Find where a setting lives

4 min read

Start with the setting's purpose and the program that reads it. Search the installed registry manual, find the key, then inspect its live values. A path alone does not tell you whether a value is a setting to change, a fact published by a service, or private to one user.

Search before changing anything #

These commands only read documentation and current state:

regman -k buffer
regman 'Machine\System\KMES' BufferCapacity
reg ls Machine/System/KMES -l
reg get Machine/System/KMES BufferCapacity -L

Search installed documentation with regman -k, using a word from the setting's name or purpose.
Look up the returned key and value; check type, valid values, default and application timing. A key-only lookup lists its documented values.
Inspect live values with reg. -L shows the winning layer and sequence, not every hidden entry.

For graphical browsing, Registry Editor shows the same manual beside live values. regman reads documentation, not live state: a documented entry need not be set. Full command syntax is in regman and reg.

Common locations #

These common locations are backed by pinned source revisions, not an exhaustive schema or a guarantee about your installed release. Check your installed manual before changing a field.

What you are looking for	Start here	Who gives it meaning
A service definition	`Machine\System\Services\<name>`	peinit reads service definitions. See the service key reference.
Init-wide settings	`Machine\System\Init`	peinit reads global control limits, environment and boot-time path provisioning.
Network configuration and reported state	`Machine\System\Network`	netd, resolvd and policy consumers use distinct subtrees. See the network registry layout for details.
Shared authentication policy	`Machine\Generic\Authn\Policy`	Peios policy about a principal's authority, shared across authentication-authority implementations.
Shared security-descriptor suggestions	`Machine\Common\SecurityDescriptorBuilder`	A claim catalogue for programs that build security descriptors. `Common` holds stable shared formats that are not part of the Peios specifications.
authd's implementation configuration	`Machine\Software\Authd`	authd's `Sources` subkeys say which principal sources may register and what they are trusted to assert.
A particular user's settings	`Users\<SID>`; `CurrentUser` for the caller	Each consumer defines its per-user keys. Check the identity notes below.

The service and init locations come from peinit's key constants; its init manual explains the global settings. The distinction between shared authentication policy and authd configuration is explicit in its manual. The descriptor editor's catalogue documentation explains the Common example.

Check whose user settings you are reading #

Users\<SID> identifies a principal by SID. authd creates a private user root at authenticated sign-in, with access for that user, SYSTEM and Administrators; it does not reset an existing root's permissions.

CurrentUser is an alias, not a separate hive. For a caller-supplied absolute path, LCS resolves its leading CurrentUser component using the calling thread's effective token. A service or impersonating thread may therefore address a different user's settings from your interactive shell. See the alias's exact rules.

Machine-to-user fallback is consumer-specific. For example, session locale combines machine and user settings for new sessions' environment, under its own precedence rules. Those rules do not apply automatically to other programs.

Separate settings from reported facts #

The registry also contains state written by running components. Under Machine\System\Network:

Profiles and interface rules are operator configuration.
netd publishes Status and readiness facts. Its Status keys have SYSTEM-only writes and Everyone reads. Inspect them; use the documented configuration keys to request changes.
A network's status can include remembered DNS server observations. These differ from both active resolver state and the fallbacks and overrides in resolvd's configuration under Machine\System\Network\Dns.

Use Configuring profiles and Name resolution to make and verify a network change; a stored value alone does not prove active use.

If you cannot find or read it #

No manual entry: check the owning component's documentation. The installed manual is only as complete as the documentation shipped with it.
No live value: check the consumer's missing-value behavior. Do not create the key merely because the map or manual mentions it.
Access denied: check the exact key's permissions. Listing a parent and reading a child are separate operations.

There is no universal Everyone-read rule. The default hive descriptor grants read access to Authenticated Users and full access to SYSTEM and Administrators; individual keys can use different descriptors, including the network Status keys above. Knowing a path does not grant access.

Once you have identified the setting and its consumer, follow Change a setting and verify it for a controlled edit, read-back and consumer verification.

Edit this page