Virtual Registry vs. "Real registry"

 

Perhaps you would like to read Mark's "Inside Windows Vista User Account Control" article on TechNet - it may not answer all of your questions completely, but could at least give you some hints / suggestions.  I suspect that the answers to your questions may vary based on specific scenarios (64-bit process? manifest file? admin rights?).

 

Some of my thoughts...

Originally posted by Skeeto Is there any way to read a registry value and know if it's really in registry or only existing in virtual registry?

It appears that it is easier to tell if a key only exists in the global store, than to tell if it exists in the virtual store.
Check the explanation of the flags (REG_ KEY_DONT_VIRTUALIZE, REG_KEY_DONT_SILENT_FAIL, REG_KEY_RECURSE_FLAG) in Mark's Technet article.
 

Originally posted by Skeeto It seems if a value is written in a users virtual registry, a call to read registry will return the value in virtual registry, even if the original values are deleted from registry (eg by uninstall).

Values, yes - it seems that an approximation of this scenario is described in Registry Virtualization on MSDN.
Keys, it would seem to be no, as the flags are stored with the key; if the global key is gone it would seem that there is no flag to tell that it should or should not be virtualized.
 

Originally posted by Skeeto Is there any way to delete a key in virtual registry without knowing the user? Or am I understanding this correctly: A delete in registry will not delete virtual registry keys for that user too?

I suspect for keys a delete from the global store would result in at least the inability to access them from the virtual store, for the reason mentioned above.  However, this theory is untested by me, so it is just that - a theory.

 

Originally posted by Skeeto uninstall of old program will leave some keys in virtual registry (and some files in folders too, but nvm them). The problem is after installation of newest program, a read in registry will return the key and key value in the virtual registry, even if there is nothing in the "real" registry.

Have you verified this with Process Monitor?

 

It would seem that if you would set the aforementioned registry flags on the key(s) you were having problems with, there should be no concern as any values that might be stored in the virtualized registry would be irrelevant.  Alternatively, if you made your app compatible with Vista and include a manifest, it would seem like you would be OK as well, as Mark writes:

For the purposes of this virtualization, Windows Vista treats a process as legacy if it’s 32-bit (versus 64-bit), is not running with administrative rights, and does not have a manifest file indicating that it was written for Windows Vista

Originally posted by Skeeto Is this correct or is there a windows api call?

Reg.exe has to be doing it somehow... But I honestly can't find any information on what API one might use to do it.  Probably, the import tables in Vista's REG.EXE and REGEDIT.EXE (not sure offhand if it allows one to manipulate the flags) hold the answer.  I'll try to check later.

 

Originally posted by Skeeto Is there a way to secure deletion of all virtual registry keys for every user when deleting the HKEY_LOCAL_MACHINE key?

I suppose from an admin account one might be able to do something like iterate through the registry virtual roots (HKEY_USERS\<USER_SID>\Software\Classes\VirtualStore\ MACHINE\SOFTWARE), looking for the (un)desired keys.  Not tested though - just speculating that this might work.

Again, though - if the reg flags are set appropriately, this wouldn't seem to be an issue.  And if you were able to make your programs not be considered legacy, it would also seem that virtualization would not be an issue.

 

Originally posted by Skeeto Our conclusion is manifest files is a solution for apps made in C++, C#, VB etc. - in other words developed with Visual studio.

"The MT.EXE tool that ships with Visual Studio or the Vista SDK can allow you to embed a manifest as a Windows Resource in an EXE file."

Haven't tried it, but seems like it should work for Director.

Additional info here.

 

Originally posted by Skeeto it seems that Virtualization will not be supported in coming versions of Windows

Yes, the Registry Virtual article on MSDN does state:

This form of virtualization is an interim application compatibility technology; Microsoft intends to remove it from future versions of the Windows operating system as more applications are made compatible with Windows Vista.

 

Originally posted by Skeeto as it is not on 64bit

EDIT:

I'm a bit torn on how to interpret 64-bit Vista's support for UAC / virtualization.  To me, it would seem that it is on 64-bit, but 64-bit processes are not virtualized as they are not considered legacy.

 

Paul Thurrott states in the May 2007 Windows IT Pro "What You Need to Know" article about "More Vista Security Technologies":

Because file system and registry virtualization is a stop-gap measure intended to make legacy software compatible with Vista, such virtualization is available only in the 32-bit versions of Vista.

 

Mark's Technet article on UAC doesn't explicitly state that file system and registry virtualization are or are not available on 64-bit Vista, but I'm inclined to think that they are because there is presumably a strong chance that one might run a "legacy" 32-bit process that will need to be virtualized, on the 64-bit OS.

 

Mark's article does state:

For the purposes of this virtualization, Windows Vista treats a process as legacy if it’s 32-bit (versus 64-bit) [...]

Since a 64-bit process cannot run on a 32-bit version of Vista, can the distinction be interpreted as meaning that a 32-bit process running on 64-bit Vista will be considered "legacy"*, and thus subject to virtualization?

 

 

Again, many thanks for your time and advice.

 

I tried to embed a manifest file again on the Director projector files, with no luck though. I know for sure that previously versions of Director projector exe's was not "normal" exe files. I dont know for sure if latest version is 100% compatible. I have asked in Director forum about any experience with embedding manifest file. I do know we can digitally sign them though.

 

What happens is I get no error message, but the file shrinks in size and I can see the internal media are missing after embedding manifest.

 

I think we will leave the problem as it is and support the hopefully few customers with this problem (getting old software installed on Vista) on a per case basis.

The new versions we make will behave nicely and shouldnt create any problems with virtualization at all.

 

All the best

 

Skeeto