Understanding HKEY_USERS in Windows Registry

The HKEY_USERS (HKU) root key is a core pillar of the Windows Registry that stores user-specific configuration settings for all actively loaded user profiles on a machine. This article explores the architecture of HKEY_USERS, its relationship to HKEY_CURRENT_USER, how Security Identifiers (SIDs) are mapped within its structure, and the critical role it plays in managing multi-user environments in the Windows operating system.

What Is HKEY_USERS?

HKEY_USERS is one of the five primary root keys (or hives) in the Windows Registry editor (regedit.exe). Its primary purpose is to act as the master repository for user-level configurations, containing individual hives for every active user profile currently logged into the system, as well as default and built-in system accounts.

Unlike HKEY_LOCAL_MACHINE (HKLM), which stores machine-wide settings applicable to the operating system and all users regardless of who is signed in, HKEY_USERS handles customized settings such as desktop wallpapers, installed user-level software, environment variables, taskbar preferences, and application-specific settings.

The Internal Hierarchy and Security Identifiers (SIDs)

Instead of listing usernames directly, HKEY_USERS organizes profiles using Windows Security Identifiers (SIDs). A SID is a unique string of alphanumeric characters assigned by Windows to identify a user, group, or computer account.

Inside HKEY_USERS, you will typically find the following subkeys:

• .DEFAULT: Contains base settings used by system accounts prior to any user logging in (often mistaken for the template for new users, which is actually stored in a separate template hive).
• Well-Known Service Accounts: Built-in Windows service accounts represented by short SIDs:
  • S-1-5-18: Local System account.
  • S-1-5-19: Local Service account.
  • S-1-5-20: Network Service account.
• User Profile SIDs: Unique identifier keys for active users, typically starting with S-1-5-21-....
• _Classes Subkeys: Keys ending in _Classes (e.g., S-1-5-21-..._Classes) contain user-specific file associations and COM registrations.

The Relationship Between HKEY_USERS and HKEY_CURRENT_USER

HKEY_CURRENT_USER (HKCU) is not an independent registry hive. Instead, it is a dynamic alias or symbolic link to the specific SID subkey within HKEY_USERS that belongs to the currently logged-in user.

When an application reads or writes to HKEY_CURRENT_USER, the operating system automatically redirects those requests to HKEY_USERS\<User-SID>. This mechanism allows software developers to target current user configurations without needing to programmatically query the user’s specific SID first.

How Profile Loading and Unloading Works

The contents of HKEY_USERS are dynamic:

1. Logon: When a user logs into Windows, the operating system reads their individual registry file—NTUSER.DAT, located in C:\Users\<Username>—and loads it as a subkey under HKEY_USERS matching that user’s SID.
2. Active Session: Any preferences modified during the session are written to this memory-backed hive.
3. Logoff: When the user signs out, Windows flushes the changes back to the NTUSER.DAT file on disk and unloads the subkey from HKEY_USERS, freeing system memory.

Summary of Key Functions

• Multi-User Isolation: Ensures that individual user settings, permissions, and app configurations do not conflict with or overwrite those of other users.
• Foundation for HKCU: Provides the actual storage location for the active user session exposed through the HKEY_CURRENT_USER shortcut.
• System and Service Configuration: Hosts baseline configurations for critical background services and system processes operating under distinct identity contexts.