35

Where is the Registry stored in Windows? I want to find the files shown when running regedit.exe (Windows Registry Editor).

4 Answers 4

46

If I think I understand what you are saying, the registry is kept in %SystemRoot%\System32\config whilst individual users settings are located at %UserProfile%\Ntuser.dat.

If I have got the wrong end of the stick here, please rephrase your question and I will be happy to help.

2
  • 14
    Don't forget %UserProfile%\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat for per-user file associations (HKCR\Software\Classes).
    – user1686
    Feb 20, 2010 at 20:32
  • 4
    A great resource for additional info and to support William Hilsum and grawity answers see below link: msdn.microsoft.com/en-us/library/ms724877%28v=vs.85%29.aspx
    – Tek'eek
    Apr 15, 2013 at 4:23
23

On disk, the Windows Registry isn’t simply one large file but a set of discrete files called hives. Each hive contains a Registry tree, which has a key that serves as the root (i.e., starting point) of the tree. Subkeys and their values reside beneath the root.

Location of Windows registry files The location of these registry hives are as follows:

HKEY_LOCAL_MACHINE\SYSTEM : \system32\config\system

HKEY_LOCAL_MACHINE\SAM : \system32\config\sam

HKEY_LOCAL_MACHINE\SECURITY : \system32\config\security

HKEY_LOCAL_MACHINE\SOFTWARE : \system32\config\software

HKEY_USERS\UserProfile : \winnt\profiles\username

HKEY_USERS.DEFAULT : \system32\config\default

enter image description here

Some hives are volatile and don’t have associated files. The system creates and manages these hives entirely in memory; the hives are therefore temporary in nature. The system creates volatile hives every time the system boots. Examples are:

HKEY_LOCAL_MACHINE\HARDWARE : Volatile hive HKEY_LOCAL_MACHINE\SYSTEM\Clone : Volatile hive

These files are database files, and only RegEdit, Regedit32 and the Kernel32 can read them. The primary tool in Windows 10/8/7 for working directly with the registry is Registry Editor. To access it, simply type Regedit in Start Menu Search Bar and hit Enter !

If you need to read more on this, head over to TechNet!

UPDATE: AccidentalADMIN has made a useful comment. He says:

Every Windows got a registry Key which lists every hive in system. Open Regedit and navigate to the following key to get a complete list:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\hivelist

http://www.thewindowsclub.com/where-are-the-windows-registry-files-located-in-windows-7

4

I think the quickest and nicest way to achieve this is using PowerShell.

$ Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\hivelist\

PS: You can navigate through the Registry as if it was a file system. In PowerShell use:

$ cd HKLM: 

or

$ cd HKCU: 
0

Microsoft offers project system app. The Registry File System (RegFS) sample creates a virtual projection of the local machine's registry into a file system folder using the Windows Projected File System (ProjFS).
It's available at github address.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.