Deleting Windows registry entries

[riverdogs05]

In Windows registry under HKLM\system\cset001\enum\root\
cannot delete any of the Legacy entries - get error message Cannot delete
xxxxxxx (white X enclosed in a red globe).
First what are the Legacy entries ?
Second why can't entries be deleted even if they bad stuff ?

 

[Wesley Vogel]

If you do not know what they are why are you trying to delete them?

Almost everything in
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root
is a LEGACY_something.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[riverdogs05]

Oh I know what they are and/or represent-that's why I want to get rid of
them-some represent 'baddies'.

For a SUPPOSED MS-MVP, your response is totally uninformative and
essentially almost worthless.
And I probably have been working with computers much longer than you-over 35
yrs and you cannot even answer some simple questions.

 

[Stan Brown]

For a SUPPOSED MS-MVP, your response is totally uninformative and
essentially almost worthless.

Then I think you should get a refund of every cent you paid for the
assistance.

 

[Wesley Vogel]

Then you do not need my help, do you?

ControlSet001 is probably the last control set you booted with and the
LEGACY_ entries are related to services, non plug and play drivers. For
example, LEGACY_AFD is AFD Networking Support Environment. LEGACY_AVG7CORE
is Avg7Core for AVG Antivirus. LEGACY_BEEP is Beep. LEGACY_NETBIOS is the
NetBIOS Interface.

You can see these in the Device Manager.
Device Manager | View | Show Hidden Devices |
Expand Non-Plug and Play Drivers |
* LEGACY_AFD is listed as AFD Networking Support Environment, AFD.sys.
* LEGACY_BEEP is listed as Beep, Beep.sys.
* LEGACY_AVG7CORE is listed as AVG7 kernel, Avg7Core.sys.
* LEGACY_NETBIOS is listed as NetBios over Tcpip, NetBT.sys.

..sys files are drivers, whether for hardware or software devices. Almost
any AV software will be listed in Device Manger, firewall software also.
vsdatant.sys for the TrueVector Internet Monitor service (ZoneAlarm),
LEGACY_VSDATANT.

Keep reading for why you cannot delete things. You may need to use the
Device Manager to get rid of baddies.

[[Enum
HKLM\SYSTEM\CurrentControlSet

Description
The Enum subkey contains a database representing all devices installed on
the computer and recognized by the system. The database in Enum stores
configuration data for hardware devices independent of the drivers they use.
This subkey is critical to the configuration of Plug and Play devices in
Windows 2000.

Change method
To change device settings, use Device Manager.

Note
Users, including administrators, cannot view or change the contents of the
Enum subkey. These restrictions protect the integrity of the operating
system and the devices on the computer.

Tip
To display hidden devices, non–Plug and Play devices, and devices not
attached to the computer (commonly known as "ghosted" or "phantom" devices),
type set DEVMGR_SHOW_NONPRESENT_DEVICES=1 at the command line. Then, use
Device Manager to remove or reconfigure these devices. Do not edit the
registry. For more information, see Viewing Hidden Devices in the Windows
2000 Professional Resource Kit.

Caution
Do not attempt to change the permissions on the Enum subkey. If you do, you
might damage the sequence of inherited permissions in the registry. If you
change the content of the Enum subkey, you can damage the Plug and Play
functions of Windows 2000 and prevent devices from operating. If you must
gain access to the Enum subkey, contact Microsoft Product Support
Services.]]
from...
Enum
http://www.microsoft.com/resources/...er/reskit/en-us/regentry/30004.asp?frame=true

[[A control set contains system configuration information such as device
drivers and services. You may notice several instances of control sets when
viewing the Registry. Some are duplicates or mirror images of others and
some are unique. This article describes how to find control sets, which ones
are important, and why.

Control sets are stored in the HKEY_LOCAL_MACHINE subtree, under the SYSTEM
key. There may be several control sets depending on how often you change
system settings or have problems with the settings you choose.

\ControlSet001
\ControlSet002
\CurrentControlSet

ControlSet001 may be the last control set you booted with, while
ControlSet002 could be what is known as the last known good control set, or
the control set that last successfully booted Windows NT. The
CurrentControlSet subkey is really a pointer to one of the ControlSetXXX
keys.

The most valuable and reliable control set is CurrentControlSet. If you need
to modify system settings in the Registry, CurrentControlSet is the best
subkey to choose because you know that it is the correct control set. You
also know that if your modifications harm your system configuration, you
will still be able to boot using the last known good control set. ]]
from...
What are Control Sets? What is CurrentControlSet?
http://support.microsoft.com/kb/100010


PART 1 CurrentControlSet
http://support.microsoft.com/default.aspx?scid=kb;en-us;102987

PART 2 CurrentControlSet SessionManager
http://support.microsoft.com/kb/102985

PART 3 CurrentControlSet
http://support.microsoft.com/default.aspx?scid=kb;en-us;102986

Information on Last Known Good Control Set
http://support.microsoft.com/default.aspx?scid=kb;en-us;101790

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Wesley Vogel]

I failed to mention that some of these LEGACY_somethings are services.

For example....
LEGACY_ALERTER is the Alerter service.
LEGACY_CISVC is the Indexing Service service.
LEGACY_ERSVC is the Error Reporting Service.
LEGACY_W32TIME is the Windows Time service.
LEGACY_WUAUSERV is the Automatic Updates service.

And if some baddies need removed and are listed as a service.

To delete a service.

Open Services...
Start | Run | Type: services.msc | Click OK |
Scroll down to and double click the service you want to get rid of |
On the General tab, Service name: take note of the Service Name not the
Display Name | Close Services

Then open a command prompt...
Start | Run | Type: cmd | Click OK |

Type: sc delete Whateverservice Display Name

and hit Enter

Reboot.

See...
sc delete
here...
http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/sc.mspx

Or open the Registry Editor...
Start | Run | Type: regedit | Click OK |
Navigate to...
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Whateverservice

Delete it and reboot.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Then you do not need my help, do you?

ControlSet001 is probably the last control set you booted with and the
LEGACY_ entries are related to services, non plug and play drivers. For
example, LEGACY_AFD is AFD Networking Support Environment.
LEGACY_AVG7CORE is Avg7Core for AVG Antivirus. LEGACY_BEEP is Beep.
LEGACY_NETBIOS is the NetBIOS Interface.

You can see these in the Device Manager.
Device Manager | View | Show Hidden Devices |
Expand Non-Plug and Play Drivers |
* LEGACY_AFD is listed as AFD Networking Support Environment, AFD.sys.
* LEGACY_BEEP is listed as Beep, Beep.sys.
* LEGACY_AVG7CORE is listed as AVG7 kernel, Avg7Core.sys.
* LEGACY_NETBIOS is listed as NetBios over Tcpip, NetBT.sys.

.sys files are drivers, whether for hardware or software devices. Almost
any AV software will be listed in Device Manger, firewall software also.
vsdatant.sys for the TrueVector Internet Monitor service (ZoneAlarm),
LEGACY_VSDATANT.

Keep reading for why you cannot delete things. You may need to use the
Device Manager to get rid of baddies.

[[Enum
HKLM\SYSTEM\CurrentControlSet

Description
The Enum subkey contains a database representing all devices installed on
the computer and recognized by the system. The database in Enum stores
configuration data for hardware devices independent of the drivers they
use. This subkey is critical to the configuration of Plug and Play
devices in Windows 2000.

Change method
To change device settings, use Device Manager.

Note
Users, including administrators, cannot view or change the contents of the
Enum subkey. These restrictions protect the integrity of the operating
system and the devices on the computer.

Tip
To display hidden devices, non–Plug and Play devices, and devices not
attached to the computer (commonly known as "ghosted" or "phantom"
devices), type set DEVMGR_SHOW_NONPRESENT_DEVICES=1 at the command line.
Then, use Device Manager to remove or reconfigure these devices. Do not
edit the registry. For more information, see Viewing Hidden Devices in
the Windows 2000 Professional Resource Kit.

Caution
Do not attempt to change the permissions on the Enum subkey. If you do,
you might damage the sequence of inherited permissions in the registry.
If you change the content of the Enum subkey, you can damage the Plug and
Play functions of Windows 2000 and prevent devices from operating. If you
must gain access to the Enum subkey, contact Microsoft Product Support
Services.]]
from...
Enum
http://www.microsoft.com/resources/...er/reskit/en-us/regentry/30004.asp?frame=true

[[A control set contains system configuration information such as device
drivers and services. You may notice several instances of control sets
when viewing the Registry. Some are duplicates or mirror images of others
and some are unique. This article describes how to find control sets,
which ones are important, and why.

Control sets are stored in the HKEY_LOCAL_MACHINE subtree, under the
SYSTEM key. There may be several control sets depending on how often you
change system settings or have problems with the settings you choose.

\ControlSet001
\ControlSet002
\CurrentControlSet

ControlSet001 may be the last control set you booted with, while
ControlSet002 could be what is known as the last known good control set,
or the control set that last successfully booted Windows NT. The
CurrentControlSet subkey is really a pointer to one of the ControlSetXXX
keys.

The most valuable and reliable control set is CurrentControlSet. If you
need to modify system settings in the Registry, CurrentControlSet is the
best subkey to choose because you know that it is the correct control
set. You also know that if your modifications harm your system
configuration, you will still be able to boot using the last known good
control set. ]] from...
What are Control Sets? What is CurrentControlSet?
http://support.microsoft.com/kb/100010


PART 1 CurrentControlSet
http://support.microsoft.com/default.aspx?scid=kb;en-us;102987

PART 2 CurrentControlSet SessionManager
http://support.microsoft.com/kb/102985

PART 3 CurrentControlSet
http://support.microsoft.com/default.aspx?scid=kb;en-us;102986

Information on Last Known Good Control Set
http://support.microsoft.com/default.aspx?scid=kb;en-us;101790

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Oh I know what they are and/or represent-that's why I want to get rid of
them-some represent 'baddies'.

For a SUPPOSED MS-MVP, your response is totally uninformative and
essentially almost worthless.
And I probably have been working with computers much longer than you-over
35 yrs and you cannot even answer some simple questions.

 

[Vanguard]

In Windows registry under HKLM\system\cset001\enum\root\
cannot delete any of the Legacy entries - get error message Cannot delete
xxxxxxx (white X enclosed in a red globe).
First what are the Legacy entries ?
Second why can't entries be deleted even if they bad stuff ?

Right-click and change permissions. Add the Everyone group. Don't blame me
because you don't bother to backup the registry or when you go deleting
registry entries that you shouldn't be touching.

 

[Wesley Vogel]

Note
Users, including administrators, cannot view or change the contents of the
Enum subkey. These restrictions protect the integrity of the operating
system and the devices on the computer.

Tip
To display hidden devices, non–Plug and Play devices, and devices not
attached to the computer (commonly known as "ghosted" or "phantom" devices),
type set DEVMGR_SHOW_NONPRESENT_DEVICES=1 at the command line. Then, use
Device Manager to remove or reconfigure these devices. Do not edit the
registry. For more information, see Viewing Hidden Devices in the Windows
2000 Professional Resource Kit.

Caution
Do not attempt to change the permissions on the Enum subkey. If you do, you
might damage the sequence of inherited permissions in the registry. If you
change the content of the Enum subkey, you can damage the Plug and Play
functions of Windows 2000 and prevent devices from operating. If you must
gain access to the Enum subkey, contact Microsoft Product Support
Services.]]
from...
Enum
http://www.microsoft.com/resources/...er/reskit/en-us/regentry/30004.asp?frame=true

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Vanguard]

Note
Users, including administrators, cannot view or change the contents of the
Enum subkey. These restrictions protect the integrity of the operating
system and the devices on the computer.

Except that I remember editing a subkey under the Enum key (albeit in the
CurrentControlSet and not under the other versions 1, 2, and on up). I had
a modem that kept getting reinstalled although I had supposedly removed the
device and its software. I then found an .inf will under the INF folder for
the device so I removed it. However, the device still showed up in Device
Manager so I had to find it under the Enum key to remove it. Only after
that could I then properly install new drivers for the device. The new
software wouldn't install because the device was already defined in the
registry so I had to remove it.

I don't recall having to change permissions to do the editing under the Enum
key, but it has been about 4 years since I got stuck having to make the fix
in the registry.

I've read some articles which even mention deleting the Enum key whereupon
Windows will redetect all your hardware on the next boot. That might work
under 95-based versions of Windows; however, on NT-based versions, I suspect
that would lead to an INACCESSIBLE_BOOT_DEVICE blue screen since you have
removed the mass storage devices whereupon the OS is installed (so you would
get stuck having to do a repair install/upgrade). I supposed if scanning
for new hardware changes doesn't work in Add/Remove Hardware applet then you
could do it this way. The Enum key holds information about all the devices
and peripherals installed in the computer (device type, drive letter,
hardware ID and manufacturer). Well, obviously when you first installed
Windows, all this information had to be built at that time. The Enum key
might also list devices that are not currently available; for example, if
you have changed your monitor, both monitors might have an entry under HKEY_
LOCAL_ MACHINE\ Enum\ Monitor. In fact, I've seen several times when
hardware was listed that is no longer in the system, and sometimes this will
interfere with driver installs when that hardware is readded or redetected.
Some driver installs will behave as upgrades instead of as full installs
which means they will reuse the values that already exist in an old but
perhaps invalid entry.

I don't recall that I was barred from making changes under the Enum registry
key. However, for some devices, like hard drives, there are more registry
entries that are associated or interdependent on the Enum keys so you end up
having to track your way around in the registry looking for those
dependencies. Some of the Enum keys are added by PnP which means the admins
don't have, by default, access to those keys but the admin can still change
permissions to add the admins for full permissions which then lets them
delete the key.

I'm not the only one that has gone under the Enum key to correct screwups by
Windows. Read "Add New Hardware Error Message" section at
http://www.kellys-korner-xp.com/xp_a.htm. Googling shows that users have
often had to edit entries under the Enum key to get their hardware to work,
remove old non-existing hardware, get detection to work, get driver installs
to work, or just to fix the device name (I had to do this when I got some
indexed numbering on my LAN connectoid because a new entry was added for my
NIC rather than overriding the old one upon a driver reinstall).

Editing the registry is not for novices, and editing under the Enum key
requires a lot of prep by the user to understand the registry. Obviously
disk images for quick restores and/or backups of the registry help to
overcome goofs made even by the most experienced registry editing user.

 

[Wesley Vogel]

You make good points.

I believe that you can uninstall typical hidden devices and phantom devices
from the Device Manager.

Device Manager Does Not Display Devices That Are Not Connected to the
Windows XP-Based Computer
http://support.microsoft.com/kb/315539

Seems to me I had to do something like that to remove a printer that was
long in the dumpster when I wanted to install a new one that was the same
model. Trying to install the new one and HP's software kept telling me I
had to install it as whatever the name was #2 because XP thought #1 was
still installed. This was after I had thought that I had uninstalled it in
Device Manager and Add or Remove Programs. The cable wasn't long enough to
reach from the land fill though.

Like you said, "Editing the registry is not for novices..."

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In