1) and TargetPath (from WinNT.SIF). Is that inference correct? If not, how is SystemRoot derived?

Bonus question for that example: Where is SystemDrive defined in the registry? It is used in the registry as value data (i.e., %SystemDrive% as part of a larger string), but I can't find it as a value defined under any key - yet the value is used often in the registry and is passed to the environment. Anyone know how this works?

Related question: I have been able to identify the source of many environment variables in the registry under these keys;

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion (SystemRoot)
HKLM\SYSTEM\CurrentControlSet\Control\SessionManager\Environment (Comspec, OS, Path, PATHEXT, windir)
HKCU\Environment (TEMP, TMP)
HKCU\Volatile Environment (APPDATA, HOMEDRIVE, HOMEPATH, LOGONSERVER, SESSIONNAME)

But that still leaves environment variables that I don't find defined in the registry (like SystemDrive) and strings like USERDOMAIN and USERPROFILE that aren't even used in the registry. Where and how are these stored?

[bphlpt]

According to http://support.microsoft.com/kb/104011, and http://stackoverflow...red-in-registry, and http://best-windows....-variables.html, for XP:

Quote

User environment variables are stored in the Registry in the key:
HKEY_CURRENT_USER\Environment

System variables are found in the key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment

Note that any environment variable that is in the form that needs to be expanded (for example, %PATH%) must be stored in the registry as a REG_EXPAND_SZ registry value. Editing the Registry is primarily for scripts used by systems administrators and is not recommended for the average PC user.

Cheers and Regards

[jaclaz]

JohnKaufmann, on 21 September 2012 - 01:34 AM, said:

But that still leaves environment variables that I don't find defined in the registry (like SystemDrive) and strings like USERDOMAIN and USERPROFILE that aren't even used in the registry. Where and how are these stored?

I guess you will have to "dirty your hands" with SID's, those are created "on-the-fly" at logon.
See (as an example):
http://www.raygibson...file_migration/

The actual values are stored in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
See:
http://blogs.technet...a-computer.aspx

This may be of use as a quick reference:
http://www.scriptlog...eReference.html

jaclaz

[JohnKaufmann]

bphlpt, on 21 September 2012 - 01:57 AM, said:

According to http://support.microsoft.com/kb/104011, and http://stackoverflow...red-in-registry, and http://best-windows....-variables.html, for XP:

Quote

User environment variables are stored in the Registry in the key:
HKEY_CURRENT_USER\Environment

System variables are found in the key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment

...

Thanks, but I think that's pretty close to what I said, except that the original post was a bit more complete. For example, while HKCU\Environment provides only TEMP and TMP, quite a few variables are provided from HKCU\Volatile Environment (APPDATA, HOMEDRIVE, HOMEPATH, LOGONSERVER, SESSIONNAME), and SystemRoot is apparently provided from HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion -- and then there are the environment variables that are used but not defined in the registry, as well as environment variables that do not even appear in the registry.

My questions were (and remain):

1) How do the installation values connect to the registry values? How are those registry values (like SystemRoot) derived from the installation values?

2) Where is SystemDrive defined in the registry? How is it derived from the installation?

3) For all of the registry values that are not found in

HKCU\Environment
HKLM\SYSTEM\CurrentControlSet\Control\SessionManager\Environment

or even in

HKCU\Volatile Environment
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion

- and for those environment variables that are not defined in the registry, and those that do not even appear in the registry, how do they get to the environment? How and where are they stored?

Any idea where to look for those answers? - where to find documentation on such cases?

Regards,
John

[JohnKaufmann]

jaclaz, on 21 September 2012 - 03:36 AM, said:

JohnKaufmann, on 21 September 2012 - 01:34 AM, said:

But that still leaves environment variables that I don't find defined in the registry (like SystemDrive) and strings like USERDOMAIN and USERPROFILE that aren't even used in the registry. Where and how are these stored?

I guess you will have to "dirty your hands" with SID's, those are created "on-the-fly" at logon.
See (as an example):
http://www.raygibson...file_migration/

That was a great read - thanks! - but i don't see how it addresses the connection of installation settings to registry values, or registry values to environment variables. Did I miss something?

Quote

The actual values are stored in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
See:
http://blogs.technet...a-computer.aspx

That was also interesting. So the environment gets USERNAME from "DefaultUserName" and USERDOMAIN from "DefaultUserDomain"? - and those in turn are passed to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon from the SID? For example, "DefaulttUserName" comes from "Logon User Name" of the SID? And "DefaultUserDomain" comes from the default value of HKU\{SID}\Software\Microsoft\Windows\ShellNoRoam? If so, How do we learn such arcane details (particularly the inter-registry transfers, although the derivation of the corresponding environment variables would also be helpful)? Documentation?

Quote

This may be of use as a quick reference:
http://www.scriptlog...eReference.html

Thanks, but the variables per se are pretty familiar. It's the connections from the registry, and from the installation settings to the registry, that are my concern.

i appreciate you getting me this far. If you have any thoughts on the follow-up questions, I would appreciate them, too.

Regards,
John