HKEY_USERS [HKU]

HKEY_USERS [HKU]:
Windows 95 uses this key to store the user profiles, which were previously stored in systemroot\system32\config or systemroot\profiles directory.

SUBKEYS of HKEY_USERS

HKU contains at least three subkeys:

• .DEFAULT contains the per-user settings that Windows uses to display the desktop before any user logs on to the computer. This isn't the same thing as a default user profile, which Windows uses to create settings for users the first time they log on to the computer.

• SID, where SID is the security identifier of the console user (the user sitting at the keyboard), contains per-user settings. HKCU is linked to this key. This key contains settings such as the user's desktop preferences and Control Panel settings.

• SID_Classes, where SID is the security identifier of the console user, contains per-user class registrations and file associations. Windows merges the contents of keys HKLM\SOFTWARE\Classes and HKU\SID_Classes into HKCR.

Other subkeys you may find are :

• S-1-5-18 is the well-known SID for the LocalSystem account. Windows loads this account's profile when a program or service runs in the LocalSystem account.

• S-1-5-19 is the well-known SID for the LocalService account. Service Control Manager uses this account to run local services that don't need to run as the LocalSystem account.

• S-1-5-20 is the well-known SID for the NetworkService account. Service Control Manager uses this account to run network services that don't need to run as the LocalSystem account.