7

The question is very simple, what's the difference between HKEY_CURRENT_USER\Software\Wow6432Node\Classes and HKEY_CURRENT_USER\Software\Classes\Wow6432Node?

Román
  • 1,943
  • 2
  • 18
  • 28

6 Answers6

11

rather late, but here I go

Colin O'Dell writes:

I'm not sure, but I can tell you that my Windows 7 x64 machine only has the latter one. I do have HKEY_CURRENT_USER\Software\Wow6432Node\, but Classes doesn't exist inside that for me.

And you shouldn't have, HKCU is actually pointer to -> HKUS\UserSid

Now HKCU\Software\Classes is actually pointer to -> HKUS\UserSid\Software\Classes, and this one is actually pointer to HKUS\UserSid_Classes

Now here comes WOW redirection, and for example HKCU\Software\Classes\CLSID becomes: HKUS\UserSid_Classes\Wow6432Node\CLSID

ain't that fun?

So in short, HKEY_CURRENT_USER\Software\Wow6432Node\Classes is most-likely a leftover after some misbehaving application (that was probably trying to figure out redirection by itself...)

jp2code writes:

We have hundreds of WinXP machines at our workplace still. Classes is installed on all of them, but not Wow6432Node

Weren't you perhaps speaking about 32-bit Win XP? if so, it's quite obvious, there's no Wow node...

GiM
  • 460
  • 4
  • 13
  • 1
    Where `HKUS\UserSid\Software\Classes` is actually `HKUS\UserSid_Classes` which comes from `%LOCALAPPDATA%\Microsoft\Windows\UsrClass.dat` while `HKUS\UserSid` is saved in `%USERPROFILE%\NTUSER.DAT`. – TNT Sep 04 '18 at 17:31
10

HKCU\Software\Classes\Wow6432Node is correct: it's the redirected location that's accessed by 32-bit apps when they ask for HKCU\Software\Classes on a 64-bit machine.

HKCU\Software\Wow6432Node\Classes should not exist. If it does, whatever wrote that key and its subkeys is buggy.

See this article: Registry Keys Affected by WOW64 for details.

In fact, I think that HKCU\Software\Wow6432Node should not exist - it's not listed on that article I linked above and on my system I have only HKCU\Software\Wow6432Node\Microsoft\Active Setup\Installed Components with a few subkeys, which suggests to me they're in the wrong place.

Rory
  • 40,559
  • 52
  • 175
  • 261
  • The article you linked states, that `\Wow6432Node\Classes` is linked to `\Classes\Wow6432Node` (for compatibility). It is thus intended. – Patrick Böker Jan 18 '18 at 13:46
  • 3
    It says "`HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes` is linked to `HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node`" but this question is about `HKEY_CURRENT_USER`, not `HKEY_LOCAL_MACHINE`. – Rory Jan 18 '18 at 13:53
  • I think you have this backwards. If you examine the actual SOFTWARE hive you find Wow6432Node\Classes\CLSID but not Classes\Wow6432Node\CLSID - so I imagine the regedit tool is itself redirecting these and for 32bit CLSIDs – rayzinnz Mar 19 '21 at 02:47
  • @rayzinnz - I think you're talking about the `HKEY_LOCAL_MACHINE\Software` hive, but this question is about `HKEY_CURRENT_USER`. – Rory Mar 20 '21 at 12:55
3

I'm not sure, but I can tell you that my Windows 7 x64 machine only has the latter one. I do have HKEY_CURRENT_USER\Software\Wow6432Node\, but Classes doesn't exist inside that for me.

Colin O'Dell
  • 8,386
  • 8
  • 38
  • 75
  • 1
    I guess some installer created the first one by mistake. – Román Oct 14 '10 at 18:22
  • We have hundreds of WinXP machines at our workplace still. `Classes` is installed on all of them, but **not** `Wow6432Node`. –  Jul 25 '11 at 16:45
2

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes is linked to HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node

You can read this at the bottom of this article.

Olppah
  • 790
  • 1
  • 10
  • 21
  • 1
    This question is about HKEY_**CURRENT_USER** – Herohtar Jul 29 '19 at 19:38
  • @Herohtar There is not any `Software\Wow6432Node` key under `HKEY_CURRENT_USER` in registry normally. If you found one, it is absolutely a bug, either you write values to or delete values from the node, it does not take effect anyway. – xenophōn Aug 29 '19 at 03:08
  • @賈可Jacky `HKEY_CURRENT_USER\Software\Wow6432Node` and `HKEY_CURRENT_USER\Software\Classes\Wow6432Node` both exist on my Windows 10 system. Whether that is a bug or not, those are the keys the original question was asking about. This answer making a statement about keys under `HKEY_LOCAL_MACHINE` does not answer that question at all. – Herohtar Aug 29 '19 at 03:39
  • @Herohtar So it is a bug by Microsoft itself, I have deleted it. Just try it: type `regedit.exe -m` and `%SystemRoot%\SysWow64\regedit.exe -m` in the `Run` dialog to open native registry editor on 64 bit OS and 32 bit version of registry editor, create key under `HKLM\Software` in the 32 bit version, and then refresh the 64bit version see the changes under `HKLM\Software\Wow6432Node`. – xenophōn Aug 29 '19 at 06:15
  • @Herohtar Also try to create key under `HKCU\Software` and `HKCU\Software\Wow6432Node` in the 32 bit version, and then refresh both the 32 bit and 64 bit version see the changes. – xenophōn Aug 29 '19 at 06:16
  • @Herohtar You may still try to create key under `HKCU\Software\Wow6432Node\Classes` in the 32 bit version, and then refresh the both version of registry editor to see the changes under `HKCR\Classes\Wow6432Node` and `HKCR\Wow6432Node\Classes` to verify whether it could be recognized by Windows. – xenophōn Aug 29 '19 at 06:19
2

The reason for the "Wow6432Node" reg key and the other key, is that on modern 64 bit machines we still run alot of 32-bit apps. Microsoft knowing this, has allsorts of mirroing, and spoofing schemes within the registry to sort it all out. Usually this works to your advantage.

Say you are trying to register som component to the registry in code. All you need to do is try to put your entries into the key(reg path) you think you want. The registry will take that request and deal with it (propably putting it into the Wow6432Node sub-directory).

In other words, 99% of the time ignor 'Wow6432Node'. Especially if you are registering things to the registry from code. If you manually include 'Wow6432Node' in your path, then your app will only work right on 64-bit machines - which are the only ones who use that reg path.)

SUMMARY: Its where windows puts your 32-bit stuff on a 64-bit machine!!!!!

Ryan
  • 76
  • 3
  • I think the OP was asking why both were present, presumably already knowing the purpose of WOW6432 – Davy8 Oct 14 '10 at 18:42
  • 1
    I don't think both were present on the same PC. One was present on a newer PC, the other was present on an older PC. That complicates your installers. –  Jul 25 '11 at 16:47
0

I have no explanation for the "Classes" subkey and I don't see it on my own machines but the HKCU...Wow6432Node subkey is confusing itself since it is not associated with registry redirection and is not listed in the "Registry Keys Affected by WOW64" MSDN doc. I'm wondering if the OP was referring to a theoretical "Classes" child subkey of "Wow6432Node".

"Active Setup" is a reason that HKEY_CURRENT_USER\Software\Wow6432Node may exist. Application installers sometimes require per-user modifications to run when the user next logs in.

At login, to detect such modifications needed for 32-bit applications on 64-bit Windows, Windows compares [HKLM\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components{GUID}] to [HKCU\Software\Wow6432Node\Microsoft\Active Setup\Installed Components{GUID}].

If the HKLM GUID subkey is not also found in the HKCU analogous location, Windows performs the installation operations and copies the information to [HKCU\Software\Wow6432Node\Microsoft\Active Setup\Installed Components] (so that the installation operations are not repeated).

So, if [HKCU\Software\Wow6432Node\Microsoft\Active Setup\Installed Components] is present, then the "Wow6432Node" portion of the HKCU... subkey ID is likely just text that matches a portion of the HKLM... subkey.

Witsend
  • 23
  • 5