INFO: Windows NT/2000/XP Uses KnownDLLs Registry Entry to Find DLLs

Microsoft Windows NT, Windows 2000, and Windows XP uses the KnownDLLs registry entries to search for either 32-bit or 16-bit DLLs when loading the DLL. For 32-bit DLLs the KnownDLLs registry entry only affects the search for implicitly loaded DLLs. For 16-bit DLLs the KnownDLLs registry entry affects the search for both implicitly and explicitly loaded DLLs. If you incorrectly include a DLL name in the KnownDLLs registry entry, the LoadLibrary in Windows NT/2000/XP WOW fails to load a DLL located in the application's current directory.

Windows NT/2000/XP uses the KnownDLLs registry entry to determine which DLL an application will use. There are two different KnownDLLs registry entries: one that affects the loading of 32-bit DLLs, and one that affects the loading of 16-bit DLLs. A DLL listed in the KnownDLLs registry entry is sometimes referred to as a "KnownDLL" in this article.

DLLs: 16-bit

For 16-bit DLLs, the KnownDLLs registry value is found in the following key: The KnownDLLs registry value is a REG_SZ string with DLL names in 8.3 format, separated by a space. The KnownDLLs value affects both implicitly and explicitly loaded DLLs.

Without the KnownDLLs registry value, Windows NT WOW uses the following search order to locate the DLL:

1. The current directory of the task that is using the DLL.
2. The \WINNT directory.
3. The \WINNT\SYSTEM directory.
4. The \WINNT\SYSTEM32 directory.
5. The directory of the executable for the task that is using the DLL.
6. A directory listed in the PATH environment variable.

With the KnownDLLs registry value, Windows NT WOW only looks in the \WINNT\SYSTEM32 directory to locate the DLL. If KnownDLLs includes an entry for a DLL that is not located in the \WINNT\SYSTEM32 directory, LoadLibrary fails to load the DLL even if the DLL is located at any of the 5 other locations above.

If Windows NT/2000/XP WOW fails to locate the DLL, LoadLibrary returns error code 2 (File Not Found), or the implicit linking causes the parent module to fail to load.

For information about how Windows 95 registers 16-Bit DLLs as KnownDLLs see the following article in the Microsoft Knowledge Base:

DLLs: 32-bit

For 32-bit DLLs the KnownDLLs registry key is found at: The REG_SZ registry value name is the name of the DLL without the extension. The registry value data is the name of the DLL with the extension. This entry affects only implicitly loaded DLLs, not DLLs loaded using the LoadLibrary() API.

Without this entry, Windows NT uses the following search order to locate the DLL:

1. The directory of the executable for the process that is loading the DLL.
2. The current directory of the process that is loading the DLL.
3. The \WINNT\SYSTEM32 directory.
4. The \WINNT directory.
5. A directory listed in the path environment variable.

With the KnownDLLs registry entry, Windows NT uses the following search order to locate the DLL:

1. The \WINNT\SYSTEM32 directory.
2. The directory of the executable for the process that is loading the DLL.
3. The current directory of the process that is loading the DLL.
4. The \WINNT directory.
5. A directory listed in the PATH environment variable.

If the DLL is not located in any of the locations mentioned above, the implicit linking causes the parent module to fail to load.

A DLL is treated as a KnownDLL if a KnownDLL implicitly links to it. For example, MAIN.DLL uses functions from CHILD.DLL. If MAIN.DLL is listed in the KnownDLLs registry key, then Windows NT also treats CHILD.DLL as a KnownDLL. Another application or DLL that uses CHILD.DLL will use the DLL that was linked to MAIN.DLL.

Windows NT maps 32-bit KnownDLLs at boot time. Renaming or moving the DLL does not have any effect on which DLL an application will load; it still uses the one that was in \WINNT\SYSTEM32 at boot time.

To alter how Windows NT loads KnownDLLs use the ExcludeFromKnownDlls registry value located at: NOTE: Use RegEdt32 instead of RegEdit to modify this registry value.

This REG_MULTI_SZ registry value contains names of DLLs in 8.3 format, one DLL per string. If a DLL is listed in ExcludeFromKnownDlls, then Windows NT does not treat the DLL as a KnownDLL, even if it is listed in the KnownDLLs registry key. This is useful when you develop a DLL that is used by a lot of other KnownDLLs and it is important to replace and test new builds without rebooting Windows NT.

Making changes to the aforementioned registry keys requires administrative privileges to the local machine. The use of KnownDLLs secures the system from someone deceptively replacing APIs by placing a rogue DLL in the application directory.

For information about how Windows 95 registers 32-Bit DLLs as KnownDLLs see the following article in the Microsoft Knowledge Base: WARNING: Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

For information about how to edit the registry, view the "Changing Keys And Values" Help topic in Registry Editor (Regedit.exe) or the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe. Note that you should back up the registry before you edit it. If you are running Windows NT, you should also update your Emergency Repair Disk (ERD).