Installation Mode and Registry Mapping

During the installation of a conventional 32-bit application, a number of entries are made in the registry’s HKLM\SOFTWARE section. These entries are used for initialization purposes when a user starts the application. Individual changes to the applications result in entries under HKCU\SOFTWARE and therefore affect the user profile.

Note

The default installation directory for applications is defined under the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir key. This key is identical to the %ProgramFiles% environment variable.

As described in detail in Chapter 5, installing applications on a terminal server differs from the corresponding installation routines under Windows XP for only one interactive user. The reasons for this are found in the application parameters that are managed by the registry and occasionally .ini files. There are two potential problems that can occur that are particularly associated with registering:

1. When an application is installed, registry keys needed by all users are not defined globally in HKLM\SOFTWARE, but individually in HKCU\SOFTWARE. Thus, important data is located exclusively in the administrator’s profile.

2. Necessary registry keys are not set up in HKCU\SOFTWARE during installation. They are entered only when the user runs the application for the first time. However, it might be necessary for the administrator to predefine certain values.

To solve both problems, terminal servers have two modes: the installation mode for application installations, and the execution mode for standard operation. What role does the registry play? If the terminal server is running in installation mode, all user-specific registry entries saved under HKCU\SOFTWARE are also copied to the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software registry hive. Therefore, this hive is also called the shadow copy.

Note

An application that adheres strictly to terminal server development standards will not, of course, create any critical entries in HKCU\SOFTWARE during installation. Therefore, the shadow copy is irrelevant for this type of application.

Users will later launch applications that might anticipate initial entries in HKCU\SOFTWARE. However, these entries do not exist in the user profile nor in HKCU\SOFTWARE. Nonetheless, the application will still try to read these entries and might produce errors if it cannot. To avoid this problem, the information in the shadow copy overlays the user’s profile. This is known as registry mapping.

So how do user profiles and registry mapping create the resulting configuration where applications are concerned? When a user logs on, the session profile is built in multiple steps. First, system-wide configuration parameters for applications are loaded from HKLM\SOFTWARE. The entries in the user’s profile file are added subsequently. If the values of a certain application key are different in HKLM\SOFTWARE than the profile file, the individual profile file has priority. The system-wide configuration of application parameters should therefore be viewed as a suggestion or a default value. Group Policy is the better source for reliable central parameters. This overlies the existing configuration when the user profile is loaded. On a terminal server, the HKCU\SOFTWARE registry hive is also superimposed by the mirrored HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software section generated during active installation mode.

Note

To create user-specific entries in the ...\Terminal Server\Install registry hive, the hive might have to be modified through environment variables (for example, with %UserName%). This implies using the REG_EXPAND_SZ data type to convert the environment variable to a valid character string when the registry is read. Unfortunately, not all applications interpret this conversion correctly and sometimes produce errors. Therefore, it is often necessary to elicit the desired behavior through logon scripts. (See Chapter 7.)

Automatic Application Execution

Windows Server 2003 offers the option to configure applications or scripts in the registry using different keys. These scripts run automatically if a certain event occurs. This mechanism can be used to perform initialization tasks required on terminal servers. However, to do so requires an understanding of the corresponding keys. The following list presents them in detail.

• HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run: Entered programs are executed upon each user logon.

• HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce: Entries made by executable programs are deleted after being processed.

• HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Run: Entered programs are executed upon each user logon.

• HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Load: Entered programs are executed upon each user logon.

• HKLM\SOFTWARE\Policies\Microsoft\System\Scripts: Usually configured through Group Policies.

• HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run: Default user is used as a template for new user profiles.

• HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run: Entered programs are executed upon each user logon.

• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce: Entries made by executable programs are deleted after being processed.

• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx: Entries made by executable programs are deleted after being processed.

• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run: Shadow copy.

• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\RunOnce: Shadow copy.

• HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup: Usually configured using Group Policies.

If an application or a script is to be run when a user logs off, the following key is used:

• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LogoffApp: Lists applications and scripts, separated by commas.

  Note

  If only a script is to be run when a user logs on, configuration takes place under computer administration or the domain based on the Profile tab of the corresponding user account. (See Chapter 4.)