If you've ever looked in the Windows registry,
the first thing you would have seen is a list of these things called HKEY_CLASSES_ROOT,
HKEY_LOCAL_MACHINE, CURRENT_CONFIG, and all that. But what exactly are those? The first
thing to understand is that the Windows Registry is made up of keys and values.
And everything on the left-hand side, they're all keys, but there are subkeys. And then on
the right-hand side, when you actually go into something and change one of the
variables effectively, that's where you would set the values for any one of the keys. And
all of these HKEY things at the top level are predefined Root Keys, they're called.
Now, if you weren't aware, the Windows registry is actually made up of a couple different files
on the computer at different locations. So you might assume that these root keys are the
names of these files and then everything else is contained within them, but that's not actually the
case. The primary location for the registry files are in the C:\Windows\System32\config directory.
And that's where all the files for all the different registry keys are located,
except the ones for the current user. That's actually located in the user profile directory,
and it's called a .DAT file. Whereas these other ones are in the config
directory and they don't have a file extension as far as I know.
But even in here, you'll notice that these file names don't line up with
the predefined root key names. For example, you have files like SYSTEM, SAM, Security,
and Software. And these actually correspond to subkeys of the HKEY_LOCAL_MACHINE registry
keys. So these root keys are not files in themselves. They are basically logical keys
that kind of point to a bunch of different stuff that makes up the registry, including these files.
And these files happen to be under mostly the local machine key. So you're probably
wondering what are the purposes of these various root keys? And that's what I can go over next.
And first of all, if you're wondering what the HKEY stands for, it actually stands for
Handle-to-Registry-Key. And further, you may have also seen these root keys abbreviated.
For example, HKEY_CLASSES_ROOT is often abbreviated as HKCR, local machine is HKLM,
and so on. The HKEY_CLASSES_ROOT key mostly has to do with information about registered applications.
So it's got things like file associations or which programs open which files. You've got
object linking for things called Object Class IDs and which applications handle certain actions.
And how this works is the default settings for these are actually located elsewhere in the
HKEY_LOCAL_MACHINE\software\classes key. And the user settings, if the user changes it, they would
go in the HKEY_CURRENT_USER\software\classes key. So basically the HKEY_CLASSES_ROOT will
combine those two locations, the one for the default and the one for the user.
And turns it into one that the rest of the system will reference. And it basically
makes it so the user setting will override the default and that's the one that gets
used. Next is HKEY_LOCAL_MACHINE. And this contains information and settings
related to the local computer. So that includes things like system memory or installed hardware
or software, configuration data, devices and drivers, and startup control parameters.
And you can see this is the case if you look at some of the sub keys in here,
such as drivers, hardware, security, software, and system. And actually,
if you look at the files in the config directory in system32, you'll actually notice that a lot
of those files actually correspond to sub keys of the HKEY_LOCAL_MACHINE.
And that's where they are actually stored. Next up, we have HKEY_CURRENT_CONFIG. And kind of
like the name suggests, this has info about the current hardware profile of the system. However,
if you look closely, you'll notice that this whole root key is actually
just linked to the software and system keys of the HKEY_LOCAL_MACHINE key.
And also it's basically just an alias or a copy of
HKEY_LOCAL_MACHINE\system\CurrentControlSet\hardware profiles\current. Except that it's only going to
show keys and values that are different from that default config that is stored
there. So in other words, the current config key basically uses part of the
local machine key as a template and then builds and changes off of that.
Now, next up, we have HKEY_USERS, and you could probably guess that this contains settings and
information related to each user on the computer. And each user actually is separated into sub keys
under here. The default configuration, like for a new user, is stored in config\default. And
unlike the files that are in the system32 config directory for other registry keys,
the user's registry keys are actually in that user profile, and it's in a file called NTUser.dat.
Next, as for HKEY_CURRENT_USER, this just contains information about the current logged in user. And
sort of like with the current config to local machine keys, the current user just points to
one of the profiles in the HKEY_USERS sub key. So if you look at the contents of HKEY_CURRENT_USER,
it will contain the same information as one of the profiles in HKEY_USERS,
and it will just be whichever one is currently logged in at the moment.
Now, there is actually another root key that is not actually visible in the registry editor,
and that's called the HKEY_PERFORMANCE_DATA root key. This one also doesn't have its own
file. It's basically a virtual key, and it basically contains information about the
computer's performance. And that would be whatever data is being reported by
the kernel of the operating system, drivers, or even some applications.
They'll kind of just dump whatever is going on performance-wise into these registry keys,
so other applications can read off of that. And you can actually see some of
this data in the Task Manager's performance tab window. A lot of
this comes from that registry key. And even though it's more of a virtual registry key,
it's not a actual one, it still gets accessed by registry key commands.
So you would access this performance data the same you would any other information elsewhere
in the registry. So that's kind of why I threw it in there. So all pretty straightforward,
I think. Now, if you ever have to go digging into the registry,
you'll have a little bit better understanding of what you're actually looking through.
If you enjoyed this video, definitely give it a big thumbs up for the YouTube algorithm.
This will probably be more of a shorter video, so let me know if you kind of like
these more simplified ones. If you want to keep watching, another fun video I have is where I was
deleting the Windows registry while Windows was actually running, just as an experiment.
So that was pretty fun. You can see what happens by clicking on that right there.
So thanks so much for watching, and I'll see you in the next one.