Undestanding 'Merged View of HKEY_CLASSES_ROOT'


Skeptic Mike

Well-known member
Member
VIP
Local time
2:14 AM
Posts
148
OS
Windows 11 25H2 Pro Build 26200
Here's Microsoft's documentation: Merged View of HKEY_CLASSES_ROOT - Win32 apps it was updated in 2021.

My understanding of the merge process has always been that everything from HKEY_LOCAL_MACHINE\Software\Classes and HKEY_CURRENT_USER\Software\Classes is included in HKEY_CLASSES_ROOT. Except 'If the values of entries in the two Classes subkeys conflict, then only the value in HKEY_CURRENT_USER\SOFTWARE\Classes appears in HKEY_CLASSES_ROOT.'

So, what does this mean:

At the end of this topic is a list of subkeys that are found in both HKEY_LOCAL_MACHINE\Software\Classes and HKEY_CURRENT_USER\Software\Classes. The immediate subkeys of these keys from the HKEY_LOCAL_MACHINE tree are included in the merged view only if they are not duplicates of immediate subkeys from the HKEY_CURRENT_USER tree. The merged view does not include the HKEY_LOCAL_MACHINE contents of duplicate subkeys.​
In particular the last sentence: "The merged view does not include the HKEY_LOCAL_MACHINE contents of duplicate subkeys.". This suggests to me that given the correct set of keys in HKEY_CURRENT_USER\Software\Classes, then values in those keys from HKEY_LOCAL_MACHINE wouldn't appear in HKEY_CLASSES_ROOT. But surely that can't be true.

Anybody have an explanation?
 
Windows Build/Version
Windows 11 Pro 25H2 version 26200.7462

My Computers

System One System Two

  • OS
    Windows 11 25H2 Pro Build 26200
    Computer type
    PC/Desktop
    Manufacturer/Model
    MSI PRO ADL-U Cubi 5 (MS-B0A8)
    CPU
    i3-1215U
    Memory
    8GB
    Monitor(s) Displays
    Sony 43" 4k TV
    Screen Resolution
    3840x2160
    Hard Drives
    250GB NVMe M.2 PCIe Gen 3 SSD
    PSU
    External 65W
    Case
    Mini PC
    Browser
    FireFox
    Antivirus
    MS
  • Operating System
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell Optiplex 3070 SFF
    CPU
    Intel i3-9100
    Memory
    16GB DDR4
    Monitor(s) Displays
    Dell S2721
    Screen Resolution
    3840 x 2160
    Hard Drives
    Samsung 500GB nvMe
    Case
    Dell small form factor
    Keyboard
    Cherry mechanical (Blue)
    Mouse
    Microsoft
    Antivirus
    MS Defender
I don't see a contradiction. The cardinal rule for Windows policy is whenever there are (supported) duplicate keys between HKLM and HKCU, the user preference (HKCU) will win. 3rd-party apps can read from whatever keys they want, but Windows features must follow this rule.

Therefore HKR throws out duplicate keys by allowing the HKCU instances to win.

HKR is a synthetic view, just like HKCU. Both are generated dynamically from different hives. The CU in HKCU is your user profile. Someone else can have a totally different user hive, and their presented HKR would be different from your HKR.

The immediate subkeys of these keys from the HKEY_LOCAL_MACHINE tree are included in the merged view only if they are not duplicates of immediate subkeys from the HKEY_CURRENT_USER tree. [HKLM version wins if HKCU is empty]

The merged view
does not include the HKEY_LOCAL_MACHINE contents of duplicate subkeys. [HKLM loses in a conflict]
 

My Computer

System One

  • OS
    Windows 7
Excellent explanation, @garlin You taught me something.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro 25H2 26200.8655
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell Optiplex 7080
    CPU
    i9-10900 10 core 20 threads
    Motherboard
    DELL 0J37VM
    Memory
    32 gb
    Graphics Card(s)
    none-Intel UHD Graphics 630
    Sound Card
    Integrated Realtek
    Monitor(s) Displays
    Benq 27
    Screen Resolution
    2560x1440
    Hard Drives
    2x1tb Solidigm m.2 nvme /External drives 512gb Samsung m.2 sata+2tb Kingston m2.nvme
    PSU
    500w
    Case
    MT
    Cooling
    Dell Premium
    Keyboard
    Logitech wired
    Mouse
    Logitech wireless
    Internet Speed
    so slow I'm too embarrassed to tell
    Browser
    #1 Edge #2 Firefox
    Antivirus
    Defender+MWB Premium
  • Operating System
    Windows 11 Pro 24H2 26200.8457
    Computer type
    PC/Desktop
    Manufacturer/Model
    Beelink Mini PC SER5
    CPU
    AMD Ryzen 7 6800U
    Memory
    32 gb
    Graphics card(s)
    integrated
    Sound Card
    integrated
    Monitor(s) Displays
    Benq 27
    Screen Resolution
    2560x1440
    Hard Drives
    1TB Crucial nvme
    Keyboard
    Logitech wired
    Mouse
    Logitech wireless
    Internet Speed
    still too embarrassed to tell
    Browser
    Firefox
    Antivirus
    Defender
    Other Info
    System 3 is non compliant Dell 9020 i7-4770/24gb ram Win11 PRO 26200.8457
A late reply - I've been unwell.

Thanks @garlin for responding. I'm still mystified by this.

"The merged view does not include the HKEY_LOCAL_MACHINE contents of duplicate subkeys."​

The values in HKEY_LOCAL_MACHINE duplicate subkeys are always included in HKCR. The only way in which HKCU wins is that if the same value is written in HKCU, HKCR returns the data from HKCU.
Here's Microsoft's documentation: Merged View of HKEY_CLASSES_ROOT - Win32 apps it was updated in 2021.
I checked by looking at 2003 platform SDK, and the contents dated March 2005 are identical, except for the example which is wrongly formatted in the current version. (Missing newlines and indenting.) I haven’t found anything earlier, although I assume that there must have been some discussion about the merging which was introduced in Windows 2000.

I don't think there's any reason to take this further. I think that I understand how HKCR works, I just can't understand a small part of the documentation.
 

My Computers

System One System Two

  • OS
    Windows 11 25H2 Pro Build 26200
    Computer type
    PC/Desktop
    Manufacturer/Model
    MSI PRO ADL-U Cubi 5 (MS-B0A8)
    CPU
    i3-1215U
    Memory
    8GB
    Monitor(s) Displays
    Sony 43" 4k TV
    Screen Resolution
    3840x2160
    Hard Drives
    250GB NVMe M.2 PCIe Gen 3 SSD
    PSU
    External 65W
    Case
    Mini PC
    Browser
    FireFox
    Antivirus
    MS
  • Operating System
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell Optiplex 3070 SFF
    CPU
    Intel i3-9100
    Memory
    16GB DDR4
    Monitor(s) Displays
    Dell S2721
    Screen Resolution
    3840 x 2160
    Hard Drives
    Samsung 500GB nvMe
    Case
    Dell small form factor
    Keyboard
    Cherry mechanical (Blue)
    Mouse
    Microsoft
    Antivirus
    MS Defender

Latest Support Threads

Back
Top Bottom