0 / 6
Registry Root Keys
Open Registry Editor and five root keys sit at the top. Only two of them, HKLM and HKU, actually hold data, and the other three point to a place inside those two or show two places merged.
The registry is the hierarchical database where Windows keeps settings for users, programs and hardware. When you connect to another computer's registry remotely, only HKLM and HKU appear.
1 / 6
HKLM: a real key loaded from hive files
Expand HKLM (HKEY_LOCAL_MACHINE) and you find the SAM, SECURITY, SOFTWARE and SYSTEM keys. Each one is a hive loaded at boot from the file of the same name in C:\Windows\System32\config. Settings that apply to every user of the computer are gathered here. Keys rebuilt at every boot without a file, such as HARDWARE, are left out of the figure.
2 / 6
HKU: a real key loaded from each user's hive files
Under HKU (HKEY_USERS), each signed-in user has a key named after their SID. When a user signs in, Windows loads two hive files for that user. NTUSER.DAT in the user folder (C:\Users\username) becomes the SID key, and UsrClass.dat under AppData in the same folder becomes the key named after the SID with _Classes appended. The .DEFAULT key at the top is not the default for new users but the settings of the system account (LocalSystem) used by Windows services and other system processes.
3 / 6
HKCU: points to the current user's key in HKU
HKCU (HKEY_CURRENT_USER) has no data of its own. It only shows HKU\S-1-5-21-…-1001, the current user's key, under another name. That is why a program can find the settings of the account it runs as (usually the signed-in user) through the name HKCU without knowing the SID.
4 / 6
HKCC: points to the hardware profile in HKLM
HKCC (HKEY_CURRENT_CONFIG) has no data of its own either. It only shows HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\Current under another name. It holds only the ways the current hardware setup differs from the standard one.
5 / 6
HKCR: merges two Classes keys into one view
HKCR (HKEY_CLASSES_ROOT) shows information such as which program opens each file extension and where COM components are registered. COM is the Windows component standard that lets one program call the features of another. This information is split between HKLM\SOFTWARE\Classes (defaults for all users) and HKU\S-1-5-21-…-1001_Classes (the current user's settings). HKCR shows the two merged into one view, and when the same entry exists in both, the user's value is the one you see.
6 / 6
A value written to HKCU also shows up in HKU
A program writes the desktop wallpaper value (WallPaper) to HKCU\Control Panel\Desktop. Because HKCU is another name for HKU\S-1-5-21-…-1001, the same value also appears at HKU\S-1-5-21-…-1001\Control Panel\Desktop. The value does not move from one place to the other; it is stored in a single key from the start and ends up in the NTUSER.DAT file.