Editing Windows Registry (section)

==== Windows NT ====
Windows NT systems store the registry in a binary file format which can be exported, loaded and unloaded by the Registry Editor in these operating systems. The following system registry files are stored in <code>%SystemRoot%\System32\config\</code>:
* <code>Sam</code> – {{code|HKEY_LOCAL_MACHINE\SAM}}
* <code>Security</code> – {{code|HKEY_LOCAL_MACHINE\SECURITY}}
* <code>Software</code> – {{code|HKEY_LOCAL_MACHINE\SOFTWARE}}
* <code>System</code> – {{code|HKEY_LOCAL_MACHINE\SYSTEM}}
* <code>Default</code> – {{code|HKEY_USERS\.DEFAULT}}
* <code>Userdiff</code> – Not associated with a hive. Used only when upgrading operating systems.<ref>{{cite web | url = https://technet.microsoft.com/en-us/library/cc722562.aspx | title = Overview of the Windows NT Registry | access-date = 2011-12-02}}</ref>

The following file is stored in each user's profile folder:
* <code>%USERPROFILE%\Ntuser.dat</code> – <code>HKEY_USERS\<[[Security Identifier|User SID]]></code> (linked to by HKEY_CURRENT_USER)

For Windows 2000, Server 2003 and Windows XP, the following additional user-specific file is used for file associations and COM information:
* <code>%USERPROFILE%\Local Settings\Application Data\Microsoft\Windows\Usrclass.dat</code> (path is localized) – <code>HKEY_USERS\&lt;User SID&gt;_Classes</code> ({{code|HKEY_CURRENT_USER\Software\Classes}})
For Windows Vista and later, the path was changed to:
* <code>%USERPROFILE%\AppData\Local\Microsoft\Windows\Usrclass.dat</code> (path is not localized) alias <code>%LocalAppData%\Microsoft\Windows\Usrclass.dat</code> – HKEY_USERS\&lt;User SID&gt;_Classes ({{code|HKEY_CURRENT_USER\Software\Classes}})

Windows 2000 keeps an alternate copy of the registry hives (.ALT) and attempts to switch to it when corruption is detected.<ref>{{cite web | url = https://technet.microsoft.com/en-us/library/cc750583.aspx | title = Inside the Registry | access-date = 2007-12-28}}</ref> Windows XP and Windows Server 2003 do not maintain a <code>System.alt</code> hive because [[NTLDR]] on those versions of Windows can process the <code>System.log</code> file to bring up to date a System hive that has become inconsistent during a shutdown or crash. In addition, the <code>%SystemRoot%\Repair</code> folder contains a copy of the system's registry hives that were created after installation and the first successful startup of Windows.

Each registry data file has an associated file with a ".log" extension that acts as a [[transaction log]] that is used to ensure that any interrupted updates can be completed upon next startup.<ref name="Norris">{{cite web|archive-url=https://web.archive.org/web/20090529202753/http://amnesia.gtisc.gatech.edu/~moyix/suzibandit.ltd.uk/MSc/Registry%20Structure%20-%20Main%20V4.pdf|format=PDF|url=http://amnesia.gtisc.gatech.edu/~moyix/suzibandit.ltd.uk/MSc/|date=February 2009|title=The Internal Structure of the Windows Registry|publisher=Cranfield University|archive-date=29 May 2009|last=Norris|first=Peter|url-status=dead}}</ref>  Internally, Registry files are split into 4&nbsp;[[Kilobyte|kB]] "bins" that contain collections of "cells".<ref name="Norris" />