You are currently offline, waiting for your internet to reconnect

INFO: Windows NT/2000/XP Uses KnownDLLs Registry Entry to Find DLLs

This article was previously published under Q164501
IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:
256986 Description of the Microsoft Windows Registry
SUMMARY
Microsoft Windows NT, Windows 2000, and Windows XP uses the KnownDLLs registry entries to search for either 32-bit or 16-bit DLLs when loading the DLL. For 32-bit DLLs the KnownDLLs registry entry only affects the search for implicitly loaded DLLs. For 16-bit DLLs the KnownDLLs registry entry affects the search for both implicitly and explicitly loaded DLLs. If you incorrectly include a DLL name in the KnownDLLs registry entry, the LoadLibrary in Windows NT/2000/XP WOW fails to load a DLL located in the application's current directory.
MORE INFORMATION
Windows NT/2000/XP uses the KnownDLLs registry entry to determine which DLL an application will use. There are two different KnownDLLs registry entries: one that affects the loading of 32-bit DLLs, and one that affects the loading of 16-bit DLLs. A DLL listed in the KnownDLLs registry entry issometimes referred to as a "KnownDLL" in this article.

DLLs: 16-bit

For 16-bit DLLs, the KnownDLLs registry value is found in the followingkey:
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\WOW				
The KnownDLLs registry value is a REG_SZ string with DLL names in 8.3format, separated by a space. The KnownDLLs value affects both implicitlyand explicitly loaded DLLs.

Without the KnownDLLs registry value, Windows NT WOW uses the followingsearch order to locate the DLL:
  1. The current directory of the task that is using the DLL.
  2. The \WINNT directory.
  3. The \WINNT\SYSTEM directory.
  4. The \WINNT\SYSTEM32 directory.
  5. The directory of the executable for the task that is using the DLL.
  6. A directory listed in the PATH environment variable.
With the KnownDLLs registry value, Windows NT WOW only looks in the\WINNT\SYSTEM32 directory to locate the DLL. If KnownDLLs includes anentry for a DLL that is not located in the \WINNT\SYSTEM32 directory,LoadLibrary fails to load the DLL even if the DLL is located at any ofthe 5 other locations above.

If Windows NT/2000/XP WOW fails to locate the DLL, LoadLibrary returns error code 2 (File Not Found), or the implicit linking causes the parentmodule to fail to load.

For information about how Windows 95 registers 16-Bit DLLs as KnownDLLssee the following article in the Microsoft Knowledge Base:
141969Windows 95 Uses Known16DLLs Registry Key to Find 16-bit DLLs

DLLs: 32-bit

For 32-bit DLLs the KnownDLLs registry key is found at:
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager				
The REG_SZ registry value name is the name of the DLL without theextension. The registry value data is the name of the DLL with theextension. This entry affects only implicitly loaded DLLs, not DLLs loadedusing the LoadLibrary() API.

Without this entry, Windows NT uses the following search order tolocate the DLL:
  1. The directory of the executable for the process that is loading the DLL.
  2. The current directory of the process that is loading the DLL.
  3. The \WINNT\SYSTEM32 directory.
  4. The \WINNT directory.
  5. A directory listed in the path environment variable.
With the KnownDLLs registry entry, Windows NT uses the following searchorder to locate the DLL:
  1. The \WINNT\SYSTEM32 directory.
  2. The directory of the executable for the process that is loading the DLL.
  3. The current directory of the process that is loading the DLL.
  4. The \WINNT directory.
  5. A directory listed in the PATH environment variable.
If the DLL is not located in any of the locations mentioned above, theimplicit linking causes the parent module to fail to load.

A DLL is treated as a KnownDLL if a KnownDLL implicitly links to it. Forexample, MAIN.DLL uses functions from CHILD.DLL. If MAIN.DLL is listed inthe KnownDLLs registry key, then Windows NT also treats CHILD.DLL as aKnownDLL. Another application or DLL that uses CHILD.DLL will use the DLLthat was linked to MAIN.DLL.

Windows NT maps 32-bit KnownDLLs at boot time. Renaming or moving the DLLdoes not have any effect on which DLL an application will load; it stilluses the one that was in \WINNT\SYSTEM32 at boot time.

To alter how Windows NT loads KnownDLLs use the ExcludeFromKnownDllsregistry value located at:
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager				
NOTE: Use RegEdt32 instead of RegEdit to modify this registry value.

This REG_MULTI_SZ registry value contains names of DLLs in 8.3 format, oneDLL per string. If a DLL is listed in ExcludeFromKnownDlls, then Windows NTdoes not treat the DLL as a KnownDLL, even if it is listed in theKnownDLLs registry key. This is useful when you develop a DLL that is usedby a lot of other KnownDLLs and it is important to replace and test newbuilds without rebooting Windows NT.

Making changes to the aforementioned registry keys requires administrativeprivileges to the local machine. The use of KnownDLLs secures the systemfrom someone deceptively replacing APIs by placing a rogue DLL in theapplication directory.

For information about how Windows 95 registers 32-Bit DLLs as KnownDLLssee the following article in the Microsoft Knowledge Base:
151646Windows 95 Uses KnownDLLs Registry Key to Find 32-bit DLLs
WARNING: Using Registry Editor incorrectly can cause serious problems thatmay require you to reinstall your operating system. Microsoft cannotguarantee that problems resulting from the incorrect use of Registry Editorcan be solved. Use Registry Editor at your own risk.

For information about how to edit the registry, view the "Changing Keys AndValues" Help topic in Registry Editor (Regedit.exe) or the "Add and DeleteInformation in the Registry" and "Edit Registry Data" Help topics inRegedt32.exe. Note that you should back up the registry before you edit it.If you are running Windows NT, you should also update your EmergencyRepair Disk (ERD).
Properties

Article ID: 164501 - Last Review: 11/21/2006 15:45:00 - Revision: 4.1

  • Microsoft Win32 Application Programming Interface
  • kbinfo kbregistry kbdll kbkernbase KB164501
Feedback
html>ript> type="text/javascript" src="https://c.microsoft.com/ms.js" '="">/ms.js" '="">