• System Registry

    From Ed Cryer@21:1/5 to All on Wed Aug 7 13:07:23 2024
    I was looking at all the old, obsolete entries in this PC's registry.
    There are zillions of them.
    The PC is old but efficient; it's seen lots of software come and go.
    Anyway, I was wondering how big the registry has actually got. So I ran
    regedit and exported a copy to Desktop, which failed at 476MB with a
    disc error message.

    My instinct is to leave well enough alone, since there's no sign of
    trouble. However, I thought maybe some expert here might know better.

    Ed

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Big Al@21:1/5 to Ed Cryer on Wed Aug 7 09:08:55 2024
    On 8/7/24 08:07 AM, Ed Cryer wrote:
    I was looking at all the old, obsolete entries in this PC's registry. There are zillions of them.
    The PC is old but efficient; it's seen lots of software come and go.
    Anyway, I was wondering how big the registry has actually got. So I ran regedit and exported a copy
    to Desktop, which failed at 476MB with a disc error message.

    My instinct is to leave well enough alone, since there's no sign of trouble. However, I thought
    maybe some expert here might know better.

    Ed
    What was the error message?
    Did you export it as admin?
    --
    Linux Mint 21.3, Cinnamon 6.0.4, Kernel 5.15.0-117-generic
    Al

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Paul@21:1/5 to Ed Cryer on Wed Aug 7 13:02:53 2024
    On Wed, 8/7/2024 8:07 AM, Ed Cryer wrote:
    I was looking at all the old, obsolete entries in this PC's registry. There are zillions of them.
    The PC is old but efficient; it's seen lots of software come and go.
    Anyway, I was wondering how big the registry has actually got. So I ran regedit and exported a copy to Desktop, which failed at 476MB with a disc error message.

    My instinct is to leave well enough alone, since there's no sign of trouble. However, I thought maybe some expert here might know better.

    Ed

    I've removed a lot of noise, such as registry journal files.
    I wanted to list the main registry files (to show you don't
    need to export anything to see sizes).

    These are traditional Registry files, more or less.

    At one time these were not journaled, and much easier to corrupt on a dirty shutdown.
    NTFS is journaled, regfiles are journaled, there is two levels of
    journaling, making registry files more bullet resistant than they
    were long ago.

    We don't expect these two OSes to vary much. The reason SOFTWARE
    on the (relatively unused) Win10 is as big as it is, Visual Studio
    Community Edition is installed there.

    **************************** Win11 **************************

    C:\Windows\System32\config
    -a---- Tue, 8, 6, 2024 2:33 PM 38,535,168 COMPONENTS
    -a---- Fri, 8, 2, 2024 10:42 AM 10,846,208 DRIVERS
    -a---- Tue, 8, 6, 2024 10:38 PM 131,072 SAM
    -a---- Tue, 8, 6, 2024 10:38 PM 65,536 SECURITY
    -a---- Tue, 8, 6, 2024 10:38 PM 85,196,800 SOFTWARE
    -a---- Tue, 8, 6, 2024 10:38 PM 28,049,408 SYSTEM

    dir /ah C:\Users\username # Work in a Command Prompt, use dir /ah to see hidden items

    Tue, 08/06/2024 10:37 PM 7,340,032 NTUSER.DAT <=== HKCU ???

    **************************** Win10 **************************

    H:\Windows\System32\config
    -a---- Mon, 7, 22, 2024 7:09 AM 36,962,304 COMPONENTS
    -a---- Mon, 7, 22, 2024 7:09 AM 7,974,912 DRIVERS
    -a---- Mon, 7, 22, 2024 8:20 PM 65,536 SAM
    -a---- Mon, 7, 22, 2024 8:20 PM 32,768 SECURITY
    -a---- Mon, 7, 22, 2024 8:20 PM 90,701,824 SOFTWARE
    -a---- Mon, 7, 22, 2024 8:20 PM 22,806,528 SYSTEM

    H:\Users\Bullwinkle

    Mon, 07/22/2024 08:20 PM 2,359,296 NTUSER.DAT

    Even if these were memory mapped and fully populated in RAM,
    this is a pimple on the memory subsystem. Like at one time,
    if you had a 512MB machine, I could see size on these eventually
    being a problem, as the "core" of the Registry might try to be
    resident (parts of the Registry that are "polled" stay in memory).
    But on modern machines with bigger RAM... hellooo is
    anyone in here <huge empty hall>.

    *******

    You can use a Repair Install of the OS, for registry cleaning.
    C:\Windows.old will contain the old OS (removable via "cleanmgr.exe"). C:\Windows is the new (smaller) output from the Repair install.

    Of the Registry Files, I would expect SOFTWARE to be the most
    dynamic. A Repair Install could shrink it. The others might be
    a bit more resistant to poking.

    Before a Repair Install, you do a backup of the disk. Restoring
    from backup, is faster than a revert run by Windows.

    The reason I have no sizes to offer on registry cleaning,
    is I don't clean the registry. Not ever. And certainly
    I would not use a Snake Oil Cleaner to do it ("we removed 8179 items").
    Your printer could stop working if you did it that way.

    Paul

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Ed Cryer@21:1/5 to Big Al on Wed Aug 7 20:18:16 2024
    Big Al wrote:
    On 8/7/24 08:07 AM, Ed Cryer wrote:
    I was looking at all the old, obsolete entries in this PC's registry.
    There are zillions of them.
    The PC is old but efficient; it's seen lots of software come and go.
    Anyway, I was wondering how big the registry has actually got. So I
    ran regedit and exported a copy to Desktop, which failed at 476MB with
    a disc error message.

    My instinct is to leave well enough alone, since there's no sign of
    trouble. However, I thought maybe some expert here might know better.

    Ed
    What was the error message?
    Did you export it as admin?

    I get a .reg file before the error message.
    Cannot export C:\Users\Ed\...reg. Error writing the file. There may be a
    disk or file system error.

    Then My PC passes all disk validation checks;
    DISM /Online /Cleanup-Image /RestoreHealth
    sfc /scannow
    chkdsk c: /f /r

    I find lots of occurrences of the error message online; and no solved.
    I suspect a simple dialogue discrepancy. "Export" from regedit. What is
    it expecting? I expect a simple place to write a copy; but maybe regedit
    is expecting some other type of target.

    Has anybody run regedit export without getting the error message?

    Ed

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Stan Brown@21:1/5 to Ed Cryer on Wed Aug 7 14:58:11 2024
    On Wed, 7 Aug 2024 13:07:23 +0100, Ed Cryer wrote:
    My instinct is to leave well enough alone, since there's no sign of
    trouble. However, I thought maybe some expert here might know better.

    Your instinct is a good one. I don't know the details of how Windows
    looks up registry entries, but it it's some sort of direct access, as
    opposed to just reading the file from beginning till the desired key
    is reached. Obsolete entries increase the size, but they don't
    degrade the performance.

    --
    Stan Brown, Tehachapi, California, USA https://BrownMath.com/
    Shikata ga nai...

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Paul@21:1/5 to Ed Cryer on Thu Aug 8 03:04:36 2024
    On Wed, 8/7/2024 3:18 PM, Ed Cryer wrote:
    Big Al wrote:
    On 8/7/24 08:07 AM, Ed Cryer wrote:
    I was looking at all the old, obsolete entries in this PC's registry. There are zillions of them.
    The PC is old but efficient; it's seen lots of software come and go.
    Anyway, I was wondering how big the registry has actually got. So I ran regedit and exported a copy to Desktop, which failed at 476MB with a disc error message.

    My instinct is to leave well enough alone, since there's no sign of trouble. However, I thought maybe some expert here might know better.

    Ed
    What was the error message?
    Did you export it as admin?

    I get a .reg file before the error message.
    Cannot export C:\Users\Ed\...reg. Error writing the file. There may be a disk or file system error.

    Then My PC passes all disk validation checks;
    DISM /Online /Cleanup-Image /RestoreHealth
    sfc /scannow
    chkdsk c: /f /r

    I find lots of occurrences of the error message online; and no solved.
    I suspect a simple dialogue discrepancy. "Export" from regedit. What is it expecting? I expect a simple place to write a copy; but maybe regedit is expecting some other type of target.

    Has anybody run regedit export without getting the error message?

    Ed


    When I export "Computer" to my D: drive, I get this many bytes,
    and the file is double byte text. Regedit needs elevation to work,
    even though the elevation isn't useful for all entries. Entries
    protected by TrustedInstaller (registry entries have permissions)
    the entries cannot be removed or modified. Perfect for the entries
    malware leave behind. The recent damage to the usage of TrustedInstaller applications, means if I had a malware entry today, I'd have no way to
    remove it.

    WALLACE.reg (W11home)

    397,452,574 bytes

    Since the source of the Export is a binary format, you would expect
    some expansion when converting it to text.

    ******* Small sample of exported content *******
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE]
    "ServiceLastKnownStatus"=dword:00000002

    [HKEY_LOCAL_MACHINE\BCD00000000]

    [HKEY_LOCAL_MACHINE\BCD00000000\Description]
    "KeyName"="BCD00000000"
    "System"=dword:00000001
    "TreatAsSystem"=dword:00000001

    [HKEY_LOCAL_MACHINE\BCD00000000\Objects]

    ,,,

    [HKEY_USERS\S-1-5-18\System\GameConfigStore]

    [HKEY_USERS\S-1-5-18\System\GameConfigStore\Children]

    [HKEY_USERS\S-1-5-18\System\GameConfigStore\Parents]
    *******

    I didn't run into a permissions problem writing to D: .

    Your ellipsis leaves out some details we could use.
    I presume you typed in "MachineName.reg" as your output filename when asked
    and MachineName.reg is the part in the ellipsis ?
    When it asked for an output filename, you gave it one, right ?
    It might be silly enough software, to try to write out " .reg".

    "Cannot export C:\Users\Ed\...reg. Error writing the file. "

    You can see my output is a text file. Leaving an extension of .reg
    on a file, makes it show "Merge" as a context menu option. And
    you don't want to be doing that, to the freshly generated file.
    Change the extension for safety, to .txt and that will make
    it innocuous.

    WALLACE.txt

    397,452,574 bytes <=== Small enough, Notepad eventually opens it

    Just be careful, OK.

    Paul

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Ed Cryer@21:1/5 to Stan Brown on Thu Aug 8 11:53:34 2024
    Stan Brown wrote:
    On Wed, 7 Aug 2024 13:07:23 +0100, Ed Cryer wrote:
    My instinct is to leave well enough alone, since there's no sign of
    trouble. However, I thought maybe some expert here might know better.

    Your instinct is a good one. I don't know the details of how Windows
    looks up registry entries, but it it's some sort of direct access, as
    opposed to just reading the file from beginning till the desired key
    is reached. Obsolete entries increase the size, but they don't
    degrade the performance.


    I'm with you here, Stan. There's no sign of trouble in my PC apart from
    this. And I'm leaving it alone now; curiosity killed the cat, and we
    don't all have Paul's deeper insight.

    Ed

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Paul@21:1/5 to Ed Cryer on Thu Aug 8 12:50:08 2024
    On Thu, 8/8/2024 6:53 AM, Ed Cryer wrote:
    Stan Brown wrote:
    On Wed, 7 Aug 2024 13:07:23 +0100, Ed Cryer wrote:
    My instinct is to leave well enough alone, since there's no sign of
    trouble. However, I thought maybe some expert here might know better.

    Your instinct is a good one. I don't know the details of how Windows
    looks up registry entries, but it it's some sort of direct access, as
    opposed to just reading the file from beginning till the desired key
    is reached. Obsolete entries increase the size, but they don't
    degrade the performance.


    I'm with you here, Stan. There's no sign of trouble in my PC apart from this. And I'm leaving it alone now; curiosity killed the cat, and we don't all have Paul's deeper insight.

    Ed

    I have a suspicion, it's just an unsanitized file name at fault.
    You can see the screen and tell us.

    And look in that folder and check the file sizes. That
    will give you some idea how "abnormal" your situation is.
    Remember that, "amazing things are possible" with registry files.
    They can hold arbitrarily large "items". The registry is
    a kind of file system, that is good with small objects.
    But large objects can also be jammed in there, no problem
    at all. You could put the library of congress in there.

    C:\Windows\System32\config
    -a---- Tue, 8, 6, 2024 2:33 PM 38,535,168 COMPONENTS
    -a---- Fri, 8, 2, 2024 10:42 AM 10,846,208 DRIVERS
    -a---- Tue, 8, 6, 2024 10:38 PM 131,072 SAM
    -a---- Tue, 8, 6, 2024 10:38 PM 65,536 SECURITY
    -a---- Tue, 8, 6, 2024 10:38 PM 85,196,800 SOFTWARE <=== might be the dynamic one
    -a---- Tue, 8, 6, 2024 10:38 PM 28,049,408 SYSTEM

    Paul

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)