Root Hives Displayed in Windows Regedit

When you open the Windows Registry Editor (Regedit), the left navigation pane displays five major root keys, commonly referred to as root hives. This article identifies each of these five default root hives, explains their specific roles in the Windows operating system, and details the difference between system-wide and user-specific configurations.

1. HKEY_CLASSES_ROOT (HKCR)

HKEY_CLASSES_ROOT contains configuration data regarding file name extension associations and Component Object Model (COM) class registrations. It ensures that Windows opens the correct application when a user double-clicks a file. This hive is actually a merged view of HKEY_CURRENT_USER\Software\Classes and HKEY_LOCAL_MACHINE\Software\Classes, giving priority to current user settings.

2. HKEY_CURRENT_USER (HKCU)

HKEY_CURRENT_USER stores configuration settings and preferences specific to the user account currently logged into the system. This includes environment variables, desktop settings, mapped network drives, application preferences, and personal control panel configurations. It is a direct link to the currently active user’s subkey in HKEY_USERS.

3. HKEY_LOCAL_MACHINE (HKLM)

HKEY_LOCAL_MACHINE contains system-wide configuration settings that apply to the computer and all users who log into it. It holds critical data regarding physical hardware, device drivers, installed software, security policies, and the Windows boot process. The data in this hive is essential for the operating system to start and run properly.

4. HKEY_USERS (HKU)

HKEY_USERS contains individual configuration profiles for all user accounts loaded on the machine, including the default user template and built-in system service accounts (such as LocalSystem, NetworkService, and LocalService). When a user logs in, their profile is loaded here, and a pointer is mapped to HKEY_CURRENT_USER.

5. HKEY_CURRENT_CONFIG (HKCC)

HKEY_CURRENT_CONFIG contains real-time hardware profile information gathered during system startup. It stores details about the current hardware profile used by the local computer system. This root hive is a shortcut that points to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\Current.