HKEY_LOCAL_MACHINE
Ubicación de la información de hardware, software
y seguridad
-
..\HARDWARE
This subkey maintains descriptions of the system's hardware and all
hardware device-to-driver mappings.
-
NTDETECT on x86 machines, or ARC firmware on RISC machines, collects information
on the system's hardware characteristics as the machine boots. NTDETECT
or ARC passes this information on to NT once NT's image has been started.
NT then stores this information in the HKLM\HARDWARE\DESCRIPTION subkey.
-
As device drivers start up and claim devices, they inform NT so that it
can associate devices with the drivers that control them. NT places this
mapping data in the HKLM\HARDWARE\DEVICEMAP subkey.
-
Serving a similar purpose, HKLM\HARDWARE\OWNERMAP associates the system's
buses (e.g., PCI and ISA) to drivers that control them.
-
Finally, device drivers inform NT of system resources that they claim for
their devices. Such resources include port addresses, physical memory ranges,
and interrupt numbers. NT keeps track of this information in the HKLM\HARDWARE\RESOURCEMAP
subkey to prevent conflicts.
Windows NT Diagnostics (Winmsdp.exe) lets you view Registry hardware information
that it obtains by simply reading values out of the HARDWARE key.
-
..\SAM
This key holds local and domain account information, such as user passwords,
group definitions, and domain associations. By default, this key is unreadable
by even the system administrator account. Looking inside HKLM\SAM is not
very revealing because the data is undocumented and the passwords are encrypted
with a one-way mapping (e.g., you cannot determine a password from its
encrypted form)
-
..\SECURITY
Here NT stores user and group policies. Examples of policies include
whether a particular user is allowed to reboot the machine, load device
drivers, back up files, or access the system remotely. SECURITY's information
is also encrypted. HKLM\SAM is linked into the SECURITY subkey under HKLM\SECURITY\SAM.
-
..\SOFTWARE
Like HKCU\Software, applications use HKLM\SOFTWARE to store private
settings. HKLM\SOFTWARE uses the same naming convention used at HKCU\Software,
but the type of data stored is usually different. Because the HKLM root
key is the same for all users who log on, it serves as a repository for
system-wide program settings. The information usually includes paths to
application files and directories and licensing, and expiration date information.
Another HKLM\SOFTWARE subkey is Windows\Current Version. This key is
a Windows 95-compatability key that contains system software parameters.
For example, the Explorer key includes information about desktop name-space
extensions such as Network Neighborhood and My Computer. Applications put
pointers to their uninstall programs in the Uninstall key. And AppPaths
is where NT stores the paths of applications it knows about. Executing
an AppPaths program from the Start menu's Run dialog box launches the program
by looking at its hard-wired location.
-
..\SYSTEM
-
...\Clone
-
...\ControlSet
The other ControlSet subkeys represent configurations such as Last
Known Good Configuration, a copy of the last profile the system successfully
booted with. You can look at the value Current under HKLM\SYSTEM\Select
to find out which ControlSet subkey CurrentControlSet maps to. Other values
under Select point at control sets associated with Last Known Good Configuration,
and the control set that last resulted in a failed boot attempt.
-
...\ControlSet001
-
...\ControlSet002
-
...\CurrentControlSet
NT links CurrentControlSet to the ControlSet subkey that corresponds
to the profile the system used in the boot of the current session.
-
Control Static NT tuning
and configuration parameters
-
Enum
Information collected when drivers and services are started
-
Hardware Profiles Video-related configuration information
-
Services Startup and error control
for device drivers and services
-
...\Disk
It is present on only systems that have run NT's Disk Administrator
program. HKLM\SYSTEM\DISK is where Disk Administrator stores information
about drive letter mappings, volume sets, mirrored volumes, and striped
sets.
-
...\Select
-
...\Setup
NT Setup creates the HKLM\SYSTEM\Setup subkey, which points subsequent
invocations of Setup at the System's root partition. NT uses the Setup\SystemSetupInProgress
value to determine whether to be in Setup or regular operation mode.