Registry Redirection and Reflection in 32-Bit Windows

On 64-bit versions of Windows, the Windows-on-Windows 64-bit (WOW64) subsystem manages compatibility for 32-bit applications using registry redirection and registry reflection. When administrators or users modify registry keys in the standard Registry Editor (Regedit), these mechanisms determine whether a 32-bit application reads the newly modified values or reads completely separate, isolated keys.

Registry Redirection and the WOW6432Node

Registry redirection isolates 32-bit and 64-bit application configurations by creating a separate registry view. When a 32-bit application attempts to access keys under HKEY_LOCAL_MACHINE\Software, the WOW64 subsystem intercepts the request and silently redirects the application to HKEY_LOCAL_MACHINE\Software\WOW6432Node.

When opening Regedit on a 64-bit system, the default view displays the native 64-bit registry keys at the top level and the 32-bit keys nested under WOW6432Node. If a user modifies a value under HKEY_LOCAL_MACHINE\Software\ExampleApp, a 32-bit application will not see that update because it automatically queries HKEY_LOCAL_MACHINE\Software\WOW6432Node\ExampleApp. To make changes visible to a 32-bit program, the edits must be applied specifically inside the WOW6432Node hierarchy.

Registry Reflection vs. Shared Keys

Registry reflection was an older synchronization mechanism used in Windows XP, Windows Server 2003, and Windows Vista 64-bit editions. It maintained copies of specific registry keys (such as COM registrations and file associations) between the 64-bit and 32-bit registry trees. Modifying a reflected key in the 64-bit view of Regedit would trigger the system to automatically replicate the change to the 32-bit WOW6432Node view, and vice versa.

Starting with Windows 7 and Windows Server 2008 R2, Microsoft deprecated registry reflection in favor of shared registry keys. Instead of copying data between two separate physical locations, keys that require cross-architecture access are shared directly in real time. For shared keys, both 32-bit and 64-bit applications read from and write to the exact same physical registry location, ensuring that any modification made in Regedit is immediately visible to 32-bit applications without requiring redirection or synchronization.

Practical Impact on Regedit Modifications

The visibility of modified keys in a 32-bit application depends on the classification of the target key:

• Redirected Keys: Edits made in the root Software branch will remain invisible to 32-bit applications. You must explicitly edit the corresponding entry under Software\WOW6432Node.
• Shared Keys: Edits made anywhere in the shared branch (such as certain paths under HKEY_CURRENT_USER or shared COM settings) are immediately visible to both 32-bit and 64-bit applications.
• Architecture-Specific Regedit Instances: Running the 32-bit version of the Registry Editor (%SystemRoot%\SysWOW64\regedit.exe) automatically presents the redirected keys from the perspective of a 32-bit application, ensuring that direct modifications land in the appropriate WOW6432Node space.