Understanding Registry Value Data Types

by Barry Dysert
(last updated June 19, 2017)

5

If you ever have to get into the registry, you may be curious to know what value data types exist. Every key's value is assigned a data type. The list of valid data types includes:

  • REG_SZ. A null-terminated string
  • REG_BINARY. Binary data
  • REG_DWORD. A 32-bit number
  • REG_QWORD. A 64-bit number
  • REG_MULTI_SZ. A sequence of null-terminated strings, terminated by a null value
  • REG_EXPAND_SZ. A null-terminated string that contains unexpanded references to environment variables (like %PATH%)

Of course, if you're editing the registry you'll need to use the data type appropriate for the key you're creating. For example, there's a registry tweak you can do that will disable Windows from constantly checking for low disk space (and therefore increase by a bit the amount of resources available for other things). This is at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies. If you click on the "Explorer" folder you can create a key named "NoLowDiskSpaceChecks". To disable Windows from doing the disk space checking, you want to put a 1 in for that key's value.

Obviously, you could use a data type of REG_BINARY, REG_DWORD, or REG_QWORD since they will all hold the value 1 with no problem. I used REG_DWORD, though, since there may come a time when the key may take on more than two values, so I wouldn't want to be limited to REG_BINARY. And REG_QWORD seems like a lot of space to simply hold a 1.

 This tip (13035) applies to Windows 7, 8, and 10.

Author Bio

Barry Dysert

Barry has been a computer professional for over 35 years, working in different positions such as technical team leader, project manager, and software developer. He is currently a software engineer with an emphasis on developing custom applications under Microsoft Windows. When not working with Windows or writing Tips, Barry is an amateur writer. His first non-fiction book is titled "A Chronological Commentary of Revelation." ...

MORE FROM BARRY

Understanding Event Logs

Windows event logs are great resources to see what is "invisibly" going on with your system. By understanding the various ...

Discover More

Removing a File Type Program Association

Removing a file type program association is a task for third-party utilities. You can, however, change the association ...

Discover More

Using the Event Viewer to Examine Remote Event Logs

Assuming you have proper access to remote computers, you can examine their event logs from your system without much ...

Discover More
More WindowsTips

Exporting a Portion of the Registry

Windows wouldn't function if it weren't for the Registry, and many system tweaks involve editing it. Before making such ...

Discover More

Importing a Portion of the Registry

Windows wouldn't function if it weren't for the Registry, and many system tweaks involve editing it. If you've exported a ...

Discover More

Creating Registry Keys or Values

The Registry is the central depository of configuration information used by Windows and by programs running on your ...

Discover More
Subscribe

FREE SERVICE: Get tips like this every week in WindowsTips, a free productivity newsletter. Enter your address and click "Subscribe."

View most recent newsletter.

Comments

If you would like to add an image to your comment (not an avatar, but an image to help in making the point of your comment), include the characters [{fig}] in your comment text. You’ll be prompted to upload your image when you submit the comment. Maximum image size is 6Mpixels. Images larger than 600px wide or 1000px tall will be reduced. Up to three images may be included in a comment. All images are subject to review. Commenting privileges may be curtailed if inappropriate images are posted.

What is seven more than 6?

2020-12-23 02:10:26

Sean Francis

aargh - can't edit previous post.

To correct or better elaborate on what I said - The variable length/expanding properties of REG_BINARY were the reason. As far as readability - I misspoke - the VALUES are displayed with hex within regedit, but REG_BINARY is specifying the INTERNAL, stored format.

This would lead me to think that, provided there is no reversal of order on word boundaries or anything like that, it should look the same as a typical QWORD entry (HEX), aside from allowing for growing one byte at a time. However, an MS Engineer said that one would have to map the "old, QWORD values" i.e. bits, over to the REG_BINARY entry - which sounded fishy but that's what he said. It deterred me from flipping the "high-order bit" for fear of messing up the exploits-protection values (to disable embedded fonts - which was the significant byte in the QWORD value.

REALLY SORRY for the mess... for so many "bird-droppings" really - it wasn't my intent at all. (senilit... no no... just need some sleep, heh)


2020-12-23 01:49:37

Sean Francis

I forgot - please forgive the apparently "necro-ness" of my post. I really should have considered that, but I have just been dealing with adjusting the aforementioned exploit protections and was doing so through the registry - whereupon I discovered the change made with the Win 10 1709 patch/update. I'm not really a necro-type guy ;-)


2020-12-23 01:42:58

Sean Francis

It's a bit relevant to the existing comments/post, so I thought I'd include this, for informational and amusement purposes ;-)

In fact - Binary can be useful if a QWORD becomes insufficient for storing values - sort of the opposite of the original comment (Yeah, agree with Barry - they'd rather plan for tomorrow's increased needs than save a few bits - not to mention that a binary representation of, e.g., a bitmask or multiple flags best _displayed_ with hex becomes extremely ugly and cumbersome if you think about it). But that aside - a recent Win 10 update has changed a QWORD represented reg key to a REG_BINARY representation:

The registry does at times make use of REG_BINARY for multiple values, even storing masks for many flags, which is to say that using binary does not limit one to only two values, but it does complicate the entry of them :-)

As it is not a fixed-length, more values, in fact, can be accommodated with REG_BINARY than with a QWORD - have a look at Microsoft's RS3 (1709) Win 10 update - they have changed the kernel mitigationoptions from QWORD to REG_BINARY to provide for additional as well as future options (e.g. the enable/disable embedded fonts exploit protections, etc..). It is basically sacrificing easy "readability" within the Registry (and editor) for increased capacity i.e. bits. An un-pretty way to provide for display and "setting" of a potentially large bitmask.

Cheers!! A fellow (semi) old-timer. Drove up and down 880 at all hours, as well as on the Peninsula, etc.. for decades i.e. commuting when I wasn't WFH... ;-)

Sean - aprilia1k


2017-09-06 04:19:20

Barry

I think the space savings would be negligible, and i wouldn't want to try it anyway. Sounds like that would be asking for trouble.


2017-09-06 01:12:48

Amaroq Starwind

Would Windows function correctly if you changed some of the default DWORD values to regular BINARY values? And would doing so use less space?


Newest Tips
Subscribe

FREE SERVICE: Get tips like this every week in WindowsTips, a free productivity newsletter. Enter your address and click "Subscribe."

(Your e-mail address is not shared with anyone, ever.)

View the most recent newsletter.