Regedit Same Address Different Keys

What am I missing. I have two instances of Regedit running and I go to the same address but different keys show in each instance. How is that even possible? It is like two different machines and two different registries, but both instances of Regedit are from the same machine. I must be overlooking something. Any explanation for this issue is most welcomed.

Edited: Images have changed since my original OP to show more clearly show the "issue" (which was not really an issue, but just how Windows works; the issue turned out to be my ignorance)

tracit99 said:

What am I missing. I have two instances of Regedit running...

Out of interest @tracit99, how did you do that? I only seem to be able to open one instance however hard I try. What am I missing?

Hello @das10

Your link pointed me in the right direction to solve this "issue" my ignorance. I learned something new have learned some new things today. I had no idea that there are two different executables for Regedit (regedit.exe) one is 32 64 bit (C:\Windows\System32 C:\Windows) and one is 64 32 bit (C:\Windows\SysWOW64). The Regedit on the left is the 64 bit version and the Regedit on the right is the 32 bit version. This issue has shown me that sometimes all keys present in the Registry are not shown. What one sees depends on which version of the Registry (32 bit or 64 bit version of regedit.exe) one is using.

Edited: Corrected my label references to both 32 bit and 64 bit versions of regedit.exe and the file location of the 64 bit version of regedit.exe. Thanks to @das10 @lx07 @Bree @AlphaUMi @Berton and @LMiller7 for helping me understand what is really happening.

Bree said:

Out of interest @tracit99, how did you do that? I only seem to be able to open one instance however hard I try. What am I missing?

Hi @Bree

The Registry Regedit on the left was opened with WKey + R + regedit.exe and is 64 bit. The Registry Regedit on the right was opened with a third party application and is 32 bit.

tracit99 said:

The Registry on the left was opened with Win Key + R regedit.exe and is 64bit. The Registry on the right was open with a third party applications and is 32bit.

Then it is your program at fault. Look with ProcExp, right click and add the "Image Type" column. For me (with x64) it is all x64 however I start it.



Anyway, regedit opens a cursor and then only updates when you make a change. That is why you have to navigate out of a key and back if you change it as it is stored in memory until that point which explains the issue I guess.

It isn't a 32/64 bit issue - just how it works.

You could check this easily - make a change to some policy (anything) in gpedit.msc and then check in regedit when it is updated and v.v. You will find what regedit shows is what it was when opened - if you change to another key, back again and it re-opens the SAM and shows new value.

Hi @lx07
I am going to respectively disagree with your analysis. While I follow what you are saying I do not believe that it applies to this "issue". First of all I did not make any changes anywhere in the registry key shown at the OP (Note: Image has been updated at OP). I was just viewing the contents of a particular key. If you look closely at what is posted you will see several keys that appear on the left side that are not present on the right side and vice-versa. See also the attached Task Manager screenshot. You can clearly see a 32 Bit and a 64 Bit of regedit.exe running and both of them are at the same address in the Registry but each shows different keys.