Registry Junk: A Windows Fact of Life

TechCommunityAPIAdmin · ‎Jun 26 2019

First published on TechNet on Oct 02, 2005

Registry cleaners have always been popular, but I never paid much attention to them. I originally thought that there might be valid reasons for their existence, but over time changed my mind, only to recently recognize that even today they can help maintain Registry hygiene.

It used to be common for developers to write their own application installation routines in order to avoid paying hundreds of dollars for commercial setup toolkits. Their focus in coding installers was of course the install part of setup, because coding uninstallers is in some sense an admission that the software you’ve developed might not be useful or robust enough to become a permanent fixture on end-user systems. As a result, software uninstalls were often incomplete, leaving behind Registry and file system detritus. A few hundred kilobytes of unused keys and values causes no noticeable performance impact on system operation, but I figured it was natural for a Registry cleaner to be an essential part of running a tight ship for the anal retentive systems administrator.

Installer technology has come a long way and today there are literally dozens of reliable freeware and low-cost installation toolkits available both for old-style and Windows Installer Package (.MSI)-based setup. I previously believed that meant the end of Registry scrap and any reason for the existence of Registry cleaners. However, one of the Regmon troubleshooting examples Dave and I present in our Windows internals seminars made me realize that it’s not only possible, but common, for even best-of-breed uninstallers that have earned the Windows logo from Microsoft to leave our Registries littered with traces of applications deleted long ago.

The troubleshooting example that triggered my realization is one where a user discovers that Internet Explorer (IE) hangs upon startup unless they’ve used their ISP’s dialer to establish an Internet connection before opening IE. The user captured a Regmon trace of the hang and found references to their previous ISP’s dialer in the “RAS Phonebook” key under HKEY_CURRENT_USER (HKCU, the personal settings area of the Registry). After deleting the stale values their new ISP’s dialer began launching automatically when IE opened like it was supposed to.

Some research on my part suggests that the user had manually configured a RAS phonebook entry and when they changed ISPs forgotten to update the entry, but the fact that the problematic key in the example was in the per-user part of the Registry got me thinking. If the user’s old dialer had created the phonebook entry automatically and then been uninstalled from a different account the user would have been left with a broken IE configuration. That’s because uninstallers typically delete their application’s system-wide settings from the HKEY_LOCAL_MACHINE part of the Registry and any per-user settings of the user running the uninstaller from HKEY_CURRENT_USER. But what happens to the per-user settings of the other users that used the application? You guessed it, Registry junk gets created - and possibly file system junk in the application's Application Data folder in the Documents and Settings directories of other users. An uninstall is only thorough if the user performing it is the only one that used the software.

You can verify my assertion by first installing and using any application that creates personal settings in the Registry (try Winzip if you want one to experiment with). Then log into a different account and use the software. Uninstall from either account then log into the other and you’ll find the application’s per-user settings left behind (Winzip stores its settings in HKCUSoftwareNico Mak ComputingWinZip).

Uninstallers that want to be as meticulous as possible could use the LoadUserProfile Windows API to load each profile stored on the system, as listed in HKLMSOFTWAREMicrosoftWindows NTCurrentVersionProfileList, and look for their application settings in other profiles. The problem with that approach is that Registry permissions would likely prevent an uninstalling user from deleting keys out of other user profiles. And even if permissions weren’t an issue domain users with roaming profiles carry application settings with them to other computers, so profiles that need to be updated might not even be locally accessible.

So it seems that Registry junk is a Windows fact of life and that Registry cleaners will continue to have a place in the anal-sysadmin’s tool chest, at least until we’re all running .NET applications that store their per-user settings in XML files – and then of course we’ll need XML cleaners.

Originally by Mark Russinovich on 10/2/2005 4:09:00 PM
Migrated from original Sysinternals.com/Blog