Section 2: Registry Hives

The Big Picture: Five Doors, Two Real Rooms

Open regedit and look at the left side. You will see five big folders at the top:

Computer
 ├── HKEY_CLASSES_ROOT          (HKCR)
 ├── HKEY_CURRENT_USER          (HKCU)
 ├── HKEY_LOCAL_MACHINE         (HKLM)
 ├── HKEY_USERS                 (HKU)
 └── HKEY_CURRENT_CONFIG        (HKCC)

Each starts with HKEY_. The letters HKEY mean handle to a key: a "handle" is a number a program gets from Windows that stands for something that is open. These five are called root keys (the top of each tree) or predefined keys.

Here is the surprise that confuses almost every beginner: they are not five separate databases. Only two of them are the real roots. The other three are shortcuts or merged views of parts of those two.

THE FIVE ROOT KEYS

   REAL ROOTS                    SHORTCUTS / MERGED VIEWS

   HKEY_LOCAL_MACHINE  ────────► HKEY_CLASSES_ROOT   (merge of two places)
   (HKLM)                        HKEY_CURRENT_CONFIG (link to one subkey)

   HKEY_USERS          ────────► HKEY_CURRENT_USER   (link to YOUR subkey)
   (HKU)

Another word to learn: a hive is a big chunk of the registry tree that is stored together as one file on disk, along with its helper files. Think of the registry as a library and hives as its bookshelves. Each shelf (hive) is one physical thing you can move, back up or load separately. You will see the list of hives in 2.6 and Section 5.

2.1 HKEY_LOCAL_MACHINE (HKLM)

What it is: The settings that apply to the whole computer, for every user. Nobody's personal taste lives here. It holds hardware, drivers, services, installed software, and security data.

Real or link? It is a real root.

The most important subkeys (a subkey is a key inside another key):

What is a hash? A hash is a one-way scrambled form of a password. Windows stores the scramble, not the password itself. You cannot turn it back into the original text easily.

Who can write here? Only administrators and the system itself. A normal user can read much of HKLM but cannot change it (Section 6 explains why).

Windows tip: In regedit, open HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion. Read ProductName and CurrentBuild. This is where programs find out which Windows version they run on.

2.2 HKEY_CURRENT_USER (HKCU)

What it is: The settings of you, the person who is signed in right now: wallpaper, theme, mouse speed, which apps you opened recently, and settings your programs saved for you.

Real or link? A link (a shortcut). When you sign in, Windows loads your personal hive and then makes HKCU point to your section inside HKEY_USERS (see 2.4). If two people use the PC, each sees their own, different HKCU, even though the path looks identical.

Person A signed in:   HKCU  ──►  HKEY_USERS\S-1-5-21-...-1001  (A's data)
Person B signed in:   HKCU  ──►  HKEY_USERS\S-1-5-21-...-1002  (B's data)

Important subkeys:

Who can write here? You can, for your own HKCU, without being an administrator. That is why programs that "do not need admin rights" keep their settings here.

2.3 HKEY_CLASSES_ROOT (HKCR)

What it is: The place that says what each kind of file is, and what to do with it. "A .pdf file is a PDF document, open it with this program." It also holds the registration of COM classes (COM is an older Windows technology that lets programs use each other's features; each feature has an ID stored here).

Real or merged view? A merged view of two places:

HKEY_CLASSES_ROOT   =   HKLM\SOFTWARE\Classes   (defaults for all users)
                      + HKCU\Software\Classes   (your own overrides)

If the same key exists in both, YOUR version (HKCU) wins.

So HKCR is a handy one-stop view. If you write to it, Windows decides which of the two real places receives the data (usually the machine one, if you have the rights).

Typical contents:

Section 9 shows this in more detail.

2.4 HKEY_USERS (HKU)

What it is: The home of all loaded user profiles. For each user whose hive is currently loaded, there is a subkey named by their SID (Security Identifier: a unique code Windows gives to each account, something like S-1-5-21-1111-2222-3333-1001).

Real or link? A real root.

Typical content:

Only users who are signed in (or have a service running as them) have their hive loaded. A user who has never signed in this session is just a file on disk, not part of the tree.

Windows tip: The number at the end of a normal SID (here, 1001) is often 1000 or higher for the first normal accounts you create. Run whoami /user in a terminal to see your own SID.

2.5 HKEY_CURRENT_CONFIG (HKCC)

What it is: A small shortcut to the current hardware profile: facts about how the computer is set up right now, such as the display settings and printers that are in use.

Real or link? A link. It points to:

HKEY_CURRENT_CONFIG  ──►  HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\Current

Hardware profiles were designed for old laptops, which were sometimes docked and sometimes not, and needed different settings in each case. Today almost nobody uses more than one profile, so HKCC is small and rarely needed. It is still there for compatibility.

2.6 How Hives Map to Physical Hive Files on Disk

What it is: Each real part of the registry lives in a hive file. Some hives are loaded at boot from files. A few parts exist only in memory.

Here is the whole picture, with real roots on the left, files on the right:

REGISTRY (in memory)                  FILES ON DISK

HKEY_LOCAL_MACHINE
 ├── SYSTEM    ─────────────────────► config\SYSTEM
 ├── SOFTWARE  ─────────────────────► config\SOFTWARE
 ├── SAM       ─────────────────────► config\SAM
 ├── SECURITY  ─────────────────────► config\SECURITY
 ├── BCD00000000 ───────────────────► Boot\BCD
 └── HARDWARE  ───────────────────► (no file, rebuilt every boot)

HKEY_USERS
 ├── .DEFAULT  ─────────────────────► config\DEFAULT
 ├── S-1-5-21-...-1001 ─────────────► C:\Users\Rover\NTUSER.DAT
 └── S-1-5-21-...-1001_Classes ─────► ...\Windows\UsrClass.dat

HKCU  = link to your HKEY_USERS entry
HKCR  = HKLM\SOFTWARE\Classes + HKCU\Software\Classes
HKCC  = link to a key inside HKLM\SYSTEM

Section 5 explains the files in depth, including the helper files .LOG1 and .LOG2.

Summary