The HKEY LOCAL MACHINE Key

The HKEY_LOCAL_MACHINE Key

HKEY_LOCAL_MACHINE is one of the most important, and most interesting, root keys of the registry. It contains configuration data for the local computer. Information stored in this registry key is used by applications and device drivers, and by the operating system itself for obtaining information on the configuration of the local computer. The information doesn't depend on the user who's logged in to the system.

The HKEY_LOCAL_MACHINE root key contains five subkeys, briefly described in Table 7.1. The rest of this section describes the subkeys in greater detail.

Note 

You can read the information contained in any of these subkeys, but it only makes sense to edit the contents of the Software and System keys.

Table 7.1: Subkeys Contained within the HKEY_LOCAL_MACHINE Root Key

Subkey	Contents
HARDWARE	This subkey contains the database describing all the hardware devices installed on the computer, the method of interaction between device drivers and hardware devices, and the data that connects kernel-mode device drivers with user-mode code. All the data contained within this subkey are volatile. The system re-creates these data each time it starts The Description subkey describes all the hardware physically present on the computer. The hardware recognizer collects this information at system startup and the kernel stores this information under the HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION registry key The DeviceMap subkey contains various data in formats defined by certain device driver classes. As device drivers are loading, they pass their information to the system so that it can associate specific hardware devices and their drivers The ResourceMap subkey contains information on the system resources allocated to each device (including ports, DMA addresses, IRQs). Notice that all Windows NT-based operating systems, including Windows 2000 and Windows XP, provide a much more convenient way to view the contents of this subkey. To view (and possibly change) this data, it is recommended that you use various administrative tools. For example, if you're using Windows NT 4.0, you can view the information using the Windows NT Diagnostics utility (Winmsdp.exe). In Windows 2000 and Windows XP, you can use the MMC console or Device Manager for the same purpose
SAM	This subkey contains the directory services database, which stores information on user and group accounts and security subsystems. (SAM stands for the Security Account Manager). By default, you can't view this key using registry editors even if you're logged in as an Administrator. The data contained within the HKLM\SAM registry key isn't documented, and user passwords are encrypted. Note that for Windows NT domains the SAM database also stores a domain directory services database. In native-mode Windows 2000 domains, the directory services database is stored in the Ntds.dit file on domain controllers. However, the SAM database remains important, since it stores local accounts (required to log on locally). If your computer that is running Windows XP does not participate in a domain, SAM database is the main storage of the user and group accounts information
SECURITY	This database contains the local security policy, including user rights and permissions. The key is only used by the Windows NT/2000/XP security subsystem. For example, it contains information that defines whether or not an individual user can reboot the computer, start or stop device drivers, backup/recover files, or access the computer through the network. Information contained within this key is also encrypted. The HKLM\SAM key is the link to the HKLM\SECURITY\SAM key
SOFTWARE	This database contains information on the software products installed on the local computer, along with various configuration data
SYSTEM	This database contains information on controlling the system startup, the loading order of device drivers and system services, and on the operating system behavior

If the HKEY_CURRENT_USER registry key contains data similar to that contained under HKEY_LOCAL_MACHINE, then the HKEY_CURRENT_USER data has priority by default.

Note 

If you read the previous chapter carefully, you'll remember that the Policy setting under HKEY_LOCAL_MACHINE has priority over the individual settings specified for each user. This is only true if you logged in to the system as an Administrator and specified the default value for the power policy, as described in Chapter 5.

However, the settings under this key may also extend the data under HKEY_LOCAL_MACHINE rather than replace them. Furthermore, there are certain settings (for example, those that manage the device driver loading order) that have no meaning outside the HKEY_LOCAL_MACHINE root key.