What are the differences between the multiple ControlSets in the Windows registry?

There are multiple branches with “ControlSet” in their names under HKEY_LOCALMACHINE\SYSTEM.

What are the fundamental differences between the way Windows uses these 3 keys?

HKLM\System\ControlSet001
HKLM\System\ControlSet002
HKLM\System\CurrentControlSet

Solution 1:

Microsoft say it best in KB100010

Going back to Windows (I think 95), you could set any driver/hardware component to work only in a certain setting mode, which was user selectable at start up.

By default, you have

\ControlSet001 - Last boot

\ControlSet002 - Known good settings

\CurrentControlSet - Current boot

Edit --

It looks like this was only taken out recently, I have personally never used it since 95, however, I found a good site that can show you it from Windows XP.

From system properties:

And from device manager:

Solution 2:

Windows maintains at least two ControlSet entries in the registry. You will likely have ControlSet001 and one (or possibly both) of ControlSet002 or ControlSet003.

There is no significant difference between these; they hold vital information about your system’s hardware, services, and other system settings necessary for booting and running the system, and are generally identical.

The CurrentControlSet item is the easiest to describe: it is simply mapped onto whichever ControlSet### your are currently using, just like how HKEY_CURRENT_USER is mapped to whichever user from the HKEY_USERS branch is currently active. Naturally, any changes you make to CurrentControlSet will be written to the set that it is mapped to.

The reason that you have multiple control sets is that when you make a change to how the system functions, especially to hardware, there is a possibility that may not work. If there were only one copy of the information required to even boot, and it fails, then you would be in trouble because it would require a lot of work (and at least separate OS, if not a whole system) to try to fix things. Instead, changes are made to one control set, and if Windows cannot boot successfully, you can reboot using the other, pre-change control set. That way at least you get back up and running quickly so that you can use the system (and the Internet) to figure out what the problem was.

When you do manage to boot correctly, the changes are written to the other copy, thus keeping it up to date (I believe it happens on shutdown or at some point; just not immediately after a seemingly successful boot since it may or may not have actually been successful).

Some people mis-interpret the two control sets as being the “normal one” and the “backup one”. This is true in a sense, however in reality, you may be booting from either. There is no primary or secondary set, and they can be cycled. In other words, if you normally used ControlSet001, then had a failed boot, you may now be using ControlSet002/003 normally until the next time that you have a failed boot at which point you would switch back.