HKEY_LOCAL_MACHINE [HKLM]

HKEY_LOCAL_MACHINE [HKLM] :

This key contains configuration information particular to the computer. This information is stored in the systemroot\system32\config directory as persistent operating system files, with the exception of the volatile hardware key. Settings range from device driver configurations to Windows settings. HKEY_LOCAL_MACHINE is probably the most important key in the registry and it contains five subkeys:

• HARDWARE.

  Database that describes the physical hardware in the computer, the way device drivers use that hardware, and mappings and related data that link kernel-mode drivers with various user-mode code. The operating system creates this key each time it starts, and it includes information about devices and the device drivers and resources associated with them.
  

• SAM.

  Contains the Windows local security database, the Security Accounts Manager (SAM). Windows stores local users and groups in SAM. This key's access control list (ACL) prevents even administrators from viewing it. SAM is a link to the key HKLM\SECURITY\SAM.

• SECURITY.

  Contains the Windows local security database in the subkey SAM, as well as other security settings. This key's ACL prevents even administrators from viewing it, unless they take ownership of it.

• SOFTWARE.

  Pre-computer software database. Contains per-computer application settings. Microsoft standardized this key's organization so that programs store settings in HKLM\SOFTWARE\Vendor\Program\Version\. Vendor is the name of the program's publisher, Program is the name of the program, and Version is the program's version number.
  

• SYSTEM.

  Database that controls system start-up, device driver loading, NT 4 services and OS behavior. Contains control sets, one of which is current. The remaining sets are available for use by Windows. Each subkey is a control set named ControlSetnnn, where nnn is an incremental number beginning with 001. The operating system maintains at least two control sets to ensure that it can always start properly. These sets contain device driver and service configurations. HKLM\SYSTEM\CurrentControlSet is a link to ControlSetnnn, and the key HKLM\SYSTEM\Select indicates which ControlSetnnn is in use.