NT Registry Structure

HKEY_CLASSES_ROOT: it includes information related to OLE and file association. The purpose of setting this item is to provide compatibility with the current Windows 3.x.

HKEY_CURRENT_USER: used to manage information related to the user currently logged on to the system. The information includes:

The appearance and behavior presented by the user's desktop and NT Server to the user;
Connection with all network devices;
Desktop program, application parameter selection, screen color, and other personal interests, as well as security permissions. The information is saved for retrieval by the system when users log on;
When a user modifies the environment device, the information of this item is also changed.

HKEY_LOCAL_MACHINE: it includes information about the computer that is running NT, including application, driver, and hardware information. There are five independent projects under it:

HARDWARE: it is used to store computer HARDWARE information. During each system boot, HARDWARE must be re-created, which makes it easier to add new HARDWARE to the system. The modification does not take effect or make sense. There are four sub-projects under this project: DESCRIPTION: This includes CPU, FPU and system bus, while the system bus is about I/O storage and other device information; DEVICEMAP: the information is related to the keyboard, print port, mouse, and other devices. OWNERMAP: Information is about PCI-based devices. RESOURCEMAP: It mainly contains HAL (Hardware Abstraction Layer) and some information about I/O devices, drivers, SCSI adapter, system resources, and video resources;
SAM: The Security Account Manager (SAM) Stores users and information in SAM. No matter which editor is used, information in SAM is not accessible. The user management program of the system administrator is used to manage SAM information;
SECURITY: the information is related to local SECURITY and user permissions, and a copy of SAM information is also included. Of course, it cannot be edited by a General Editor. The main content is user permissions, password rules, and local group members;
SOFTWARE: contains information about the installed system SOFTWARE and user SOFTWARE, and the corresponding description. Each installed software product corresponds to one item, which stores the parameter selection information, configuration information, and MRU (recently used files) list, and other projects that can be modified by applications.
SYSTEM: includes information related to SYSTEM startup, device drivers, services, and NT Server configurations.
HKEY_USERS: contains information about all active users with user configuration files. It has two sub-projects:. DEFAULT and the ID of the current login user .. DEFAULT is intended for login users who do not have user configuration files.

HKEY_CURRENT_CONFIG: This item is not available in versions earlier than NT 4. Its information comes from HKEY_LOCAL_MACHINESYSTEM and HKEY_LOCAL_MACHINESOFTWARE, but it only saves part of the information.

HKEY_DYN_DATA: This is also the first appearance in NT 4. It contains the system's Plug and Play status. Because NT 4 does not support plug and play, the content of this item is empty. It may be used in later versions.