none
Where are the System Tray Customizations stored?

    Question

  • I'd like to force all my systems to "Show icon and notifications" for my antivirus software.  That way users will be able to see when the icon changes indicating that the AV is no longer working.  I've found ways of forcing all icons to show but I'd like to selectively just force this one to show.  I know how to force it to show using the "Customize..." system interface but I'd like to force it to happen through a reg hack, group policy or copying a file or something.  I've got too many users using too many different systems to run around and manually change it each time a new users logs on.  Is there a way of putting this setting in the default profile so it automatically happens for everybody?  Thanks for your help.
    Wednesday, December 16, 2009 6:28 PM

Answers

  • Hi Curt,

    I tried to monitor the change of registry keys and noticed that the following key is changed after modify the settings in Customize:

    HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify

    But the value is not a simple "0"/"1" so we may not able to find out the exact value which control the show/hide option.

    Edit:

    I did more research and found follownig explanation for the change in Windows 7:

    There is no way for applications to programmatically always show themselves top level on the system tray either on first install or at any time during runtime. This is one of several changes we’ve made in Windows 7 in an effort to produce a cleaner, quieter desktop that is in the user’s control to customize the top level with their favorite applications and icons.

     

    We keep the user in control of the notification area by not allowing programmatic promotion (other than temporarily or to show a notification). Assuming the machine is sufficiently quiet, when you first add your icon with Shell_NotifyIcon(NIM_ADD, ...) it will be shown on the taskbar for 45 seconds, then move into the overflow

    thereafter. If the user promotes an icon, it will always live on the taskbar. If the user demotes it, the icon will never be seen on the taskbar. Any promotion needs to be user initiated. We’ve made this much easier in Windows 7 via drag/drop & through the Notification Area Icons control panel, and what we’ve seen in usability studies and based on beta feedback, is that users have no difficulties discovering how to customize notification behavior and will promote the icons they want quick access to.

    Tuesday, December 22, 2009 8:21 AM
    Moderator

All replies

  • I don't think you can change the registry to make all users with the same Customize settings. If the icons are intergrated in OS, you can make the change via the group policy or registry, such as the network sound  icons. Since microsoft don't know which program you would install, they won't created the registry for your program, if you wan to make your CUstomize setting, I think it's better to change the setting manually as your wish.


    John
    • Edited by John Cena Saturday, December 19, 2009 2:12 AM
    Thursday, December 17, 2009 12:39 PM
  • I have machines where as many as 100 different users log on.  I can't go and manually make changes for every user on each one of these machine.  The Customizations have to be stored somewhere.  I'm hopefull that if I knew where they are kept, I can programatically apply them to all users who log on.  Thanks for any help you can provide.
    Thursday, December 17, 2009 4:50 PM
  • Hi Curt, I have this same gripe. Microsoft have tied it down so tight I think it's impossible which is extemely frustrating in a corporate environment, I really wish they'd stop doing this.

    What you can do is look at PromotedIcon1 and 2 in the unattend.xml which can be used to replace and show other icons in place of the action centre and battery icons. However, Microsoft have made even this ridiculously difficult, you need the GUID of the icon and it must be a signed app otherwise it won't work, and you can only do these 2.
    Thursday, December 17, 2009 7:11 PM
  • Thanks.  That leads to a couple more questions.

    1) How can I find out the GIUD?
    2) When I upgrade to a newer version of my antivirus software, is the GIUD likely to change?  If so, this has a limited duration of value.  Wouldn't I have to re-image the system each time the GIUD changes?  That's not exactly convenient!

    Thursday, December 17, 2009 7:36 PM
  • The unattend reference points here for help on the GUID:

    http://go.microsoft.com/fwlink/?LinkId=120340

    I'm not sure about the answer to your 2nd question as I've not really ever looked into this in great depth.

    Microsoft, can't you make this easier for us all to configure?

    Thursday, December 17, 2009 8:10 PM
  • I've got to write a C program to figure out the GUID?  That's not very convenient!  Isn't there someplace in the registry where this info can be found?  Or perhaps a VB or Powershell script?
    Thursday, December 17, 2009 9:24 PM
  • Hi Curt,

    I strongly recommend you do not apply this setting in the registy if you don't know which entry can be modified, since it will cause unexpected problem.
    John
    Saturday, December 19, 2009 2:33 AM
  • Agreed.  That's why I'm asking the experts on this forum for information.
    Saturday, December 19, 2009 5:47 AM
  • Hi Curt,

    I tried to monitor the change of registry keys and noticed that the following key is changed after modify the settings in Customize:

    HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify

    But the value is not a simple "0"/"1" so we may not able to find out the exact value which control the show/hide option.

    Edit:

    I did more research and found follownig explanation for the change in Windows 7:

    There is no way for applications to programmatically always show themselves top level on the system tray either on first install or at any time during runtime. This is one of several changes we’ve made in Windows 7 in an effort to produce a cleaner, quieter desktop that is in the user’s control to customize the top level with their favorite applications and icons.

     

    We keep the user in control of the notification area by not allowing programmatic promotion (other than temporarily or to show a notification). Assuming the machine is sufficiently quiet, when you first add your icon with Shell_NotifyIcon(NIM_ADD, ...) it will be shown on the taskbar for 45 seconds, then move into the overflow

    thereafter. If the user promotes an icon, it will always live on the taskbar. If the user demotes it, the icon will never be seen on the taskbar. Any promotion needs to be user initiated. We’ve made this much easier in Windows 7 via drag/drop & through the Notification Area Icons control panel, and what we’ve seen in usability studies and based on beta feedback, is that users have no difficulties discovering how to customize notification behavior and will promote the icons they want quick access to.

    Tuesday, December 22, 2009 8:21 AM
    Moderator
  • Keeping the user in control in a home environment is fine, but in an Enterprise environment things are different.  There should be a GPO that allows the system administrator to make the decision on what is shown in the system tray. 

    Just out of curiosity, does Microsoft's new product focus groups ever include IT professionals that manage actual production environments?

    Thursday, March 18, 2010 3:07 PM
  • I also would like to have certain icons always show. There needs to be a way for an enterprise admin to customize this sort of thing. Yes, we know that users can easily do alot of things, but they do not always do what is best for themselves, like displaying the anti-virus app icon so they can see the status.
    Wednesday, May 19, 2010 3:15 PM
  • I've been struggling with this very same issue.  For my users' accounts I want certain notification icons enabled by default, like antivirus.  If they want to change from those defaults, that's fine, but I want to define defaults.

    Moreover, from a user perspective as well, I'd prefer having programmatic access to my desktop, with settings in human editable text editor, such as in the Unix .bash_profile startup script tradition.

     

    Friday, April 15, 2011 6:34 PM
  • There's one little problem with your little philosophy there the malware writers seem to have zero problem promoting their hijack programs to being always shown and users are usually too uninformed to look at the overflow to make sure antivirus is running. So for the sake of enterprise managers everywhere give us the system tray back cause right now the only people that have control of it are the viruses. Good Jub microsoft.
    Friday, June 17, 2011 5:22 PM
  • I too have an interest for forcing a notification tool to always be visible, for domain management / network administration purposes. I am writing a disk quota monitor for user accounts that will always show their account storage usage percentage on an icon in the taskbar tray.

    I want the quota monitoring tool to set itself to be always visible when it runs for the first time for each user's account.


    Since Microsoft is intentionally obfuscating this registry data, here's what I've found:

    [HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify]

    "IconStreams"=hex:14,00,00,00,07,00,00,00,01,00,01,00,15,00,00,00,14,00,00,00,\
      7b,00,37,00,50,00,35,00,4e,00,34,00,30,00,52,00,53,00,2d,00,4e,00,30,00,53,\
      00,4f,00,2d,00,34,00,4f,00,53,00,50,00,2d,00,38,00,37,00,34,00,4e,00,2d,00,\
      50,00,30,00,53,00,32,00,52,00,30,00,4f,00,39,00,53,00,4e,00,38,00,52,00,7d,\
      00,5c,00,50,00,62,00,7a,00,7a,00,62,00,61,00,20,00,53,00,76,00,79,00,72,00,\

    [.......]


    The data is text, most likely unicode, stored in ROT13 format. It's a list of every icon notification that has appeared recently (apparently specific to this current logon). Here are the first few lines from my computer, using direct Hex to ASCII conversion:

    ή              { 7 P 5 N 4 0 R S - N 0 S O - 4 O S P - 8 7 4 N - P 0 S 2 R 0 O 9 S N 8 R } \ P b z z b a   S v y r f \ N q b o r \ N E Z \ 1 . 0 \ N q b o r N E Z . r k r     è         Ü H c q n g r   v f   e r n q l   g b   v a f g n y y       ¥ Û~*úâ÷̦ûþ¬ã÷Ì    P y v p x   u r e r   s b e   q r g n v y f .       { 6 Q 8 0 9 3 7 7 - 6 N S 0 - 4 4 4 O - 8 9 5 7 - N 3 7 7 3 S 0 2 2 0 0 R } \ A I V Q V N   P b e c b e n g v b a \ Q v f c y n l \ a i g e n l . r k r          Ü A I V Q V N   F r g g v a t f         ¦  nl—ç)Ë&HžÐZKÜÂR  ­ ÁìÌèÌ       þ°A I V Q V N   P b e c b e n g v b a            { S 3 8 O S 4 0 4 - 1 Q 4 3 - 4 2 S 2 - 9 3 0 5 - 6 7 Q R 0 O 2 8 S P 2 3 } \ r k c y b e r e . r k r         d          Ü F c r n x r e f :   6 6 %   §   s® xã#)B‚Áä¶}[œ  ÖE°QTôÌ     !       { 7 P 5 N 4 0 R S - N 0 S O - 4 O S P - 8 7 4 N - P 0 S 2 R 0 O 9 S N 8 R } \ N v e C b e g \ N C N t r a g . r k r     

    [.......]


    And here is what it looks like after running it through a ROT13 conversion:

    ή              { 7 C 5 A 4 0 E F - A 0 F B - 4 B F C - 8 7 4 A - C 0 F 2 E 0 B 9 F A 8 E } \ C o m m o n   F i l e s \ A d o b e \ A R M \ 1 . 0 \ A d o b e A R M . e x e     è         Ü U p d a t e   i s   r e a d y   t o   i n s t a l l       ¥ Û~*úâ÷̦ûþ¬ã÷Ì    C l i c k   h e r e   f o r   d e t a i l s .       { 6 D 8 0 9 3 7 7 - 6 A F 0 - 4 4 4 B - 8 9 5 7 - A 3 7 7 3 F 0 2 2 0 0 E } \ N V I D I A   C o r p o r a t i o n \ D i s p l a y \ n v t r a y . e x e          Ü N V I D I A   S e t t i n g s         ¦  ay—ç)Ë&UžÐMXÜÂE  ­ ÁìÌèÌ       þ°N V I D I A   C o r p o r a t i o n            { F 3 8 B F 4 0 4 - 1 D 4 3 - 4 2 F 2 - 9 3 0 5 - 6 7 D E 0 B 2 8 F C 2 3 } \ e x p l o r e r . e x e         q          Ü S p e a k e r s :   6 6 %   §   f® kã#)O‚Áä¶}[œ  ÖR°DGôÌ     !       { 7 C 5 A 4 0 E F - A 0 F B - 4 B F C - 8 7 4 A - C 0 F 2 E 0 B 9 F A 8 E } \ A i r P o r t \ A P A g e n t . e x e     

    [.......]


    The other huge key named "PastIconsStream" does not appear to contain any Unicode text data, but instead apparently contains graphical icon data. This can be seen using just notepad by

    • copying a bunch of the nonzero data with "xx,xx,xx,FF" in it
    • setting the font size to microscopic (2-3 point)
    • turning word wrap on
    • removing line wrap breaks and spacing from the copied lines
    • sliding the width of the window around until the hex data lines up in an orderly pattern, which it does, every four hex bytes.


    To simplify the documentation it may be worthwhile to try deleting the trayicon keys and using the Task Manager to End Task on Explorer.exe, then reload it using Task Manager, so Windows Explorer starts over fresh with tiny/blank hex fields in the registry. (Do this on a disposable test machine, and back up the keys first before you try this.)

    These are most likely just a simple delimited list of fields using a regular, repeating field structure. The main issue is decoding the field lengths and the field parameters. This can be helped along by Explorer itself, to see what changes in the keys when Explorer modifies the data:

    1. Write out registry keys in current state
    2. Use the Windows UI to customize notifications for one tray icon
    3. Write out registry keys again, version 2
    4. Use the Windows UI to change that icon's notifications back to the original state
    5. Write out registry keys again, version 3
    6. Use the Windows UI to again reapply the customized notifications for that first icon
    7. Write out registry keys again, version 4

    The files are next compared using a hex editor, and the hex value differences noted to determine how Windows is manipulating the data fields. From here, a syntax for changing icon notifications within these obfuscated keys can be developed without Microsoft's help.

    Friday, March 2, 2012 6:54 AM
  • Sorry to resurrect this thread. But I'm faced with the same problem.

    @DaleMahalko. Thank you very much for doing this research. I'm curious if you were able to find more info and if so can you share it?

    PS. It can clearly be done from a software or a script not written by Microsoft. Dropbox desktop client does it.

    Sunday, September 23, 2012 9:29 AM
  • I found this article that describes some detail of the binary format described in the icon streams:

    http://deployment.xtremeconsulting.com/2011/07/08/windows-7-notification-area-automation-falling-back-down-the-binary-registry-rabbit-hole/

    Hope that helps.

    Monday, November 26, 2012 9:30 AM
  • I know your issue is an old one (almost 4 years) but this is indeed possible, through a combination of PowerShell and GPO

    http://4sysops.com/archives/forcing-notification-area-icons-to-always-show-in-windows-7-or-windows-8/


    Thursday, September 5, 2013 2:47 PM
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer

    Name="EnableAutoTray"

    type=reg_dword

    value= 0 to show Icons, 1 to hide

    Copy this to a batch file and run it to show icons...

    reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer" /v "EnableAutoTray" /t REG_DWORD /d 0 /f

    Sunday, August 30, 2015 1:13 AM