HKEY_USERS [HKU]

HKEY_USERS [HKU]:
Windows 95 uses this key to store the user profiles, which were previously stored in systemroot\system32\config or systemroot\profiles directory.

SUBKEYS of HKEY_USERS

HKU contains at least three subkeys:

• .DEFAULT contains the per-user settings that Windows uses to display the desktop before any user logs on to the computer. This isn't the same thing as a default user profile, which Windows uses to create settings for users the first time they log on to the computer.

• SID, where SID is the security identifier of the console user (the user sitting at the keyboard), contains per-user settings. HKCU is linked to this key. This key contains settings such as the user's desktop preferences and Control Panel settings.

• SID_Classes, where SID is the security identifier of the console user, contains per-user class registrations and file associations. Windows merges the contents of keys HKLM\SOFTWARE\Classes and HKU\SID_Classes into HKCR.

Other subkeys you may find are :

• S-1-5-18 is the well-known SID for the LocalSystem account. Windows loads this account's profile when a program or service runs in the LocalSystem account.

• S-1-5-19 is the well-known SID for the LocalService account. Service Control Manager uses this account to run local services that don't need to run as the LocalSystem account.

• S-1-5-20 is the well-known SID for the NetworkService account. Service Control Manager uses this account to run network services that don't need to run as the LocalSystem account.

HKEY_CURRENT_USER [HKCU]

HKEY_CURRENT_USER [HKCU] :

This registry key contains the configuration information for the user that is currently logged in. The users folders, environment variables, desktop settings, network connections, printers, application preferences, screen colors, and control panel settings are stored here. This information is known as a User Profile.

SUBKEYS of HKEY_CURRENT_USER

• AppEvents

Associates sounds with events. For example, it associates sounds with opening menus, minimizing windows, and logging off of Windows.

• Console

Stores data for the console subsystem, which hosts all character-mode applications, including the MS-DOS command prompt. In addition, the Console key can contain subkeys for custom command windows.

• Control Panel

Contains accessibility, regional, and desktop appearance settings. You configure most of these settings in Control Panel. However, this key contains a handful of useful settings that have no user interface; you can configure them only through the registry.

• Environment

Stores environment variables that users have set. Each value associates an environment variable with the string that Windows substitutes for the variable. The default values for these entries are in the user's profile.

• Identities

Contains one subkey for each identity in Microsoft Outlook Express. Outlook Express uses identities to allow multiple users to share a single mail client. With the Windows support for user profiles, one user's settings are separate from other users' settings, so this key is seldom necessary to use.

• Keyboard Layout

Contains information about the installed keyboard layouts.

• Network

Stores information about mapped network drives. Each subkey in Network is a mapped drive to which Windows connects each time the user logs on to the computer. The subkeys' names are the drive letters to which the drives are mapped. Each drive's key contains settings used to reconnect the drive.

• Printers

Stores user preferences for printers.

• Software

Contains per-user application settings. Windows stores much of its own configuration in this key, too. Microsoft has standardized its organization so that programs store settings in HKCU\Software\Vendor\ Program\ Version\. The variable Vendor is the name of the program's publisher, the variable Program is the name of the program, and the variable Version is the program's version number. Often, as is the case with Windows, Version is simply CurrentVersion.

• Volatile Environment

Contains environment variables that were defined when the user logged on to Windows.


Other subkeys you see in HKCU are usually legacy leftovers or uninteresting. They include UNICODE Program Groups, SessionInformation, and Windows 3.1 Migration Status.

Brief History of Windows Registry

MS-DOS

• MS-DOS got its configuration data from Config.sys and Autoexec.bat.
  
• Config.sys loads device drivers
• Autoexec.bat used to run programs, set environment variables, and prepare MS-DOS for use.

Windows 3.0

• Windows 3.0 provided INI files for storing settings.
  
• INI files are text files that contain one or more sections with one or more settings in each section.
  
• The main problems with INI files are that they provide no hierarchy, storing binary values in them is cumbersome, and they provide no standard for storing similar types of settings.
  
• INI files also cause other subtle problems, all related to the configuration file's inability to build complex relationships between applications and the operating system.
  
• One big problem for early versions of Windows was the sheer number of INI files that floated around on the average computer. Every application had its own INI files.

Windows 3.1
Windows 3.1 introduced the registry as a tool for storing OLE (object linking and embedding) settings.

Windows 95

• Windows 95 expanded the registry into the configuration database that Windows XP and Windows Server 2003 use now.
  
• Even though INI files are no longer necessary, you'll always find INI files, including Win.ini, on any computer, at location : C:\WINDOWS\win.ini
  
• No more plain text .INI files splattered all over your system.
• In today's environment, the registry replaces these .INI files. Each key in the registry is similar to bracketed headings in an .INI file.

RELATED POST : FIVE KEYS OF WINDOWS REGISTRY EXPLAINED