Novell is now a part of Micro Focus

Pruning an App Object of Un-needed Reg Entries

Novell Cool Solutions: Trench

Digg This - Slashdot This

Posted: 24 Oct 2003

Want to prune away all the extra registry entries that get included in a snAppShot, but don't do a darned thing for the application? You're not alone. So, if you know of registry entries that are automatically captured by snAppShot, but are superfluous to the App Object, let us know.

Update: Since this article was last updated three years ago, in Oct 2000 (and referred to ZENworks 2), we thought it was high time to ask for new entries.

Also, we just got this suggestion from Frans Erich, of the Netherlands. He comments:
In this article, no one is talking about the Cooltool "AxtClean.exe" downloadable at:

The application uses a cfg file that holds the unwanted entries. The application separates a dirty axt file in a cleaned axt file and a jnk file holding all the removed entries.

The cfg file's format is plain text so if we all should work in that format and publish unwanted entries on a collective site in that format, life could be easier.

Good suggestion. Now, everyone send us your candidates for things you can eliminate, and make sure you supply them in plain text.

Thumbs Up

Christian Riiser from Sweden, wrote: Woooohaaaadisch !!!! This new initiative of making the ultimate prune list is _REALLY_ great. Who hasn't asked himself, - "WTF, did this application make ALL these small changes to the registry?" And when starting to snapshot on Win2000 THIS list will grow EVEN bigger, trust me on this one.... :-) Keep it up !!!


Julian Greenwood

I have been looking for a list of reg entries that are captured by snAppShot but are not part of the Application and can be removed. I have not been able to find such a list but maybe we can start one.

Here is one registry entry that always seems to be captured and is not needed (and may even cause a problem if not removed).

I have checked this information with Microsoft.




are screen location registrations in which Windows saves size and location information for closed windows in the first registry location. Windows saves size and location information for up to 28 different windows. Each window's size and location parameters are stored in a subkey of the streams key.

Therefore removing these keys from App Objects will not impact the AO and may even resolve some problems that Microsoft has seen of what is called Cross Linking, where multiple programs write window size and location information into the same Stream SubKey.

Supporting Documentation:

Danny Stark

Watch out for this registry key:

HKEY_LOCAL_MACHINE\System\ CurrentControlSet\Services\ VxD\DHCP

If you use a DHCP server to assign IP addresses, your lease could get renewed and added to the snAppShot.

Eric Fairbanks

Try this technique to start building your list of unnecessary items to prune. Start a snAppShot, open and close Windows Explorer and Notepad (two things you may commonly use when installing an application), then reboot your machine (sometimes a requirement to complete an application installation). When your system comes back up, finish the snAppShot.

This "Reboot object" will contain more than just registry entries that aren't needed, but also files that are changed or created on each reboot. Most (if not all) of the items discovered in this process are not needed.

Ewen Anderson

Regarding "Pruning an App Object of Un-needed Reg Entries", Centralis has developed an application (AXE) which does just that - it allows you to store and apply rules to .AXT files, and even makes deploying IE5 to Terminal Server via ZENworks relatively simple.

We can store a list of known entries as rules, as well as replacing paths, strings, etc., with environment variables, so your list could come in very handy.

The app will be ready next month, and we're hoping to make a trial version available via Cool Solutions as soon as it's available. (Our Terminal Server snapin for NWAdmin is already featured).

If you have any questions you may contact Ewen at

Gary Harris

Stuff to ignore in a snAppShot.

  • Setup your "master" machine to not save settings and you will avoid most of the worthless registry entries.
  • Use "Tweak UI" to set "Save window settings" = NO
  • Set Client 32 properties "Save profile on exit" = NO (in the Location Profile Properties)
  • Set "Disable Password Caching" in Workstation Package / Computer System Policies

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\Policies\Network] "DisablePwdCaching"=dword:00000001

  • I always use the same user and computer name, etc., for snAppShots. I can then ignore:
    • all entries under "mru"
    • all entries under "uuid"
    • all entries under "710-" (room number)
    • all entries under "test" (user)
    • all entries under "dhcpinfo" (delete entire key)
  • Use an "INI" file with snAppShot, mine keeps growing with files and directories to ignore.

[Exclude Files]

  • *.bak=
  • *.ft?=
  • *.gid=
  • *.log=
  • *.mtx=
  • *.old=
  • *.reg=
  • *.swp=
  • *.wcm=
  • Drvdata.bin=
  • Drvidx.bin=
  • faultlog.txt=
  • nbihw.cfg=
  • ndislog.txt=
  • ntuser.dat=
  • ntuser.dat.log=
  • pagefile.sys=
  • ShellIconCache=
  • snpstat.ini=
  • system.da0=
  • system.dat=
  • tmpdelis.bat=
  • ttfcache=
  • user.da0=
  • user.dat=
  • winicon.csh=

[Exclude Directories]

  • C:\AOT=
  • C:\ati=
  • C:\Faxpress=
  • C:\Netscape=
  • C:\Notes=
  • C:\novell=
  • C:\recycled=
  • C:\recycler=
  • C:\snApshot.dir=
  • C:\TEMP=
  • C:\WINDOWS\Favorites=
  • C:\WINDOWS\History=
  • C:\WINDOWS\recent=
  • C:\WINDOWS\system32\config=
  • C:\WINDOWS\temp=
  • C:\WINDOWS\Temporary Internet Files=

[System Configuration Text Files]

  • C:\autoexec.bat=
  • C:\autoexec.dos=
  • C:\config.dos=
  • C:\config.sys=
  • C:\msdos.sys=

Other stuff to ignore

  • HKEY_LOCAL_MACHINE\SOFTWARE\ Description\Microsoft\Rpc\UuidPersistentData
  • HKEY_CURRENT_USER\Control Panel\ Appearance
  • HKEY_LOCAL_MACHINE\System\ CurrentControlSet\Services\VxD\ DHCP\DhcpInfo00

If you have any questions you may contact Gary at

Paul Ponting

  • This registry key may need further checking as it may contain the username of the person creating the app object:
  • Another un-needed registry key that may be created:
    HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\ Explorer\RunMRU

If you have any questions you may contact Paul at

Daniel Reed

From WinNT4 Resource Kit utility, SYSDIFF.EXE: SYSDIFF.INF has some predefined registry enties, files, and folders to exclude. I have added a few more under lines, commented by DJR initials, that I noticed were also not needed. Just some more entries to think of excluding.



  • Signature = "$Windows NT$"


  • The first character on each line is the drive letter of a drive to exclude.
    • c
    • d
    • e
  • General notes for file/dir exclusion sections:
    • *: refers to all drives.
    • ?: refers to the drive with the system on it.
    • :: is substituted with %systemroot%
    • Lines that are not in valid format (such as those that don't start with x:\) are ignored.


  • Each line is a fully-qualified path of a tree to be excluded. The directory and all of its subtrees are excluded.
    • *:\recycled
    • *:\recycler
    • added 10:55 AM 04/17/2000 DJR
    • *:\temp


  • Each line is a fully-qualified path of a directory to be excluded. The directory's subdirs are NOT excluded.
    • ::\system32\config
    • ::\system32\logfiles


  • Each line is a fully-qualified path of a file to be excluded. If it does not start with x:\ then we assume it's a filename part for a file to be excluded whereever it is found.
    • *:\pagefile.sys
    • ntuser.dat
    • ntuser.dat.log
  • added 10:55 AM 04/17/2000 DJR. Names used by DJR for before & after DIFF file snAppShots.
    • before.dif
    • after.dif


  • Each line in here is a fully qualified path of a directory whose files are all to be included in a diff (marked as added/changed). Use this if you want to include files in the diff that might not have actually been changed.


    Each line indicates a single registry key to be excluded. Subkeys of this key are not excluded. The first field is one of HKLM or HKCU. The second field is the subkey, which must NOT start with a \.

    • HKLM,System\Disk
    • HKLM,System\Select
    • HKLM,System\Setup
    • HKCU,Software\Microsoft\Windows\ CurrentVersion\Explorer\RunMRU


    Each line indicates a registry key and subkeys to be excluded. The first field is one of HKLM or HKCU. The second field is the subkey, which must NOT start with a \.

    • HKLM,SYSTEM\ControlSet001
    • HKLM,SYSTEM\ControlSet002
    • HKLM,SYSTEM\ControlSet003
    • HKLM,SYSTEM\ControlSet004
    • HKLM,SYSTEM\ControlSet005
    • HKLM,SYSTEM\ControlSet006
    • HKLM,SYSTEM\ControlSet007
    • HKLM,SYSTEM\ControlSet008
    • HKLM,SYSTEM\ControlSet009
    • HKLM,SYSTEM\CurrentControlSet\Enum
    • HKLM,"SOFTWARE\Microsoft\Windows NT\ CurrentVersion\perflib"
  • added 11:37 AM 04/18/2000 DJR
    • HKLM,"SOFTWARE\Microsoft\Windows\ CurrentVersion\Reliability"
    • HKCU,"Software\Microsoft\Windows\ CurrentVersion\Explorer\ExpView"
    • HKCU,"Software\Microsoft\Windows\ CurrentVersion\Explorer\RecentDocs"
    • HKCU,"Software\Microsoft\Windows\ CurrentVersion\Explorer\StreamMRU"
    • HKCU,"Software\Microsoft\Windows\ CurrentVersion\Explorer\Streams"


    Each line indicates a registry value entry to be excluded. The first field is one of HKLM or HKCU. The second field is the subkey, which must NOT start with \. The third field is the value entry name.


    Karen Moore

    If you run NAL and reboot during your snAppShot process, you can delete:




    These entries are user-specific for NAL distributed apps and are updated each time a user logs in. If captured during the snAppShot process, unneeded registry entries for the user who created the snAppShot will be pushed down to your user's machines.

    My recommendation is to not run NAL during your snAppShot process.

    If you have any questions you may contact Karen at

    Stephanie Burrill

    We typically "prune" the following additional entries:

    • HKLM\Software\Novell\ Login\History\Contexts
    • HKLM\Software\Microsoft\ Windows\CurrentVersion\Explorer\ RunMRU (List of commands in Windows menu: Start, File, Run)

    Registry Keys used in WINS configuration:

    • HKLM\System\CurrentControlSet\ Services\Class\NetTrans\ xxxx\NameServer1 (stores IP address of WINS server)
    • HKLM\System\CurrentControlSet\ Services\Class\NetTrans\xxxx\ NodeType

    Note: xxxx is a number which varies from computer to computer (eg. 0003)

    Additional Registry keys used for DHCP:

    • HKLM\System\CurrentControlSet\ Services\VxD\DHCPOptions

    Christian Geffcken

    In any case, it seems that the value HKLM/System/CurrentControlSet/ Control/Windows/ShutdownTime is irrelevant to an AOT file.

    Moreover, when you modify the HKLM/System/CurrentControlSet, the corresponding keys & values in HKLM/System/ControlSet001 (001 is the default, see HKLM/System/Select) are always updated. So maybe they are not necessary to be put in the AOT, specifically if the PC will reboot just after (see also NT Resource Kit).

    If you have any questions you may contact Chris at

    Cory Zerwas

    I've noticed that the following key tends to be included in the AOT if the app required a reboot. I have not seen this key cause any problems if left in the app, just rather be safe than sorry.

    "HKLM\Software\Description\ Microsoft\Rpc\UuidPersistentData"

    Raymon Epping NEW

    Here is another one:

    HKEY_LOCAL_MACHINE\Software\ Novell\Workstation Manager\


    HKEY_LOCAL_MACHINE\Software\ Novell\Workstation Manager\ Scheduler\NAL workstation association agent\

    If you have any questions you may contact Raymon at

    Rainer Mueller-Knoche

    Just reading your article "Pruning an App Object of Un-needed Reg Entries". Some nice Tips in there and I'd like to give an additional. As a CNI I give a lot of ZEN trainings and workshops. To get some hints on un-needed entries I suggest the following to my students.

    Let's play SETUP.EXE, that means start snAppShot, go ahead until "Run Application Install" then do manually what a SETUP.EXE will do.

    1. Create a directory TEST under C:\, and copy NOTEPAD.EXE into it.
    2. Create a File TEST.TXT and copy it into C:\TEST.
    3. Play around with the explorer.exe, open it, do some searches on .exe files (like you may do searching the setup.exe you need for your app).
    4. Start IE or NETSCAPE.
    5. Go to the Internet and search for something (like you do to get additional information for the application you're installing).
    6. Open some readme.txt or .doc, .pdf files (like you may do to get more information on the app you're installing).
    7. Do a lot of such funny things.
    8. Then do what nearly every app installation on Windows wants you to do.
      • Restart your computer.
      • Login again.
      • Continue snAppShot, but before letting do snAppShot the rest, start your new install NOTEPAD.EXE under C:\TEST. Open C:\TEST\TEXT.TXT with it, do some changes, save them and close the app.

    9. Now go on with snAppShot doing the rest.

    While snAppShot does its second scan, take time to compare. I ask the students what they expect to see as delta. Let's say as application information after importing it in NWADMIN or ConsoleOne. Normally they guess that there will be no registry entry, no .ini files, etc. Just one new directory and two new files in the appfiles tab.

    Depending on what the students did, what they really get is about 20 to 150 reg entries, some in files, about 10 to 20 other new files, some shortcuts, and a lot of more things in ZEN 3 (NALCache should be excluded by default).

    This practice won't give you a complete list, but you'll get quite a good list of all items, reg entries, .ini etc. in your environment which are never relevant to your app and often give a lot of problems distributing them in your app rollout.

    Rainer Mueller-Knoche, CNE/CNI, Nuernberg, Germany

    If you have any questions you may contact Rainer at

    Novell Cool Solutions (corporate web communities) are produced by WebWise Solutions.

  • © Copyright Micro Focus or one of its affiliates