Question

Can someone explain this strange result for me?

Got the following code in linqPad

Microsoft.Win32.Registry.CurrentUser.OpenSubKey(@"Software\Microsoft").Dump();
Microsoft.Win32.Registry.LocalMachine.OpenSubKey(@"Software\Microsoft").Dump();

When looking in process monitor it looks like this:

RegQueryKey    HKU\S-1-5-21-...   
RegOpenKey     HKU\S-1-5-21-...\Software\Microsoft   
RegSetInfoKey  HKU\S-1-5-21-...\Software\Microsoft   
RegQueryKey    HKU\S-1-5-21-...\Software\Microsoft   
RegQueryKey    HKU\S-1-5-21-...\Software\Microsoft   
RegQueryKey    HKLM   
RegOpenKey     HKLM\Software\Wow6432Node\Microsoft   
RegSetInfoKey  HKLM\SOFTWARE\Wow6432Node\Microsoft   
RegQueryKey    HKLM\SOFTWARE\Wow6432Node\Microsoft   
RegQueryKey    HKLM\SOFTWARE\Wow6432Node\Microsoft  

My question is:
Why does Registry.CurrentUser access 64-bit and Registry.LocalMachine 32-bit?

(and also, why does Registry.CurrentUser access HKU\S-.. and not HKCU)

Using Windows 7, 64-bit, .Net 3.5, LINQPad.exe *32

Answer 1

If you look at the MSDN documentation it says that HKCU\Software\Classes is redirected via WOW64 redirection, but not the entire HKCU\Software key.

HKEY_CURRENT_USER           Shared          Shared
    SOFTWARE                Shared          Shared
        Classes             Shared          Redirected and reflected
            Appid           Shared          Redirected and reflected with one exception: the DllSurrogate and DllSurrogateExecutable registry values are not reflected if their value is an empty string.
            CLSID           Redirected      Redirected and reflected
            DirectShow      Redirected      Redirected and reflected
            Interface       Redirected      Redirected and reflected
            Media Type      Redirected      Redirected and reflected
            MediaFoundation Redirected      Redirected and reflected