JSI Tip 0314 - Registry hives in the registry.

Jerold Schulman

November 13, 1997

1 Min Read
ITPro Today logo

Permanent keys (those not created at boot) are identified in the hivelist subkey at:

HKEY_LOCAL_MACHINESystemCurrentControlSetControlhivelist

The one exceptions is HKEY_CURRENT_USER which is located at %SystemRoot%ProfilesUserName

The value entries identify the registry hives. All are type REG_SZ

Value Name

Default

D e s c r i p t i o n

REGISTRYMACHINEHARDWARE

  None

  The HKEY_LOCAL_MACHINEHardware key is recreated upon boot.

REGISTRYMACHINESAM

  DeviceHarddisk 0Partition1WINNTSystem32ConfigSAM

  HKEY_LOCAL_MACHINESAM

REGISTRYMACHINESECURITY

  DeviceHarddisk 0Partition1WINNTSystem32ConfigSECURITY  

  HKEY_LOCAL_MACHINESecurity

REGISTRYMACHINESOFTWARE

  DeviceHarddisk 0Partition1WINNTSystem32ConfigSoftware

  HKEY_LOCAL_MACHINESoftware

REGISTRYMACHINESYSTEM

  DeviceHarddisk 0Partition1WINNTSystem32ConfigSystem

  HKEY_LOCAL_MACHINESystem

REGISTRYUSER.DEFAULT

  DeviceHarddisk 0Partition1WINNTSystem32ConfigDefault

  HKEY_USERS.DEFAULT

REGISTRYUSERSecurity ID (SID)

  DeviceHarddisk 0Partition1WINNTProfilesUsernametuser.dat  

  The current user(s) profile.If services are running under user accounts,their entries are also located here. 


Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.

You May Also Like