HKEY_USERS\.DEFAULT Help

[COKEDUDEUSF]

Can someone please explain what the HKEY_USERS\.DEFAULT is for. My interpretation from everything that I read is any time you create a new account on your computer the HKEY_USERS\.DEFAULT will be copied over to the HKEY_CURRENT_USER. Is that correct? If it is, then my computer is not behaving, I have created 3 accounts and my hive from HKEY_USERS\.DEFAULT is not being copied over to the HKEY_CURRENT_USER hive.

[Noise]

Can someone please explain what the HKEY_USERS\.DEFAULT is for. My interpretation from everything that I read is any time you create a new account on your computer the HKEY_USERS\.DEFAULT will be copied over to the HKEY_CURRENT_USER. Is that correct? If it is, then my computer is not behaving, I have created 3 accounts and my hive from HKEY_USERS\.DEFAULT is not being copied over to the HKEY_CURRENT_USER hive.

It's "supposed" to work that way, but it doesn't. The default hive loaded when you create a new user is located in:

C:\Documents and Settings\Default User\NTUSER.DAT

NTUSER.DAT is a registry hive and can be opened with regedit if you need to make changes, but its tricky to do:

1. Open Registry Editor.
   
2. In the registry tree (on the left), click either the HKEY_USERS or HKEY_LOCAL_MACHINE keys.
   
3. On the File menu, click Load Hive.
   
4. In Look in, click the drive, folder, or network computer and folder that contains the hive you want to load.
   
5. Click Open.
   
6. In Key Name, type the name that you want to assign to the hive (I use TEMPLATE), and then click OK.
   

[COKEDUDEUSF]

Can someone please explain what the HKEY_USERS\.DEFAULT is for. My interpretation from everything that I read is any time you create a new account on your computer the HKEY_USERS\.DEFAULT will be copied over to the HKEY_CURRENT_USER. Is that correct? If it is, then my computer is not behaving, I have created 3 accounts and my hive from HKEY_USERS\.DEFAULT is not being copied over to the HKEY_CURRENT_USER hive.

It's "supposed" to work that way, but it doesn't. The default hive loaded when you create a new user is located in:

C:\Documents and Settings\Default User\NTUSER.DAT

NTUSER.DAT is a registry hive and can be opened with regedit if you need to make changes, but its tricky to do:

1. Open Registry Editor.
   
2. In the registry tree (on the left), click either the HKEY_USERS or HKEY_LOCAL_MACHINE keys.
   
3. On the File menu, click Load Hive.
   
4. In Look in, click the drive, folder, or network computer and folder that contains the hive you want to load.
   
5. Click Open.
   
6. In Key Name, type the name that you want to assign to the hive (I use TEMPLATE), and then click OK.
   

What kind of program do you need if you wnt to view the NTUSER.DAT?

[nospoon]

Can someone please explain what the HKEY_USERS\.DEFAULT is for. My interpretation from everything that I read is any time you create a new account on your computer the HKEY_USERS\.DEFAULT will be copied over to the HKEY_CURRENT_USER. Is that correct? If it is, then my computer is not behaving, I have created 3 accounts and my hive from HKEY_USERS\.DEFAULT is not being copied over to the HKEY_CURRENT_USER hive.

The HKU\.DEFAULT is for the Local System account--when no users are logged on:

The .Default user is not the default user

If you ever gone spelunking in the HKEY_USERS registry key, you've no doubt found the user named HKEY_USERS\.Default. Who is this guy?

Despite its name, the profile for the .Default user is not the default user profile. It's actually the profile for the Local System account and is an alias for HKEY_USERS\S-1-5-18. (S-1-5-18 is the security identifier for the Local System account.) Consequently, settings in HKEY_USERS\.Default are used by programs and services that run as Local System. The most visible examples of programs that run as Local System are winlogon and logonui, the programs that display the interface for logging onto the system. Whatever color scheme and screen saver you choose for the Local System profile get used at the logon screen.

Unfortunately, the name .Default has led people to believe that this user's settings are the basis for new user profiles. In retrospect, calling it .Default was probably a bad decision. It just gave people the wrong idea.

http://blogs.msdn.com/oldnewthing/archive/...02/1786493.aspx

See also:

http://support.microsoft.com/kb/305709

http://support.microsoft.com/kb/291586

[COKEDUDEUSF]

Can someone please explain what the HKEY_USERS\.DEFAULT is for. My interpretation from everything that I read is any time you create a new account on your computer the HKEY_USERS\.DEFAULT will be copied over to the HKEY_CURRENT_USER. Is that correct? If it is, then my computer is not behaving, I have created 3 accounts and my hive from HKEY_USERS\.DEFAULT is not being copied over to the HKEY_CURRENT_USER hive.

The HKU\.DEFAULT is for the Local System account--when no users are logged on:

The .Default user is not the default user

If you ever gone spelunking in the HKEY_USERS registry key, you've no doubt found the user named HKEY_USERS\.Default. Who is this guy?

Despite its name, the profile for the .Default user is not the default user profile. It's actually the profile for the Local System account and is an alias for HKEY_USERS\S-1-5-18. (S-1-5-18 is the security identifier for the Local System account.) Consequently, settings in HKEY_USERS\.Default are used by programs and services that run as Local System. The most visible examples of programs that run as Local System are winlogon and logonui, the programs that display the interface for logging onto the system. Whatever color scheme and screen saver you choose for the Local System profile get used at the logon screen.

Unfortunately, the name .Default has led people to believe that this user's settings are the basis for new user profiles. In retrospect, calling it .Default was probably a bad decision. It just gave people the wrong idea.

http://blogs.msdn.com/oldnewthing/archive/...02/1786493.aspx

See also:

http://support.microsoft.com/kb/305709

http://support.microsoft.com/kb/291586

Thx for the links.

[Ascii2]

What kind of program do you need if you wnt to view the NTUSER.DAT?

A registry editor. In Windows 2000, the hive may be loaded using REGEDT32.EXE or REG.EXE. Edited August 25, 2008 by Ascii2