Loading

Friday, August 14, 2009

Windows Registry Hives - HKCR, HKCU, HKLM, HKU, HKCC, and HKPD

Information stored in the Registry is divided into several predefined sections called "hives". A registry hive is a top level registry key predefined by the Windows system to store registry keys for specific objectives.

On my Windows XP system, the Registry has 6 registry hives:
  • HKCR - Abbreviated from the registry key name HKEY_CLASSES_ROOT. HKCR stores information about registered applications, such as Associations from File Extensions and OLE Object Class IDs tying them to the applications used to handle these items.
  • HKCU - Abbreviated from the registry key name HKEY_CURRENT_USER. HKCU stores settings that are specific to the currently logged-in user. The HKCU key is a link to the subkey of HKEY_USERS that corresponds to the user; the same information is reflected in both locations.
  • HKLM - Abbreviated from the registry key name HKEY_LOCAL_MACHINE. HKLM stores settings that are general to all users on the computer. On my XP system, HKLM contains five subkeys, HARDWARE, SAM, SECURITY, SOFTWARE and SYSTEM.
  • HKU - Abbreviated from the registry key name HKEY_USERS. HKU contains subkeys corresponding to the HKEY_CURRENT_USER keys for each user registered on the machine.
  • HKCC - Abbreviated from the registry key name HKEY_CURRENT_CONFIG. HKCC contains information gathered at runtime; information stored in this key is not permanently stored on the hard disk, but rather regenerated at boot time.
  • HKPD - Abbreviated from the registry key name HKEY_PERFORMANCE_DATA. HKPD provides runtime information into performance data provided by either the operating system kernel itself or other programs that provide performance data. This key is not displayed in the Registry Editor, but it is visible through the registry functions in the Windows API.

No comments:

Post a Comment