What Data Is Stored in HKEY_CURRENT_USER?

The HKEY_CURRENT_USER (HKCU) hive in the Windows Registry contains configuration settings, preferences, and environment variables specific to the user account currently logged into the operating system. It serves as an active shortcut to the user’s specific Security Identifier (SID) branch located under HKEY_USERS. This article outlines the specific categories and types of user profile data stored within the major subkeys of HKCU.

Core Data Subkeys Under HKEY_CURRENT_USER

AppEvents

• Sound Schemes: Associations between system events (e.g., login, critical stop, notifications) and specific sound files (.wav).
• Application Event Triggers: Sound configurations for specific third-party applications.

Console

• Command-Line Interface Settings: Configuration for Command Prompt and PowerShell windows.
• Display Properties: Custom font styles, font sizes, window sizes, cursor sizes, and screen buffer dimensions.
• Color Schemes: Default background and text colors for console windows.

Control Panel

• Desktop Preferences: Desktop wallpaper path, wallpaper style (tile, stretch, fit), screensaver choices, and active visual themes.
• Input Devices: Mouse settings (pointer speed, double-click sensitivity, button swapping) and keyboard repeat rates.
• Regional & Language Settings: Date formats, time formats, currency symbols, measurement units, and locale information.
• Accessibility Options: High-contrast modes, Sticky Keys, Filter Keys, and narrator preferences.
• Power Schemes: User-specific display timeout and sleep preferences.

Environment

• User Environment Variables: Personal environment variables such as user-specific PATH, TEMP, and TMP directory paths, which override or append to system-wide variables.

Keyboard Layout

• Active Input Methods: Currently active keyboard layouts and language input profiles.
• Layout Substitutes: Custom key mappings and IME (Input Method Editor) settings.

Network

• Mapped Network Drives: Persistent drive mappings assigned specific drive letters (e.g., Z:), including the remote UNC path and reconnection behavior upon logon.

Printers

• Default Printer: The designated default printing device for the user.
• Printer Connections: Per-user network printer connections, driver associations, and custom print queue preferences.

Software

• Application Settings: User-specific settings, configurations, and license keys for installed software (e.g., Microsoft Office, third-party browsers, design software).
• Windows Shell & Explorer: Stored under Software\Microsoft\Windows\CurrentVersion\Explorer, this includes:
  • Taskbar layout, pinned shortcuts, and notification area behaviors.
  • File Explorer view preferences (hidden file visibility, file extensions, icon sizes).
  • Recent files, Jump Lists, and run history (RunMRU).
  • Default file associations and “Open With” handler choices.

Volatile Environment

• Session-Specific Data: Temporary variables generated during the active logon session, such as LOGONSERVER, USERDOMAIN, USERNAME, APPDATA, and LOCALAPPDATA paths. This data is not preserved across logoffs.