Skip navigation

JSI Tip 0314 - Registry hives in the registry.

Permanent keys (those not created at boot) are identified in the hivelist subkey at:


The one exceptions is HKEY_CURRENT_USER which is located at %SystemRoot%\Profiles\UserName

The value entries identify the registry hives. All are type REG_SZ

Value Name
D e s c r i p t i o n
 key is recreated upon boot.
  \REGISTRY\MACHINE\SAM   \Device\Harddisk 0\Partition1
  \REGISTRY\MACHINE\SECURITY   \Device\Harddisk 0\Partition1
  \REGISTRY\MACHINE\SOFTWARE   \Device\Harddisk 0\Partition1
  \REGISTRY\MACHINE\SYSTEM   \Device\Harddisk 0\Partition1
  \REGISTRY\USER\.DEFAULT   \Device\Harddisk 0\Partition1
  \REGISTRY\USER\Security ID (SID)     \Device\Harddisk 0\Partition1
  The current user(s) profile.
If services are running under user accounts,
their entries are also located here. 

Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.