Attempted registry write to HKLM writes to HKCR instead

Question

I've been tasked with updating an old Visual Studio C++ COM executable to work with Visual Studio 2010 and run on 64bit Windows 7. (The program itself is 32bit.)

Part of that process involves making sure registry reads/writes/creates still work and/or updating them to use HKEY_CURRENT_USER rather than HKEY_LOCAL_MACHINE . However, when testing the registry functions which use RegCreateKeyEx , RegQueryValue , RegSetValue , etc. and using ProcessMonitor to watch the registry accesses I noticed some (potentially?) odd behaviour.

When the root is specified as HKEY_CURRENT_USER everything seems to work as expected. For example, when trying to create the key

HKCU\Software\Classes\CLSID\[Guid]

ProcessMonitor will show the following key being created,

HKCU\Software\Classes\Wow6432Node\CLSID\[Guid]

Which is expected (32bit application on 64bit machine).

However, if the root is HKEY_LOCAL_MACHINE when trying to create the key

HKLM\Software\Classes\CLSID\[Guid]

ProcessMonitor will show the following key being created,

HKCR\Wow6432Node\CLSID\[Guid]

Is this expected behaviour? Does it have anything to do with restrictions to writing to HKEY_LOCAL_MACHINE? This is my first time really dealing with registry access, so I'm not familair with any nitty-gritty details. Through some research I've learned that HKEY_CLASSES_ROOT is some kind of amalgemation of HKCU and HKLM , though I'm not sure if that is relevant.

The program is running as Administrator with UAC disabled. The first registry access looks like this, with pszRootKey = 'Software/Classes' , and everything else builds off m_hk

dwErr = RegCreateKeyEx(
        HKEY_LOCAL_MACHINE, pszRootKey, 0, NULL, 0, KEY_ALL_ACCESS, NULL,
        &m_hk, NULL
        );

Edit:

When stepping through the code the above call to RegCreateKeyEx() produces the following in ProcessMonitor:

 Operation     | Path | Result  | Detail
---------------------------------------------------------------------------------
 RegQueryKey   | HKLM | SUCCESS | Query: HandleTags, HandleTags: 0x0
 RegCreateKey  | HKCR | SUCCESS | Desired Access: All Access, Disposition:REG_OPENED_EXISTING_KEY
 RegSetInfoKey | HKCR | SUCCESS | KeySetInformationClass: KeySetHandleTagsInformation, Length: 0

Answer 1

If you run your program with Administrator rights with UAC disabled, this will show your problem is not related to the User Account Control. Instead of this, the problem is very likely to be caused by WOW64. You can find more information about this at these locations:

• Registry Redirector
• Registry Keys Affected by WOW64